Malware & Threats

AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks

AI, Artificial Intelligence, Malware & Threats, Northflank, Trigger.dev, WorkOS /

AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks 2026-11-04 at 14:43 By Ionut Arghire Hackers have been harvesting AI access tokens and have been using AI-assisted offensive tools to automate attacks. The post AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View […]

AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks Read More »

Google Dismantles XCPE Botnet of 1.3 Million Android Devices

botnet, disrupted, Google, Malware & Threats, takedown, XCPE /

Google Dismantles XCPE Botnet of 1.3 Million Android Devices 2026-11-03 at 11:22 By Ionut Arghire The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology. The post Google Dismantles XCPE Botnet of 1.3 Million Android Devices appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Google Dismantles XCPE Botnet of 1.3 Million Android Devices Read More »

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Cursor, extension, Malware & Threats, supply chain attack, Supply Chain Security /

Malicious Claude Code Extension Served in Cursor Supply Chain Attack 2026-11-02 at 13:29 By Ionut Arghire The extension performed host reconnaissance and attempted to create a reverse SSH tunnel. The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Malicious Claude Code Extension Served in Cursor Supply Chain Attack Read More »

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

exploited, Malware & Threats, Palo Alto Networks, PHP, PHP2Shell, Vulnerabilities, vulnerability, WordPress /

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress 2026-10-30 at 17:09 By Ionut Arghire Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week. The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek. This article […]

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress Read More »

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

China, China APT, Cisco, exploited, Malware & Threats, Nation-State, SD-WAN, Silent Train, Volt Typhoon, Vulnerabilities, Zero-Day /

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network 2026-10-29 at 12:29 By Eduard Kovacs Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed. The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek. This article is an […]

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network Read More »

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

Brotli, exploited, Featured, Malware & Threats, Node2Shell, Vulnerabilities, vulnerability /

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts 2026-10-28 at 10:37 By Eduard Kovacs CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit. The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek. This […]

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts Read More »

Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover

Malware & Threats, Popcorn Time /

Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover 2026-10-27 at 11:44 By Ionut Arghire Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek. This […]

Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover Read More »

953 Online Stores Infected in Long-Lasting Malware Campaign

magento, Malware, Malware & Threats /

953 Online Stores Infected in Long-Lasting Malware Campaign 2026-10-26 at 14:46 By Ionut Arghire Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection. The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

953 Online Stores Infected in Long-Lasting Malware Campaign Read More »

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

In Other News, Malware & Threats /

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware 2026-10-23 at 17:23 By SecurityWeek News Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe. The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue […]

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware Read More »

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

AI, Artificial Intelligence, China, China APT, ConnectWise, Malware & Threats, Microsoft /

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks 2026-10-23 at 13:31 By Ionut Arghire The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments. The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks Read More »

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

APT, Featured, Infy, Iran, Malware & Threats, Nation-State, Prince of Persia /

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 2026-10-23 at 09:39 By Eduard Kovacs After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. The post Iran’s Prince of Persia APT Hosts C&C in US for First […]

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 Read More »

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI

CLI, Malware & Threats, OVHcloud, Stealer /

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI 2026-10-21 at 09:02 By Eduard Kovacs Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader. The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Read More »

AI Platform Cairn Abused to Hack Over 100 Organizations

AI, Artificial Intelligence, Cairn, China, Malware & Threats /

AI Platform Cairn Abused to Hack Over 100 Organizations 2026-10-20 at 15:47 By Ionut Arghire At least three threat actors have been abusing Cairn for persistent access and financial theft. The post AI Platform Cairn Abused to Hack Over 100 Organizations appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

AI Platform Cairn Abused to Hack Over 100 Organizations Read More »

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

DLL hijacking, exploited, Featured, ICS/OT, Malware, Malware & Threats, Siemens, Vulnerabilities, vulnerability /

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks 2026-10-19 at 21:15 By Eduard Kovacs Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures. The post Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks appeared first on SecurityWeek. This article is an excerpt […]

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Read More »

ConnectWise Suspends Cloud Services in Response to Cyberattack

ConnectWise, Malware & Threats /

ConnectWise Suspends Cloud Services in Response to Cyberattack 2026-10-19 at 16:16 By Ionut Arghire The services remain unavailable as the company continues remediation and security validation. The post ConnectWise Suspends Cloud Services in Response to Cyberattack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

ConnectWise Suspends Cloud Services in Response to Cyberattack Read More »

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks

ATT&CK, Featured, Malware & Threats, MITRE, Uncategorized /

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks 2026-10-19 at 12:37 By Eduard Kovacs Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics. The post MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks appeared first on SecurityWeek. This article is an […]

MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks Read More »

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

AdFection, Candiru, Featured, malvertising, Malware & Threats, spyware /

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel 2026-10-17 at 14:00 By Ionut Arghire Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek. This article is an excerpt […]

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel Read More »

Novel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

Android malware, Android RAT, Banking Trojan, Hirudo, Malware, Malware & Threats, RAT /

Novel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies 2026-10-15 at 13:15 By Kevin Townsend The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT. The post Novel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek. This article is an excerpt from SecurityWeek […]

Novel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies Read More »

XWorm RAT Evolves Into Surveillance Platform

Malware & Threats /

XWorm RAT Evolves Into Surveillance Platform 2026-10-13 at 14:13 By Ionut Arghire Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions. The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

XWorm RAT Evolves Into Surveillance Platform Read More »

Scroll to Top