paysafe

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications. The threat actor published at least 17 malicious packages simultaneously, each tasked to exfiltrate credentials and access tokens to a command-and-control server hosted on Amazon Web Services (AWS). All three payment platforms are popular, with Paysafe being mostly used by e-commerce sites and online marketplaces, gaming platforms, travel businesses, and financial services or software-as-a-service (SaaS) providers. Skrill and Neteller are digital wallets and money transfer services used in online betting, cryptocurrency exchanges, and on Forex trading platforms. Software developers working on such platforms integrate Paysafe’s SDKs into apps and websites to implement a secure payments and funds management system. According to application security company Socket, these developers are the targets of the latest campaign via the following packages: npm/paysafe-checkout npm/paysafe-vault npm/neteller npm/skrill-payments npm/paysafe-js npm/paysafe-api npm/paysafe-node npm/paysafe-cards npm/paysafe-fraud npm/paysafe-kyc npm/skrill npm/skrill-sdk npm/paysafe-payments pypi/paysafe-kyc pypi/paysafe-payments pypi/paysafe-sdk pypi/paysafe-api The researchers say that the 13 npm packages published four malicious versions, from 1.0.0 to 1.0.3, whereas the PyPI packages published only one malicious version, 1.0.0. All 17 packages pretend to be legitimate payment SDKs, even exposing the expected APIs, but instead return fake success responses rather than communicate with Paysafe’s backend services. The real purpose is credential theft, as the embedded malicious code searches compromised environments for secrets such as tokens, passwords, and API keys. According to Socket, the exfiltrated data includes Paysafe API keys, AWS keys, GitHub tokens, npm tokens, hostname, username, and metadata about API usage. The data theft module in the npm packages attempts exfiltration only if a Paysafe API key is present and activates when the fake SDK is called. The PyPI packages automatically activate the data theft routine upon initialization and do not require a Paysafe API key to be present at all. Socket’s analysis of the malware reveals that it includes some rather basic anti-analysis features, stopping execution if it detects fewer than 2 CPU cores or if the hostname or username contains cues indicating a virtualized environment. It is unclear who is behind this campaign, but Socket's report highlights some attributes suggesting that the threat actor is sufficiently technical and may return in a more organized way. The researchers warn that the attacker's ability to pivot between ecosystems may make it more difficult to defend if there is only one ecosystem of visibility. If any of the listed packages were installed, developers are recommended to immediately "rotate all secrets on any machine that imported or executed this package." The researchers also advise searching dependency trees for the package names used in the campaign and deny any requests for them at the registry proxy level. It is also recommended to look in the logs of Continuous Integration (CI) systems for PAYSAFE_API_KEY in combination with any of the listed package names. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity jobs available right now: March 24, 2026 Application Security Analyst Alignerr | USA | Remote – No longer accepting applications As an Application Security Analyst, you will review and analyze application security scenarios across code, APIs, and system behavior. You will classify vulnerabilities such as authentication flaws, injection risks, and business logic issues, and evaluate secure coding practices and remediation strategies. You will also help create and validate security-focused reasoning datasets that train AI to accurately assess application risks. Application Security Engineer E.ON Digital Technology | Germany | Hybrid – No longer accepting applications As an Application Security Engineer, you will support the development and rollout of the application security roadmap. You will work closely with development and operations teams to enforce security practices and provide guidance early in the software development lifecycle to identify and mitigate risks. You will collaborate with Technology Platform teams to integrate security tools and processes into CI/CD pipelines, and guide developers on secure coding practices while helping remediate vulnerabilities. Cloud Security Lead Tata Consultancy Services | Ireland | Hybrid – No longer accepting applications As a Cloud Security Lead, you will own and govern cloud security controls across public and hybrid environments, including identity and access management, network security, workload and data protection, configuration baselines, and logging. You will provide cloud security architecture assurance for new and evolving solutions, ensuring alignment with security standards, risk appetite, shared responsibility models, and regulatory requirements. Get weekly updates on new cybersecurity job openings. Subscribe here! Corporate Cyber Security Specialist Paysafe | Ireland | Hybrid – No longer accepting applications As a Corporate Cyber Security Specialist, you will As a Corporate Cyber Security Specialist, you will lead small to medium security projects and support major initiatives, including the expansion of Microsoft 365 security services. You will design, implement, and optimize security automation, including ASR rules and other M365 controls. You will manage and enhance core security tools such as CASB solutions and CyberArk PAM, and build and strengthen IAM/IGA capabilities (Entra ID, SailPoint, Saviynt, Pathlock), including JML automation and access governance. Cyber Security Analyst The Cambridge Building Society | United Kingdom | Hybrid – No longer accepting applications As a Cyber Security Analyst, you will monitor and analyze outputs from security tools to identify early indicators of compromise. You will respond to cyber events and incidents, recommending and taking action to protect systems and data. You will fine-tune and enhance existing security controls to maximize their effectiveness, and coordinate regular testing, audits, and external security assessments, ensuring findings are risk-assessed and remediated within agreed timescales. Cybersecurity Automation Engineer Assurant | India | On-site – No longer accepting applications As a Cybersecurity Automation Engineer, you will design, implement, and maintain security solutions aligned with Assurant’s Information Security Policies and Standards. You will support technologies across applications, infrastructure, and endpoint security, and identify, assess, and remediate hardware and software vulnerabilities. You will ensure the confidentiality, integrity, and availability of enterprise systems, develop and recommend practices to prevent unauthorized access or data loss, and measure, analyze, and report compliance with security policies to leadership. Cybersecurity SOC L3 ZENDATA Cybersecurity | UAE | On-site – No longer accepting applications As a Cybersecurity SOC L3, you will lead SOC operations with a focus on operational excellence, visibility, and responsiveness. You will manage and mentor SOC analysts, fostering skill development and collaboration. You will drive SOC optimization through process improvements, automation, and technology adoption, and build and execute a strategic roadmap aligned with evolving threats and business goals. Head of Cyber Security Aneurin Bevan University Health Board | United Kingdom | On-site – No longer accepting applications As a Head of Cyber Security, you will provide strategic leadership and operational oversight for the organization’s cyber security posture, ensuring the protection of digital assets, clinical systems, and sensitive information. You will be responsible for developing and implementing cyber security strategy, managing risk, leading incident response, and ensuring compliance with national standards, regulatory requirements, and NHS Wales policies. Engineering Manager, Software Supply Chain Security: Pipeline Security GitLab | Canada | Remote – No longer accepting applications As an Engineering Manager, Software Supply Chain Security: Pipeline Security, you will guide the design and delivery of software supply chain security features, with a focus on CI job artifact security. You will lead the implementation of the SLSA framework in GitLab CI/CD and integrate capabilities such as SBOM, software composition analysis, and vulnerability management. Engineer – Network and Security KATIM | UAE | On-site – No longer accepting applications As an Engineer – Network and Security, you will architect, design, and implement scalable, resilient network solutions. You will deploy and manage network devices, including routers, switches, firewalls, and load balancers, ensuring availability, reliability, and performance meet business requirements. You will develop and enforce security policies, protocols, and procedures to protect the organization’s network and data, and conduct regular security assessments and audits to address vulnerabilities and ensure compliance with industry standards. Global Head IT Security & Compliance Lonza | France | Hybrid – No longer accepting applications As a Global Head IT Security & Compliance, you will develop, implement, and oversee a strategic enterprise information security and IT risk management program, including establishing and enforcing security policies and standards across the organization. You will create and manage security and risk awareness training for employees and system users, facilitate IT risk assessments in collaboration with stakeholders, and ensure compliance with relevant laws, regulations, and policies to minimize risk and audit findings. IT Security SecOps LSEG | France | Hybrid – No longer accepting applications As an IT Security SecOps, you will monitor cybersecurity events from internal tools and outsourced detection services. You will coordinate response and recovery efforts with IT teams, deliver cybersecurity service activities including SLA and KPI monitoring for insourced operations, and oversee outsourced security services to ensure effective performance and alignment. Penetration Tester Hacktive Security | Italy | Remote – No longer accepting applications As a Penetration Tester, you will lead and conduct comprehensive tests across systems, networks, web and mobile applications, and other digital assets. You will identify, assess, and ethically exploit vulnerabilities within client environments, and provide expert guidance on security best practices and risk mitigation to both technical and non-technical stakeholders. Safeguards Analyst, Account Abuse Anthropic | USA | Hybrid – No longer accepting applications As a Safeguards Analyst, Account Abuse, you will As a Safeguards Analyst, Account Abuse, you will develop and refine account signals and prevention frameworks that turn internal and external data into actionable abuse indicators. You will build and optimize identity and account-linking signals using graph-based infrastructure to detect coordinated, large-scale abuse. Security Engineer Paragon | Israel | On-site – No longer accepting applications As a Security Engineer, you will implement, configure, and maintain information security systems. You will continuously review and improve the organization’s infrastructure security architecture, ensuring that all requirements defined by the CISO and security team are properly implemented and aligned with the overall design. You will also actively monitor and analyze systems, firewalls, and logs to detect and respond to potential threats. Security Engineer Air Apps | USA | On-site – No longer accepting applications As a Security Engineer, you will develop and implement threat modeling to identify risks across applications and infrastructure. You will conduct vulnerability scanning, penetration testing, and security assessments to uncover weaknesses. You will define and enforce secure coding practices in collaboration with development teams and work with DevOps to integrate security into CI/CD pipelines and automate testing. Senior Cloud Security Consultant CyberCX | Australia | Hybrid – No longer accepting applications As a Senior Cloud Security Consultant, you will work with customers to design and deliver cloud security solutions, including native controls and third-party CSPM, CNAPP, or CIEM tools. You will assess the risk of existing cloud environments, workloads, and services against industry standards and frameworks, and provide recommendations to improve security posture. You will also prepare and present high-quality deliverables such as presentations, pre-sales proposals, assessment findings, and strategic recommendations. Senior Cloud Security Engineer Haventree Bank | Canada | Hybrid – No longer accepting applications As a Senior Cloud Security Engineer, you will act as the technical owner for key cloud security platforms, influencing configuration, detection logic, and roadmap in partnership with operations teams. You will define and maintain cloud security reference architectures across a multi-cloud environment, covering identity, network segmentation, encryption, workload protection, logging and monitoring, and secure service integration. You will also establish secure patterns for Infrastructure as Code, including secure-by-default templates, scanning expectations, and drift management. Senior Cyber Incident Responder Labcorp | USA | Hybrid – No longer accepting applications As a Senior Cyber Incident Responder, you will you will serve as the lead responder for validated cyber incidents, prioritizing threats that could impact clinical operations, EHR systems, connected medical devices, or PHI. You will coordinate with technical and clinical stakeholders to contain and remediate threats across hospitals, clinics, and remote care environments. You will drive improvements to the Incident Response Plan, ensuring readiness for ransomware, business email compromise, and other threats. Senior SAP ERP Security Specialist Merck Group | Germany | On-site – No longer accepting applications As a Senior SAP ERP Security Specialist, you will lead the security architecture across SAP S/4HANA and SAP ECC environments, ensuring alignment with enterprise security frameworks. You will manage user access governance and compliance, and integrate robust security controls into critical business processes. You will also monitor SAP systems for vulnerabilities, conduct risk assessments, and drive continuous improvement in security practices. SOC Analyst Tier 2 Elad Software Systems | Israel | Hybrid – No longer accepting applications As a SOC Analyst Tier 2, you will investigate and respond to escalations from Tier 1 analysts. You will conduct in-depth analysis of complex security alerts, including incidents, breaches, malware, phishing, and unauthorized access attempts. You will perform proactive threat hunting using advanced analytics, event correlation, and MITRE ATT&CK methodologies, and carry out endpoint forensics and network traffic analysis to identify attack vectors and scope. Vulnerability Analyst NTT DATA | Italy | On-site – No longer accepting applications As a Vulnerability Analyst, you will conduct vulnerability assessments using tools such as Nessus, Qualys, Rapid7, and OpenVAS. You will validate automated scan results to eliminate false positives, analyze vulnerabilities to assess exploitability and business impact, and create detailed reports with actionable remediation guidance. You will evaluate vulnerabilities using CVSS scoring and business context, prioritize remediation based on risk and asset criticality, and collaborate with threat intelligence teams to incorporate emerging threat data. Vulnerability Researcher Delta Dental Ins. | USA | Remote – No longer accepting applications As a Vulnerability Researcher, you will conduct research to identify high-impact, previously unknown vulnerabilities across a wide range of applications and technologies, including AI-enabled systems. You will perform vulnerability assessments using industry best practices across web applications, APIs, and cloud environments.