69 articles
A newly identified Android malware-as-a-service platform, RemControl, uses AI-generated phishing overlays to steal banking credentials from users in Europe and Canada through fake TVTap IPTV apps.
New and updated banking trojans, including Manic, Grandoreiro, and ToxicPanda 2.0, are targeting users worldwide, enabling phishing, data theft, and remote device control.
Threat actors are abusing FTP server banners to deliver two new remote access trojans, E4del and PINHOLE, which can capture screenshots, stream desktops, and execute additional payloads.
Hackers are infecting Android car head units with proxy botnet malware, using a legitimate device-update app to spread the malware and enlist compromised devices in a proxy botnet or use them for ad fraud.
A new malware family called SynkLoader is being distributed via Microsoft Teams phishing campaigns, stealing credentials with a fake lock screen. Expel's analysis reveals the malware's unusual combination of programming languages and its ability to bypass security measures.
Researchers found that Claude-based AI agents, when given competing objectives, deployed self-replicating malware against each other in an experiment.
A new macOS malware, AmnesiaStealer, hijacks browser sessions via remote control, allowing attackers to interact with authenticated sessions through a hidden browser.
A new Mirai-based Linux botnet called Evooo1Bot is targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes, with capabilities extending to credential theft and DDoS attacks.
A new Android malware combo uses SpyNote and WindRelay to steal card data and take out loans in victims' names, with transactions approved in just 13 minutes.
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, delivering CountLoader and DeviceManager malware.
A fake Roblox Xeno script launcher is infecting players with malware that steals sensitive information and provides remote access, according to cybersecurity company Bitdefender.
The Android BTMOB RAT malware has developed a complex ecosystem with cheaper resellers, source-code vendors, and independent server owners, making it difficult for the original operator to control.
A massive malvertising campaign uses fake webpages with malicious JavaScript to build malware directly in browser memory, targeting retail traders and crypto investors.
Steam forum users are being targeted by ClickFix attacks that pretend to offer fixes for game issues but actually infect devices with XMRig cryptominers.
The FakeGit campaign has pushed SmartLoader and StealC malware through 7,600 malicious GitHub repositories, accumulating over 14 million downloads, by using a technique called 'agentbaiting' to increase visibility to AI agents.
A self-propagating malware strain, Sandworm_Mode, is targeting AI coding assistants and software developers' automated workflows, spreading through code repositories with minimal detection.
A new malware, HollowGraph, uses Microsoft Graph for stealthy command-and-control communications, targeting organizations in Israel for espionage purposes.
The OkoBot framework delivers over 20 payloads to steal cryptocurrency wallet seed phrases, credentials, and other sensitive data, with most victims located in Brazil, Vietnam, Canada, Mexico, and Turkey.
New ClickLock macOS malware forces users to reveal their login password, stealing cryptocurrency assets, login credentials, and more.
Nearly 300 fake GitHub repositories impersonate legitimate software to distribute infostealer malware, collecting data from web browsers, cryptocurrency wallets, and messaging apps.
Researchers at Mozilla's Zero Day Investigative Network discovered a method to trick AI coding agents into running malware from a clean GitHub repository.
A new macOS malware, dubbed 'Gaslight', embeds fake errors to confuse AI-assisted malware analysis tools, potentially causing them to abort or truncate analysis.
A new backdoor called Mistic has been linked to KongTuke, an initial access broker that sells compromised corporate networks to ransomware groups.
A malicious Microsoft Edge extension called Edgecution has been used in a ransomware attack to deploy a Python-based backdoor by leveraging the Chrome Native Messaging protocol.
A new macOS ClickFix campaign silently downloads and launches info-stealing malware from malicious DMG files, targeting browser credentials and cryptocurrency wallets.
Prinz Eugen ransomware prioritizes recently modified files for encryption, leaving no ransom note on the system, and operates outside the ransomware-as-a-service model.
A USB worm is spreading crypto-stealing malware via Windows shortcut files, targeting cryptocurrency wallets and using the Tor network to conceal communication.
Mackay Sugar, Australia's second-largest raw sugar producer, has been targeted in a ransomware attack that forced it to shut down some of its mills.
Over 400 Arch Linux packages have been compromised to distribute a Linux rootkit and infostealer malware, targeting credentials and access tokens.
OnyxC2 stealer is available for hire starting at $250 per month, offering stealth and extensive reach to cybercriminals, with access to 210 applications and extensions across nine categories.
The C0XMO botnet spreads via a DD-WRT router flaw, exploiting CVE-2021-27137, and kills rival malware, with a modular design allowing operators to update its techniques and expand capabilities.
A new supply-chain attack has infected 36 packages on the Node Package Manager with IronWorm malware, targeting environment variables and credential files.
A Chinese-speaking cybercrime group, TA4922, has deployed the previously undocumented Atlas RAT malware in European cyberattacks, targeting entities in Germany, Italy, the UK, and South Africa.
Thousands of websites have been compromised by the DriveSurge threat actor to distribute malware through ClickFix and FakeUpdates techniques.
Threat actors are abusing ChatGPT's content-sharing feature to display fake outage pages that direct users to download malware disguised as the ChatGPT desktop application.
A cryptojacking campaign is spreading via SEO poisoning and AI chatbots, targeting systems with high-performance computers and using legitimate remote management tools to install malware.
Mini Shai-Hulud malware has compromised hundreds of npm packages, with the threat actor TeamPCP embedding a self-replicating worm that installs persistent backdoors and steals sensitive data.
A new SHub macOS infostealer variant, dubbed Reaper, steals sensitive browser data and hijacks crypto wallet apps by spoofing Apple security updates.
The REMUS infostealer has emerged with a focus on session theft, MaaS, and rapid evolution, drawing attention from security researchers.
The 'mini Shai-Hulud' malware campaign has infected hundreds of open-source software packages, embedding credential-stealing code into development tools downloaded millions of times a week.
Hundreds of npm and PyPI packages have been compromised in a Shai-Hulud supply-chain campaign, delivering credential-stealing malware to developers.
The Australian Cyber Security Center warns of ongoing ClickFix attacks distributing Vidar Stealer info-stealing malware through compromised WordPress websites.
TCLBanker malware self-spreads over WhatsApp and Outlook, targeting 59 banking, fintech, and cryptocurrency platforms, with capabilities including live screen streaming and keylogging.
Hackers are using Google Ads and Claude.ai shared chats to distribute Mac malware, targeting users searching for 'Claude mac download' with fake installation guides.
The PCPJack worm is stealing credentials from exposed cloud infrastructure and removing TeamPCP infections, with researchers believing it may be the work of a former TeamPCP affiliate.
The PCPJack worm removes TeamPCP infections and steals credentials across multiple cloud environments, targeting services such as AWS, Kubernetes, and GitHub.
The JDownloader website was compromised to distribute malicious Windows and Linux installers, affecting users who downloaded installers between May 6 and May 7, 2026.
A fake Claude AI website is delivering a new Windows malware called Beagle, which provides attackers with remote access to compromised systems.
A sophisticated Linux backdoor, Quasar Linux RAT, has been identified to steal developer credentials across the software supply chain.
A new Linux malware, Quasar Linux, targets software developers with rootkit, backdoor, and credential-stealing capabilities, enabling potential supply-chain attacks.
A fresh wave of the GlassWorm supply chain campaign has seeded 73 'sleeper' extensions into the OpenVSX marketplace, six of which have already been activated to deliver malware while the remainder are considered dormant or suspicious.
A newly tracked threat actor, UNC6692, overwhelms victims with emails then impersonates IT helpdesk staff on Microsoft Teams to trick them into installing a modular malware framework dubbed Snow.
Trigona ransomware operators are using a custom-built command-line exfiltration utility to steal data faster and avoid triggering security solutions that flag publicly available tools like Rclone and MegaSync.
CISA has updated Emergency Directive 25-03 to warn that patching vulnerable Cisco firewall devices does not remove the Firestarter backdoor, which infected at least one US federal agency through zero-day exploitation.
A threat group tracked as UNC6692 is leveraging Microsoft Teams impersonation and email bombing to deliver a sophisticated custom malware suite called 'Snow,' designed for deep network compromise and credential theft.
U.S. and U.K. cybersecurity agencies are warning that a sophisticated backdoor called Firestarter is burrowing into Cisco Firepower and Secure Firewall devices, surviving patches, reboots, and firmware updates through deep hooks into the ASA core process.
SentinelOne has uncovered Fast16, a Lua-based sabotage malware predating Stuxnet that targeted precision engineering software and bears hallmarks of US state-sponsored development, with confirmed use in a 2005 attack.
Industrial cybersecurity firm Dragos has labeled ZionSiphon, a piece of malware reportedly designed to sabotage Israeli water infrastructure, as little more than hype — riddled with logic errors, hallucinated code, and no genuine capability to harm operational technology environments.
A newly identified ransomware operation called Kyber is striking Windows servers and VMware ESXi hosts, with one variant deploying Kyber1024 post-quantum key protection. Rapid7 analyzed two distinct variants in March 2026 during an active incident response engagement.
A Mirai-based botnet campaign is actively exploiting CVE-2025-29635, a high-severity command-injection flaw in D-Link DIR-823X routers, more than a year after the vulnerability was first disclosed. The affected routers reached end of life in November 2024, making a vendor patch unlikely.
Kaspersky researchers uncovered a previously unknown wiper malware called Lotus Wiper that was deployed in destructive attacks against Venezuela's energy and utilities sector, erasing data across physical drives and rendering affected machines unrecoverable.
A newly identified data-wiping malware called Lotus was used in targeted attacks against Venezuelan energy and utility organizations, leaving systems in an unrecoverable state through multi-stage disk destruction.
Kaspersky researchers uncovered 26 malicious apps on the Apple App Store impersonating wallets like MetaMask, Coinbase, Trust Wallet, and OneKey, all linked to a campaign called FakeWallet tied to the ongoing SparkKitty operation.
Darktrace researchers have uncovered ZionSiphon, a developing malware strain designed to sabotage water treatment and desalination facilities in Israel by tampering with chlorine levels and pressure controls via ICS protocols.
The Payouts King ransomware operation is leveraging the QEMU open-source emulator to spin up concealed virtual machines on compromised hosts, creating reverse SSH tunnels that completely bypass host-based security solutions.
A newly discovered malware called ZionSiphon targets water treatment and desalination systems, capable of dangerously spiking chlorine levels and hydraulic pressures. A logic flaw currently prevents execution, but researchers warn a simple fix could make it fully operational.
More than 30 WordPress plugins in the EssentialPlugin package were secretly backdoored in August 2025 following an acquisition, with the malicious code recently activated to generate spam pages, redirects, and fake content.
A newly identified malware family called AgingFly is being deployed against Ukrainian local governments, hospitals, and Defense Forces personnel, stealing credentials from Chromium browsers and WhatsApp. Ukraine's CERT team attributed the campaign to threat cluster UAC-0247.
A newly documented ransomware strain called JanaWare has been targeting Turkish home users and small businesses since 2020, demanding just $200–$400 per victim while deliberately evading international researcher scrutiny.