MALWARE 516
- Polymarket Users Lose $2.7 Million in Third-Party Script Hack
- Threat Researcher's Notebook How Attackers Redirect Crypto Payments
- Official Claude Code Extension Compromise Security Advisory
- Unveiling Sirius Backdoor A Multistage Fileless Campaign Disguised as FedEx Invoices
- Abandoned Popcorn Time App Exposed Millions of Devices to RCE Attacks
- Prince of Persia A Threat Group Hiding in Plain Sight
- New BlackX UEFI Bootkit Exploiting Baton Drop
- Dissecting Operation FlashHole A Complex Attack by Lazarus
- How I Got Over 300 Tor Exit Nodes Removed
- PSA Patch Your Plex Media Server Before Someone Hacks It
- AOMEI Backupper Update Servers Hijacked to Push Malware Check Your PC
- The Next MOVEit May Already Be in Your File Transfer Queue
- Exposing AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware
- ARMORY CASTLE Exploits BeyondTrust
- CikaBika Bot Inside a Discord RAT
- Kris McConkey on X Insights into RedRelay and APT15
- AI Models May Be Capable of Self-Replicating Without Access to a Datacenter
- Nippon Columbia Malware Incident Exposes 8.6 Million Karaoke Fan Records
- Matchboil New Tricks Same Old Evil Intentions
- Darksword Variant Threat Research
- Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones
- Earth Sirrush A Russia-Aligned Intrusion Set With 4 Years of Evolving Espionage Tooling
- Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers
- Blinder Tunnel Targets Critical Infrastructure
- ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
- Malware Campaign Impersonates European Donors to Target Moldovan Media and Civil Society
- Fake ChatGPT Ads on Google Lead to Malware Installation
- MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
- Global Group Ransomware Abuses WinMerge to Deploy Encryptor
- Star Blizzard Refines Phishing And Malware Delivery With The Redflick Technique
- SMTP is the key BPFDoor and AVERAT hitting the network edge
- Fake iPhone Duo Preorder Scam Triggers DarkSword Attack
- NeedyMantis Unpacking a Post-Compromise Malware Family
- Kothamine Malware Uses Tailscale's Tailcat to Evade Network Detection
- New RemControl Android Banking Malware Targets Users in Europe and Canada
- The Closed Quorum Inside the First Reported Autonomous AI C2 Implant
- MovieReaper Malware Uses The Odyssey Torrents to Infect Users Worldwide
- The Fake Sites Using a Cheap Toolkit to Sell $2,000 AI Subscriptions
- Neural Override - AI-Orchestrated RAT With SCADA Tasking
- From Fake Interviews to Malicious Repositories Disrupting Contagious Interview
- North Korean Cyber Actor Group Targeting IT Professionals
- Beware the SparroWock The Backdoor That Bites, The Commands That Catch
- Fake Calendar Invites Can Infect Your System How to Protect Yourself
- Brevo Supply-Chain Attack Injected ClickFix Scripts on Customer Sites
- Update on Iranian Cyber Actors' Malware Deployment
- Operation RapidRust APT36 Deploys New Malware Tools
- Advisory on Iranian Cyber Targeting of Dissidents, Activists, and Journalists
- Iranian Cyber Targeting of Dissidents, Activists and Journalists
- Low-quality Casino Sites Conceal Highly Dangerous Threat Actors
- HBO Max's Verified Reddit Account Hijacked to Spread Malware
- Twitch Extension Exposes Users' OAuth Tokens
- 3BB Attacker Used MeshCentral Backdoor for Root Access
- India's STPI Serves TerminalFix-Style Attack via Fake Cloudflare Check
- MantaxOtax Android Malware Combines Ransomware With Spyware
- New Android Malware Encrypts Files, Steals Data, and Harasses Victims
- JSCeal Hides Crypto Malware in V8 Bytecode
- Contagious Interview Trojanized macOS Installers
- New Backdoors from Toy Ghouls
- Chinese Speaking Threat Actors Targeting Mexican Android Users With Remote Access Trojan
- Rogue ScreenConnect Installations Suggest Worm-Like Activity
- Node.js Old Technique Makes a Comeback
- BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
- Russian Hacker Faces Up to 20 Years in Prison Following Extradition and Indictment
- Mirage Kitten Switches to Node.js and JavaScript Malware
- Financially Motivated Threat Actor BREEZE COMET Targets Brazil
- 23-Year-Old Noboru Botnet Dismantled in Global Law Enforcement Operation
- Security Incident – BGP Hijacking
- Breaking the Seal Static Deobfuscation of JSCeal's Compiled V8 Bytecode
- JavaScript Obfuscation From Party Trick to Phishing Kit
- Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption
- Caught in 4K The Aurora Files
- Carry-On Compromise TA4922 Packs PackClient
- A Polymorphic Phishing Page That Occasionally Breaks Itself
- Beware of Fake Indeed Interview Apps Used to Install Spyware
- Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
- ToxicPanda Android Malware Uses VPN Permissions to Block Google Play
- The Invisible Passenger in Your Car
- New Agent Tesla Malware Variant Boosts Evasion Capabilities
- Trapping a Mustang Panda
- Rust Supply Chain Attack on arrayref Significant Overlap with DPRK Campaigns
- Manic The Android Malware That Exfiltrates Data Even When the Phone Is Offline
- A New Era of Bulletproof Hosting Providers Emerge
- Operation CameraSwarm Over 14,000 Dahua Cameras Compromised Across Ukraine and Russia
- Revealed Cyber Spies Used Malware from GitHub to Hack EncroChat Cryptophone Network
- C2Looper A New Backdoor Likely Tied To Ransomware With GitHub C2
- Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware
- Signed, sealed, injected The mechanics of DCRat in 2026
- Multi-Functional Linux Botnet "Evooo1Bot"
- Abyssos Technical Analysis of a New Modular RAT
- Hackers Breach TrueConf to Trojanize Client Installers with Backdoors
- ENDLESSDOORS Is Phoning Home. Pick Up.
- Don't Revoke That Token Yet Inside the keyv/cacheable npm Worm
- New XCSSET Variant Targets macOS Developers via Compromised Xcode Projects
- Massive ChainDrop npm Supply-Chain Attack Infects Hundreds of Packages
- How Aqua Detected a Cryptomining Attack in Memory
- QuickFox Supply Chain Attack Used to Deploy FDMTP Implant
- Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
- Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
- Mirage Kitten's New Malware Set NightLedger Backdoor and Two Tunneling Tools
- New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide
- AutoIT Payload Injector A New Wave of Malware
- GitHub Introduces 3-Day Dependabot Cooldown to Combat Malware
- MedusaHVNC Trojan Creates Hidden Desktops to Hijack Browsers and Steal Data
- Dear Diary Today I Found A Ghost In The Network
- Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
- New Dolphin X Malware Uses AI to Rank High-Value Targets
- Ta488 Targets Zimbra Mailservers with Half Click Exploits
- New Dolphin X Malware Uses AI to Rank High-Value Targets
- Cruciferra Crypter Uses Process Ghosting to Evade Detection
- Begun, the Patch Wars Have
- UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant in Financially Motivated Campaign
- ThreatsDay Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories
- OkoBot New Sophisticated Malware Framework Targets Cryptocurrency Users
- The Serpent's Tongue Luring the Python Out of Its Den
- Malicious Go Module Exposes GitHub Malware Lure Network
- Operation Dragonreturn China Nexus Cyber Espionage Campaign Targeting Indian Tax Infrastructure
- New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
- GodDamn Ransomware Latest Beast Rebrand Uses Malicious Driver to Disable Defenses
- Telegram-Hosted RedWing Malware Lets Anyone Rent Android Spyware Tools
- RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
- Cavern Manticore Exposing Iran-Linked Modular C2 Framework
- PamStealer Mimics Maccy Clipboard Manager Silently Harvests Data and Clipboard Contents
- Google Takes Action Against Malicious Residential Proxy Networks
- Fake Google and Cloudflare Verification Pages Spread Multiple Malware Families
- WinRAR Flaw Could Allow Attackers to Take Control of Your Computer
- RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
- New ChocoPoC Malware Targets Researchers via Trojanized PoC Exploits
- Brazilian Banking Trojan Ousaban Targets Spain and Portugal
- RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
- Browser-Only Ransomware From LLM Hallucinations to a Practical Attack Technique
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
- StegoAd How 119 Fake Browser Extensions Stole Credentials and Ran Ad Fraud for Two Years
- From Bing Search to Ransomware Bumblebee and AdaptixC2 Deliver Akira
- The Latest Addition to Turla's Intelligence Gathering Apparatus
- New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks
- CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
- AsyncRAT Family Threat Overview
- STOCKSTAY The Latest Addition to Turla's Intelligence Gathering Apparatus
- Introduction to COM Usage by Windows Threats
- One-two Punch Delivered in Global Operation Disrupts Cybercrime Assembly Line
- Malicious Edge Extension Abuses Native Messaging as Bridge to Malware
- Linux Process Name Masquerading
- Be on the lookout for Mistic, a new backdoor used by ransomware broker
- INC Ransomware Targets Mainframes
- Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs
- Thousands of D-Link Routers Under Control of AryStinger Botnet
- New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer
- Large-Scale Malware Distribution Campaign on GitHub Uncovered
- New Abuse of the ClickOnce Technology, Part 1 The Inner Workings of ClickOnce Application Deployment
- Popa Botnet Linked to Publicly-Traded Israeli Firm
- Operation Endgame Disrupts SocGholish Malware Infrastructure
- Roblox Developers Face Malware Attacks Losing Entire Games
- Junior Hacker Used Tailscale and OpenSSH to Maintain Access After C2 Went Offline
- Hidden in Teams DragonForce Attackers Weaponize Microsoft Teams Relays
- FishMonger's Arsenal Upgraded SprySOCKS for Windows
- Dissecting Sapphire Sleet's macOS Intrusion from Lure to Compromise
- Evil MSI Background BASE64 Statistical Analysis
- Hackers Hide New Argamal Malware Inside Working Hentai Games
- Phone Battery Draining Fast? Malware Is One of 8 Possible Factors - How to Tell for Sure
- OnyxC2 Malware-as-a-Service Offers Enterprise-Grade Data Theft
- Phishing Attacks Leverage TikTok, Instagram Reels
- BLUERABBIT A Golang-Based Backdoor with Ransomware and Destructive Capabilities
- Magecart Skimmer Turns Stripe into a Malware Command Server
- VerdantBamboo Just Another BRICKSTORM in the Firewall
- Argamal RAT Distributed with Hentai Games
- From Malspam to DesckVB RAT Deployment
- Mini Shai-Hulud Campaign Compromises Red Hat Cloud Services
- Pointing a Cursor at Evading Detection
- Inside Gamaredon Cyber Operations FSB's Matryoshka
- Unidentified RAT Pushes NetSupport RAT
- Tracking APT28 PixyNetLoader Evolutions from 2024 to 2026
- GREYVIBE A Russia-nexus Group Leveraging AI in State-Aligned Operations
- 17 Million Strong Botnet of Compromised Devices Dismantled by Dutch Authorities
- Hackers Disguised as IT Support Installing Malware In-Person, FBI Warns
- CVE-2026-35616 FortiClient EMS Flaw Actively Exploited in Malware Attacks
- Commit to Compromise A New Threat Actor Targeting the Cryptocurrency Industry
- Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
- PyrsistenceSniper Advanced Tool for Detecting Malware Techniques
- An Example of Stack String in High Level Language
- Megalodon Chums the Waters in 5.5K+ GitHub Repo Poisonings
- Cloud Atlas Targets Russian and Belarusian Public Sector with New Tools
- Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor
- Disrupting Fox Tempest A Cybercrime Service
- New Reaper Malware Uses Fake Microsoft Domain to Steal macOS Passwords
- Gamaredon's Infection Chain Spoofed Emails, GammaDrop and GammaLoad
- Kazuar Anatomy of a Nation-State Botnet
- ClickFix Finds a Backup Plan in PySoxy Proxy Chains
- New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots
- Darcula aka. Magic Cat - Blog
- Flash Alert EtherRat and TukTuk C2 End in The Gentleman Ransomware
- OceanLotus Distributing ZiChatBot Malware via PyPI Packages
- Attackers Adopt JavaScript Runtime Bun to Spread NWHStealer
- Sailor Framework - Chinese Backed Phishing Services
- Trojan Abuses Microsoft Phone Link App to Steal Your Passwords
- DigiCert Hacked with a Malicious Screensaver File
- Microsoft Defender Flags DigiCert Certs as Trojan
- EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades
- DeepDoor Python Backdoor Evades Detection On Windows
- New Android Spyware Morpheus Linked to Italian Surveillance Firm
- VECT Ransomware by Design, Wiper by Accident
- DragonBreath A Critical 0-Day Vulnerability in the Kernel
- Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
- FIRESTARTER Backdoor Malware Analysis
- FIRESTARTER Backdoor Analysis
- FIRESTARTER Backdoor Analysis by CISA
- Tropic Trooper AdaptixC2 and Custom Beacon Uncovered
- Fake Google Antigravity Downloads Are Stealing Accounts in Minutes
- New NGate Malware Developed Using AI Hides in NFC Payment Apps
- Fake Google Antigravity Downloads Are Stealing Accounts in Minutes
- Beyond the Breach Inside a Cargo Theft Actor's Post-Compromise Playbook
- ZionSiphon Malware Threatens Water Treatment Systems
- From APT28 to RePythonNET Automating .NET Malware Analysis
- Compromised DVRs and Finding Them in the Wild
- Omnistealer Uses the Blockchain to Steal Everything It Can
- Ransomware-Linked ViperTunnel Malware Hits UK and US Businesses
- Scans for EncystPHP Webshell
- OpenSSF Flags Malware Campaign on Slack Posing as Linux Foundation Figures
- Mirax Android Trojan Turns Devices Into Residential Proxy Nodes
- Mirax Android Trojan Turns Devices Into Residential Proxy Nodes
- Slithering Through the Noise - Deep Dive into the VIPERTUNNEL Python Backdoor
- The Threat Hunter's Gambit
- npm Malware, Fake Devs, and Deepfake Videos These Are A Few of My Favorite DPRK Things
- npm Malware, Fake Devs, and Deepfake Videos - A Few of My Favorite DPRK Things
- New Lua-based Malware 'LucidRook' Targeting Taiwanese Organizations
- Hackers Attempt to Turn ComfyUI Servers Into Cryptomining Proxy Botnet
- Qilin EDR Killer Infection Chain
- Researchers Observe Sub-One-Hour Ransomware Attacks
- Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures
- Malicious Script That Gets Rid of ADS
- New RoadK1ll WebSocket Implant Used to Pivot on Breached Networks
- New RoadK1ll WebSocket Implant Used to Pivot on Breached Networks
- Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
- Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
- These Warning Signs Could Mean Spyware Is On Your Phone - And 9 Ways To Keep It Secure
- Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities
- Researchers Uncover WebRTC Skimmer Bypassing Traditional Defenses
- BPFdoor in Telecom Networks Sleeper Cells in the Backbone
- These Warning Signs Could Mean Spyware Is On Your Phone - And 9 Ways To Keep It Secure
- Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities
- Researchers Uncover WebRTC Skimmer Bypassing Traditional Defenses
- BPFdoor in Telecom Networks Sleeper Cells in the Backbone
- Kamasers Analysis A Multi-Vector DDoS Botnet Targeting Organizations Worldwide
- Kamasers Analysis A Multi-Vector DDoS Botnet Targeting Organizations Worldwide
- Trivy Compromised Everything You Need to Know about the Latest Supply Chain Attack
- Trivy Compromised Everything You Need to Know about the Latest Supply Chain Attack
- Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers
- Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers
- Crypto Scam 'ShieldGuard' Dismantled After Malware Discovery
- Transparent COM Instrumentation for Malware Analysis
- Warlock Ransomware Group Enhances Post-Exploitation Techniques
- Katana A Mirai Variant Targeting Android TV Set-Top Boxes
- How to Examine Polyglot Files with Spectra Analyze
- GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos
- AppsFlyer Web SDK Hijacked to Spread Crypto-Stealing JavaScript Code
- Credential-Stealing Crew Spoofs VPN Clients from Cisco, Fortinet, and Others
- AI-Generated Slopoly Malware Used in Interlock Ransomware Attack
- This Android Vulnerability Can Break Your Lock Screen in Under 60 Seconds
- Escorted Out! Major Cybersecurity Takedown
- AI-Generated Slopoly Malware Used in Interlock Ransomware Attack
- BeatBanker Malware Targets Android Users with Banking Trojan and Crypto Miner
- BeatBanker Malware Targets Android Users with Banking Trojan and Crypto Miner
- APT28 Conducts Long-Term Espionage on Ukrainian Forces Using Custom Malware
- Quiz Sites Trick Users into Enabling Unwanted Browser Notifications
- New Social Security Scam Emails Use Fake Tax Documents to Hijack PCs
- Russian APT Targets Ukraine with BadPaw and MeowMeow Malware
- Russian APT Targets Ukraine with BadPaw and MeowMeow Malware
- Telegram Increasingly Used to Sell Access, Malware and Stolen Logs
- Dust Specter APT Targets Government Officials in Iraq
- Dust Specter APT Targets Government Officials in Iraq
- Exorcising Demons - Fake Tech Support Delivers Havoc Command & Control
- QuickLens Chrome Extension Steals Crypto and Shows ClickFix Attack
- Apt37 Adds New Capabilities for Air Gapped Networks
- Vshell - A Chinese-Language Alternative to Cobalt Strike
- Massiv The New Threat to Your Mobile Banking Security
- Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb
- Another Day, Another Malicious JPEG
- Another Day, Another Malicious JPEG
- Hackers Hide Pulsar RAT Inside PNG Images in New NPM Supply Chain Attack
- Predator Spyware Hides iOS Recording Indicators
- Industrial-Scale Fake Coretax Apps Drive $2m Fraud in Indonesia
- SmartLoader Hackers Clone Oura MCP Project to Spread StealC Malware
- Keenadu The Tablet Conqueror and Major Android Botnets
- Suspected Russian Hackers Deploy CANFAIL Malware Against Ukraine
- Operation Macromaze APT28's New Campaign Unveiled
- Icedid Malware Developer Fakes His Own Death To Escape The FBI
- LummaStealer Activity Surges After Law Enforcement Disruption
- Crazy Ransomware Gang Abuses Employee Monitoring Tool in Attacks
- New Linux Botnet SSHStalker Uses Old-School IRC for C2 Comms
- Quick Howto - Extract URLs from RTF Files
- Beware of Fake 7-Zip Downloads Turning PCs into Proxy Nodes!
- UK Construction Firm Targeted by Prometei Botnet in Windows Server
- Web Traffic Hijacking Malicious Nginx Configurations Uncovered
- Knife Cutting The Edge Unveiling the DKnife Framework
- Deadvax Threat Research Security Advisory
- Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users
- Android RAT Uses Hugging Face to Host Malware
- 341 Malicious ClawHub Skills Discovered Stealing User Data
- I'm locked in!
- Cant Stop Wont Stop Ta584 Innovates Initial Access
- Chrome Extensions - Are you getting more than you bargained for?
- VoidLink Evidence That the Era of Advanced AI-Generated Malware Has Begun
- Kimwolf Botnet Lurking in Corporate, Govt. Networks
- Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading
- LOTUSLITE - Targeted espionage leveraging geopolitical themes
- Gootloader now uses 1,000-part ZIP archives for stealthy delivery
- North Korean Hackers use Code Abuse Tactics for ‘Contagious Interview’ Campaign
- Inside RedVDS - How a single virtual desktop provider fueled worldwide cybercriminal operations
- CERT-UA reports PLUGGYAPE cyberattacks on defense forces
- Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework
- Hunting Lazarus - Inside the Contagious Interview C2 Infrastructure
- CastleLoader Analysis - A Deep Dive into Stealthy Loader Targeting Government Sector
- Phishing Campaign Uses Maduro Arrest Story to Deliver Backdoor Malware
- New MacSync Stealer Uses Signed macOS App to Evade Gatekeeper and Steal Data
- Fake WinRAR downloads hide malware behind a real installer
- Hospitality Sector Hit By PHALT#BLYX ClickFix Malware Campaign
- Infostealers Enable Attackers to Hijack Legitimate Business Infrastructure for Malware Hosting
- Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale
- CISA Releases New Indicators of Compromise Tied to BRICKSTORM Malware
- Rudepanda Owns Iis Servers Like 2003
- New BeaverTail Malware Variant Linked to Lazarus Group
- New SantaStealer malware steals data from browsers, crypto wallets
- NANOREMOTE, cousin of FINALDRAFT
- Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite
- New JS#SMUGGLER Campaign Drops NetSupport RAT Through Infected Sites
- Exploitation of React2Shell Surges
- ChrimeraWire Trojan Fakes Chrome Activity to Manipulate Search Rankings
- Android Malware FvncBot, SeedSnatcher, and ClayRat Gain Stronger Data Theft Features
- LummaC2 Infects North Korean Hacker Device Linked to Bybit Heist
- Despite Microsoft’s secret patch, LNK loophole remains viable for hackers to deliver malware
- MuddyWater Snakes by the riverbank
- How a Russian Threat Actor Uses a Recent WinRAR Vulnerability in Their Ukraine Operations
- Glassworm malware returns in third wave of malicious VS Code packages
- North Korea-linked actors behind Contagious Interview uploaded 197 new malicious npm packages to distribute a new OtterCookie malware version.
- ThreatsDay Bulletin - AI Malware, Voice Bot Flaws, Crypto Laundering, IoT Attacks — and 20 More Stories
- Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems
- Dead Man’s Switch – Widespread npm Supply Chain Attack Driving Malware Attacks
- FAQ About Sha1-Hulud 2.0 The "Second Coming" of the npm Supply-Chain Campaign
- Security Affairs newsletter Round 551 by Pierluigi Paganini – INTERNATIONAL EDITION
- Sturnus - New Android banking trojan targets WhatsApp, Telegram, and Signal
- Google exposes BadAudio malware used in APT24 espionage campaigns
- Mac users warned about new DigitStealer information stealer
- Frontline Intelligence Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem
- RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet
- RONINGLOADER Weaponizes Signed Drivers to Disable Defender and Evade EDR Tools
- Hackers are Weaponizing Invoices to Deliver XWorm That Steals Login Credentials
- North Korean hackers exploit Google’s safety tools for remote wipe
- Nine NuGet packages disrupt DBs and industrial systems with time-delayed payloads
- List of AI Tools Promoted by Threat Actors in Underground Forums and Their Capabilities
- Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
- Gootloader malware back for the attack, serves up ransomware
- Google sounds alarm on self-modifying AI malware
- GlassWorm Returns New Wave Strikes as We Expose Attacker Infrastructure
- Russian hackers sneak a full Linux virtual machine inside Windows to run undetected
- Google warns of new AI-powered malware families deployed in the wild
- Curly COMrades Hacker Group Using New Tools to Create Hidden Remote Access on Compromised Windows 10
- Russian spies pack custom malware into hidden VMs on Windows machines
- Attackers targeting unpatched Cisco kit notice malware implant removal, install it again
- New "Brash" Exploit Crashes Chromium Browsers Instantly with a Single Malicious URL
- Researchers Expose GhostCall and GhostHire BlueNoroff's New Malware Chains
- SocGholish Malware Using Compromised Sites to Deliver Ransomware
- Threat Actors Leverage npm Ecosystem to Deliver AdaptixC2 Post-Exploitation Framework
- Russian Coldriver Hackers Deploy New 'NoRobot' Malware
- Self-spreading GlassWorm malware hits OpenVSX, VS Code registries
- New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs
- North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts
- Hacker Group TA585 Emerges With Advanced Attack Infrastructure
- Hackers Can Inject Malicious Code into Antivirus Processes to Create a Backdoor
- Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained
- SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution
- Hackers leveraging Teams to drop malware, steal data, Microsoft warns
- Foreign threat actors adopting ChatGPT, AI to bolster "old playbook" of attacks, OpenAI finds
- Massive network of 30,000 websites filters victims before delivering scams or malware
- Phantom Taurus A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite
- New MatrixPDF toolkit turns PDFs into phishing and malware lures
- $50 Battering RAM Attack Breaks Intel and AMD Cloud Security Protections
- New Malware-as-a-Service Olymp Loader Promises Defender-Bypass With Automatic Certificate Signing
- EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations
- Cisco Talos attributes Asian telecom and manufacturing attacks to Naikon PlugX campaign
- Malware Operators Collaborate With Covert North Korean IT Workers to Attack Corporate Organizations
- Hackers Leverage AI-Generated Code to Obfuscate Its Payload and Evade Traditional Defenses
- NCSC warns of persistent malware campaign [RayInitiator and LINE VIPER] targeting Cisco devices
- COLDRIVER Updates Arsenal with BAITSWITCH and SIMPLEFIX
- Researchers expose MalTerminal, an LLM-enabled malware pioneer
- Nimbus Manticore Deploys New Malware Targeting Europe
- Gamaredon X Turla collab
- Large-Scale Attack Targeting Macs via GitHub Pages Impersonating Companies to Attempt to Deliver Stealer Malware
- Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure
- EvilAI malware campaign exploits AI-generated code to breach global critical sectors
- 40 npm Packages Compromised in Supply Chain Attack Using bundle.js to Steal Credentials
- Actors Behind AppSuite-PDF and PDF Editor Used 26 Code-Signing Certificates to Make Software Appear Legitimate
- New Buterat Backdoor Malware Found in Enterprise and Government Networks
- Malicious npm Code Reached 10% of Cloud Environments
- Lazarus Group Deploys Malware With ClickFix Scam in Fake Job Interviews
- GhostRedirector Hacks 65 Windows Servers Using Rungan Backdoor and Gamshen IIS Module
- Russian APT28 Expands Arsenal with 'NotDoor' Outlook Backdoor
- Iran-Nexus Hackers Abuses Omani Mailbox to Target Global Governments
- Android Droppers Now Deliver SMS Stealers and Spyware, Not Just Banking Trojans
- New Phishing Campaign Abuses ConnectWise ScreenConnect to Take Over Devices
- MixShell Malware Delivered via Contact Forms Targets U.S. Supply Chain Manufacturers
- Transparent Tribe Targets Indian Govt With Weaponized Desktop Shortcuts via Phishing
- Kimsuky APT Data Leak – GPKI Certificates, Rootkits and Cobalt Strike Personal Uncovered
- Hook Version 3 The Banking Trojan with The Most Advanced Capabilities
- Fake macOS Help Sites Seek to Spread Infostealer in Targeted Campaign
- ClickFix Attack Tricks AI Summaries Into Pushing Malware
- Malicious Go Module Poses as SSH Brute-Force Tool, Steals Credentials via Telegram Bot
- APT36 hackers abuse Linux .desktop files to install malware in new attacks
- Hackers Using New QuirkyLoader Malware to Spread Agent Tesla, AsyncRAT and Snake Keylogger
- Threat Actors Attacking Organizations Key Employees With Weaponized Copyright Documents to Deliver Noodlophile Stealer
- Someone's poking the bear with infostealers targeting Russian crypto developers
- PhantomCard New NFC-driven Android malware emerging in Brazil
- Malvertising campaign leads to PS1Bot, a multi-stage malware framework
- Unmasking SocGholish Silent Push Untangles the Malware Web Behind the “Pioneer of Fake Updates” and Its Operator, TA569
- Shared secret EDR killer in the kill chain
- From Bing Search to Ransomware Bumblebee and AdaptixC2 Deliver Akira
- Tracking Updates to Raspberry Robin
- New Plague Linux malware stealthily maintains SSH access
- LegalPwn Attack Tricks GenAI Tools Into Misclassifying Malware as Safe Code
- Fingerprinting Malware C2s with Tags
- Fake Telegram Premium Site Distributes New Lumma Stealer Variant
- Unmasking Interlock Group's Evolving Malware Arsenal
- Frozen in transit Secret Blizzard’s AiTM campaign against diplomats
- APT36 Expands Beyond Military New Attacks Hit Indian Railways, Oil & Government Systems
- Qwins Ltd Bulletproof Hosting Provider Powering Global Malware Campaigns
- Cobalt Strike Beacon delivered via GitHub and social media
- JSCEAL Targets Crypto App Users – A New Threat in the Cyber Security Landscape
- GOLD BLADE remote DLL sideloading attack deploys RedLoader
- Auto-Color Backdoor How Darktrace Thwarted a Stealthy Linux Intrusion
- ToxicPanda The Android Banking Trojan Targeting Europe
- RAVEN STEALER UNMASKED Telegram-Based Data Exfiltration
- Hackers Exploit Official Gaming Mouse Software to Spread Windows-based Xred Malware
- Florida Student Research Deploys AI to Spot Stealthy Android Malware
- Cyber Stealer Analysis When Your Malware Developer Has FOMO About Features
- Operation CargoTalon UNG0901 Targets Russian Aerospace & Defense Sector using EAGLET implant.
- The Rise of Acreed Infostealer in the Post-LummaC2 Threat Landscape
- Coyote in the Wild First-Ever Malware That Abuses UI Automation
- Clickfix on macOS AppleScript Malware Campaign Uses Terminal Prompts to Steal Data
- Back to Business Lumma Stealer Returns with Stealthier Methods
- UK calls out Russian military intelligence for use of espionage tool
- Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities
- CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign
- WordPress Redirect Malware Hidden in Google Tag Manager Code
- Threat hunting case study Lumma infostealer
- The Linuxsys Cryptominer
- GhostContainer backdoor malware compromising Exchange servers of high-value organizations in Asia
- On the Move Fast Flux in the Modern Threat Landscape
- Konfety Returns Classic Mobile Threat with New Evasion Techniques
- KongTuke FileFix Leads to New Interlock RAT Variant
- Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader
- OCTALYN STEALER UNMASKED
- macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App
- Malware of the Day – Multi-Modal C2 Communication – Numinon C2
- Fix the Click Preventing the ClickFix Attack Vector
- Code highlighting with Cursor AI for $500,000
- GitHub Abused to Spread Malware Disguised as Free VPN
- Attackers Inject Code into WordPress Theme to Redirect Visitors
- Researchers Reveal 18 Malicious Chrome and Edge Extensions Disguised as Everyday Tools
- From Click to Compromise Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities
- Digging Gold with a Spoon – Resurgence of Monero-mining Malware
- Deploying NetSupport RAT via WordPress & ClickFix
- Batavia spyware steals data from Russian organizations
- Phishing Attack Deploying Malware on Indian Defense BOSS Linux
- When Installers Turn Evil The Pascal Script Behind Inno Setup Malware Campaign
- macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware
- Gamaredon in 2024 Cranking out spearphishing campaigns against Ukraine with an evolved toolset
- Stealthy WordPress Malware Drops Windows Trojan via PHP Backdoor
- Odyssey Stealer The Rebrand of Poseidon Stealer
- GIFTEDCROOK’s Strategic Pivot From Browser Stealer to Data Exfiltration Platform During Critical Ukraine Negotiations
- In the Wild Malware Prototype with Embedded Prompt Injection
- Russia-linked APT28 use Signal chats to target Ukraine official with malware
- SparkKitty, SparkCat’s little brother A new Trojan spy found in the App Store and Google Play
- ConnectUnwise Threat actors abuse ConnectWise as builder for signed malware
- Androxgh0st Continues Exploitation Operators Compromise a US University For Hosting C2 Logger
- Resurgence of the Prometei Botnet
- Part 2 Tracking LummaC2 Infrastructure
- Fake Minecraft mods distributed by the Stargazers Ghost Network to steal gamers’ data
- Report Links Los Pollos and RichAds to Malware Traffic Operations
- PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments
- Fileless AsyncRAT Distributed Via Clickfix Technique Targeting German Speaking Users
- Clone, Compile, Compromise Water Curse’s Open-Source Malware Trap on GitHub
- From Trust to Threat Hijacked Discord Invites Used for Multi-Stage Malware Delivery
- Don't Get Caught in the Headlights - DeerStealer Analysis
- Toxic trend Another malware threat targets DeepSeek
- Unmasking the Infrastructure of a Spearphishing Campaign
- The Evolution of Linux Binaries in Targeted Cloud Operations
- Two Botnets, One Flaw Mirai Spreads Through Wazuh Vulnerability
- The FBI Issued a Warning About This Malware That's Infecting Millions of Devices
- Operation DRAGONCLONE Chinese Telecommunication industry targeted via VELETRIX & VShell malware
- Blitz Malware A Tale of Game Cheats and Code Repositories
- Operation Endgame Disrupts AvCheck, Forces Threat Actors to Seek Alternatives
- ClickFix Attack Exploits Fake Cloudflare Turnstile to Deliver Malware
- BladedFeline Whispering in the dark
- Android Spyware Alert! Fake government app targeting Android users in India!
- Abusing Paste.ee to Deploy XWorm and AsyncRAT Across Global C2 Infrastructure
- The strange tale of ischhfd83 When cybercriminals eat their own
- From open-source to open threat Tracking Chaos RAT’s evolution
- Fake WordPress Caching Plugin Used to Steal Admin Credentials
- Android malware trends Stealthier, easier-to-use
- The Rising Tide Understanding the Surge in Cyber Attacks in India
- How Threat Actors Exploit Human Trust A Breakdown of the 'Prove You Are Human' Malware Scheme
- Crocodilus Mobile Malware Evolving Fast, Going Global
- Victims risk AsyncRAT infection after being redirected to fake Booking.com sites
- Malicious Ruby Gems Exfiltrate Telegram Tokens and Messages Following Vietnam Ban
- Hackers Weaponize Free SSH Client PuTTY to Deliver Malware on Windows
- Alleged Conti, TrickBot Gang Leader Unmasked
- Monkey-Patched PyPI Packages Use Transitive Dependencies to Steal Solana Private Keys
- Emulating the Unyielding Scattered Spider
- Cybercriminals camouflaging threats as AI tool installers
- Zanubis in motion Tracing the active evolution of the Android banking malware
- Pakistan Telecommunication Company (PTCL) Targeted by Bitter APT During Heightened Regional Conflict
- Mark Your Calendar APT41 Innovative Tactics
- The Sharp Taste of Mimo’lette Analyzing Mimo’s Latest Campaign targeting Craft CMS
- Text-to-Malware How Cybercriminals Weaponize Fake AI-Themed Websites
- DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers
- Reborn in Rust AsyncRAT
- Credential-Stealing Crew Spoofs VPN Clients from Cisco, Fortinet, and Others
- AppsFlyer Web SDK Hijacked to Spread Crypto-Stealing JavaScript Code