infostealer

From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves

infostealer, Malware /

From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves 2026-10-28 at 07:02 By rohansinhacyblecom Executive Summary In May, Cyble Research & Intelligence Labs (CRIL) documented JOMANGY, a PHP webshell generation deployed by INJ3CTOR3 with self-healing persistence channels and a built-in toll-fraud dialer. Back then, the fraud ran through the victim’s own PBX, so removing the […]

From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves Read More »

The GhostX Ecosystem: Forged in Transit, Licensed to Deceive

cyber news, fake app, infostealer, phishing /

The GhostX Ecosystem: Forged in Transit, Licensed to Deceive 2026-10-15 at 11:44 By rohansinhacyblecom Executive Summary Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. Analysis of […]

The GhostX Ecosystem: Forged in Transit, Licensed to Deceive Read More »

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

EDR killer, infostealer, LastPass, Malware, Malware & Threats, Rapuncel /

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer 2026-09-21 at 18:46 By Ionut Arghire The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware. The post Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer Read More »

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

infostealer, Malware, Threat Intelligence /

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline 2026-09-10 at 13:45 By Ashish Khaitan Infostealer malware is behind a large share of today’s credential compromise — and it usually doesn’t start with a breach at all. When a security team hears “data breach,” the instinct is to look for […]

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline Read More »

Fortune 500 Companies Hit in Azure Data Theft Campaign

Azure, cloud security, Data Breaches, Data leak, data theft, infostealer /

Fortune 500 Companies Hit in Azure Data Theft Campaign 2026-08-17 at 09:51 By Ionut Arghire A threat actor is claiming the exfiltration of millions of records from McDonald’s, TCS, Vodafone, and other large organizations. The post Fortune 500 Companies Hit in Azure Data Theft Campaign appeared first on SecurityWeek. This article is an excerpt from […]

Fortune 500 Companies Hit in Azure Data Theft Campaign Read More »

‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing

ClickFix, ClickLock Stealer, infostealer, macOS malware, Malware, Malware & Threats /

‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing 2026-07-16 at 15:43 By Eduard Kovacs The new macOS malware has targeted at least 100 users to steal their passwords and cryptocurrency.  The post ‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing appeared first on SecurityWeek. This article is an excerpt from SecurityWeek […]

‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing Read More »

Multiple Jscrambler Packages Impacted by Supply Chain Attack

infostealer, Jscrambler, Malware & Threats, supply chain attack, Supply Chain Security /

Multiple Jscrambler Packages Impacted by Supply Chain Attack 2026-07-14 at 12:04 By Ionut Arghire A threat actor poisoned several Jscrambler NPM package versions to drop a cross-platform credential stealer. The post Multiple Jscrambler Packages Impacted by Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Multiple Jscrambler Packages Impacted by Supply Chain Attack Read More »

Infostealers Turn Millions of Devices Into Credential Theft Machines

Identity & Access, infostealer, Malware, Malware & Threats /

Infostealers Turn Millions of Devices Into Credential Theft Machines 2026-06-10 at 17:24 By Kevin Townsend As attackers increasingly favor stolen credentials over exploits, infostealers have become a primary source of access for ransomware and other cybercrime operations. The post Infostealers Turn Millions of Devices Into Credential Theft Machines appeared first on SecurityWeek. This article is […]

Infostealers Turn Millions of Devices Into Credential Theft Machines Read More »

Operation HumanitarianBait: An Infostealer Campaign in Disguise

cyberespionage, infostealer, Malware, social engineering /

Operation HumanitarianBait: An Infostealer Campaign in Disguise 2026-05-07 at 12:41 By rohansinhacyblecom Executive Summary Cyble Research and Intelligence Labs (CRIL) has uncovered a targeted cyberespionage campaign leveraging social engineering and trusted infrastructure to establish persistent, covert access to victim systems. The attack is delivered via phishing emails containing a malicious LNK file disguised within a […]

Operation HumanitarianBait: An Infostealer Campaign in Disguise Read More »

Professional Networks Under Attack: Vietnam-Linked Actors Deploy PXA Stealer in Global Infostealer Campaign

infostealer, Malware, social engineering /

Professional Networks Under Attack: Vietnam-Linked Actors Deploy PXA Stealer in Global Infostealer Campaign 2026-03-30 at 18:31 By rohansinhacyblecom Executive Summary CRIL has been actively tracking a surge in PXA Stealer activity deployed in a sophisticated, financially motivated threat campaign attributed with high confidence to a Vietnam-based cybercriminal group. The primary targets in this campaign are […]

Professional Networks Under Attack: Vietnam-Linked Actors Deploy PXA Stealer in Global Infostealer Campaign Read More »

Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs

ClickFix, infostealer, Mac malware, Malware & Threats /

Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs 2026-03-28 at 15:40 By Ionut Arghire The infection chain includes a fake CAPTCHA page, a Bash script, a Nuitka loader, and the Python-based infostealer. The post Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs Read More »

Iranian Hackers Likely Used Malware-Stolen Credentials in Stryker Breach

Handala, infostealer, Iran, Malware, Malware & Threats, Stryker /

Iranian Hackers Likely Used Malware-Stolen Credentials in Stryker Breach 2026-03-18 at 14:49 By Eduard Kovacs The medtech giant has been working on restoring systems affected by the cyberattack conducted by the Handala hackers. The post Iranian Hackers Likely Used Malware-Stolen Credentials in Stryker Breach appeared first on SecurityWeek. This article is an excerpt from SecurityWeek […]

Iranian Hackers Likely Used Malware-Stolen Credentials in Stryker Breach Read More »

AI-Assisted Phishing Campaign Exploits Browser Permissions to Capture Victim Data

AI, Credential Harvesting, infostealer, phishing, social engineering /

AI-Assisted Phishing Campaign Exploits Browser Permissions to Capture Victim Data 2026-03-16 at 08:24 By rohansinhacyblecom Executive Summary Cyble Research & Intelligence Labs (CRIL) has identified a widespread, highly active social engineering campaign hosted primarily on edgeone.app infrastructure. The initial access vectors are diverse — ranging from “ID Scanner,” and “Telegram ID Freezing,” to “Health Fund […]

AI-Assisted Phishing Campaign Exploits Browser Permissions to Capture Victim Data Read More »

Polyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea

cybercrime, infostealer, Malware, Malware & Threats, North Korea, Polyfill /

Polyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea 2026-03-12 at 11:48 By Eduard Kovacs The 2024 incident was initially linked to China, but an infostealer infection has now revealed North Korean involvement. The post Polyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea appeared first on SecurityWeek. This article is […]

Polyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea Read More »

Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign

ClickFix, infostealer, InstallFix, Malware, Malware & Threats /

Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign 2026-03-09 at 13:50 By Ionut Arghire Threat actors replace legitimate commands on the cloned installation webpages with malicious commands. The post Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign Read More »

Over 100 GitHub Repositories Distributing BoryptGrab Stealer

BoryptGrab, infostealer, Malware, Malware & Threats /

Over 100 GitHub Repositories Distributing BoryptGrab Stealer 2026-03-07 at 14:46 By Ionut Arghire The malware targets browser and cryptocurrency wallet data, along with system information and user files. The post Over 100 GitHub Repositories Distributing BoryptGrab Stealer appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Over 100 GitHub Repositories Distributing BoryptGrab Stealer Read More »

ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader

infostealer, Malware /

ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader 2026-03-05 at 14:27 By rohansinhacyblecom Executive Summary In early February 2026, Cyble Research & Intelligence Labs (CRIL) identified a new Linux malware strain delivered through a loader structure previously associated with ShadowHS activity. While ShadowHS samples deployed post-exploitation tooling, the newly observed payload is operationally different. […]

ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader Read More »

‘Arkanix Stealer’ Malware Disappears Shortly After Debut

Arkanix, infostealer, Malware, Malware & Threats /

‘Arkanix Stealer’ Malware Disappears Shortly After Debut 2026-02-24 at 17:53 By Ionut Arghire Written in C++ and Python, the malware exfiltrates system information, browser data, and steals files. The post ‘Arkanix Stealer’ Malware Disappears Shortly After Debut appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

‘Arkanix Stealer’ Malware Disappears Shortly After Debut Read More »

‘SolyxImmortal’ Information Stealer Emerges

infostealer, Malware, Malware & Threats, SolyxImmortal /

‘SolyxImmortal’ Information Stealer Emerges 2026-01-19 at 17:21 By Ionut Arghire The information stealer abuses legitimate APIs and libraries to exfiltrate data to Discord webhooks. The post ‘SolyxImmortal’ Information Stealer Emerges appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

‘SolyxImmortal’ Information Stealer Emerges Read More »

Dozens of Major Data Breaches Linked to Single Threat Actor

data breach, Data Breaches, infostealer, Malware, Malware & Threats, Sentap, Zestix /

Dozens of Major Data Breaches Linked to Single Threat Actor 2026-01-06 at 14:32 By Ionut Arghire The initial access broker (IAB) relies on credentials exfiltrated using information stealers to hack organizations. The post Dozens of Major Data Breaches Linked to Single Threat Actor appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View […]

Dozens of Major Data Breaches Linked to Single Threat Actor Read More »

Scroll to Top