June 26, 2026
- Nextron began scanning Packagist and flagged a malicious PHP package,
dcat-auth-google-2fa@v1.0.2.0, with obfuscated credential exfiltration tor[.]keepex[.]xyzand a hardcoded 2FA bypass code. Nextron · Threat Intelligence
in Malware Weaponizes Prompt Injection to Sabotage AI Analysis as Gamaredon Retools Against Ukraine