Malware

Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware

APT, cybersecurity, Malware, News, Russian Federation, Threat Intelligence, Ukraine /

Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware 2026-11-03 at 12:00 By Anamarija Pogorelec ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone. Spearphishing […]

Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware Read More »

Google disrupts XCPE botnet, bans the company behind it

Android, botnet, cybercrime, Don't miss, Google, hardware, Internet of Things, Malware, News /

Google disrupts XCPE botnet, bans the company behind it 2026-11-02 at 17:50 By Mirko Zorz Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More […]

Google disrupts XCPE botnet, bans the company behind it Read More »

AI-powered infostealer picks out the most profitable parts of your stolen data

AI, Cisco, Malware, News, Windows /

AI-powered infostealer picks out the most profitable parts of your stolen data 2026-11-02 at 16:47 By Sinisa Markovic A new Windows infostealer sends the data it steals to an AI model and asks it to rank the victim’s assets by how much money they could bring in, Cisco Talos has found. “There is a new […]

AI-powered infostealer picks out the most profitable parts of your stolen data Read More »

Fake IT help desk callers got by on little more than names and email addresses

attack, Cisco, Claude Code, cybercrime, cybersecurity, Don't miss, Malware, Microsoft Teams, News, Ransomware, report, scams, social engineering, threats, vishing, voice recognition /

Fake IT help desk callers got by on little more than names and email addresses 2026-10-30 at 08:30 By Mirko Zorz Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos […]

Fake IT help desk callers got by on little more than names and email addresses Read More »

Yoba malware hides in fake desktop versions of ChatGPT and Claude

ChatGPT, Claude Code, cybercrime, Malware, News /

Yoba malware hides in fake desktop versions of ChatGPT and Claude 2026-10-29 at 16:49 By Sinisa Markovic Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campaign, dubbed Yoba, […]

Yoba malware hides in fake desktop versions of ChatGPT and Claude Read More »

From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves

infostealer, Malware /

From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves 2026-10-28 at 07:02 By rohansinhacyblecom Executive Summary In May, Cyble Research & Intelligence Labs (CRIL) documented JOMANGY, a PHP webshell generation deployed by INJ3CTOR3 with self-healing persistence channels and a built-in toll-fraud dialer. Back then, the fraud ran through the victim’s own PBX, so removing the […]

From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves Read More »

953 Online Stores Infected in Long-Lasting Malware Campaign

magento, Malware, Malware & Threats /

953 Online Stores Infected in Long-Lasting Malware Campaign 2026-10-26 at 14:46 By Ionut Arghire Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection. The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

953 Online Stores Infected in Long-Lasting Malware Campaign Read More »

AI coding agents fall for malicious instructions planted in the Downloads folder

agentic AI, AI, Anthropic, Don't miss, Hot stuff, Malware, News, OpenAI /

AI coding agents fall for malicious instructions planted in the Downloads folder 2026-10-26 at 13:26 By Sinisa Markovic A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user’s login token when they’re opened in that folder, Forever […]

AI coding agents fall for malicious instructions planted in the Downloads folder Read More »

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials

Aikido Security, CloudSEK, Don't miss, Hot stuff, Hudson Rock, Malware, News, open source, Socket, supply chain attacks, supply chain compromise, Wiz /

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials 2026-10-22 at 16:10 By Sinisa Markovic A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. “LiteLLM got […]

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials Read More »

Info-stealing malware slipped into OVHcloud CLI releases on GitHub

Don't miss, GitHub, Hot stuff, Malware, News, OVHcloud /

Info-stealing malware slipped into OVHcloud CLI releases on GitHub 2026-10-21 at 11:59 By Sinisa Markovic OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed the incident on X, warning users who downloaded the […]

Info-stealing malware slipped into OVHcloud CLI releases on GitHub Read More »

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

AOMEI, Malware, supply chain attack, Supply Chain Security /

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign 2026-10-20 at 16:51 By Ionut Arghire Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework. The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign Read More »

Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign

Don't miss, Forescout, Hot stuff, Malware, News, Siemens, social engineering, vulnerability /

Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign 2026-10-20 at 15:23 By Sinisa Markovic Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the […]

Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign Read More »

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks

DLL hijacking, exploited, Featured, ICS/OT, Malware, Malware & Threats, Siemens, Vulnerabilities, vulnerability /

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks 2026-10-19 at 21:15 By Eduard Kovacs Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures. The post Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks appeared first on SecurityWeek. This article is an excerpt […]

Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Read More »

Fake Arch Linux AUR packages exploit typos to run malware with root privileges

cybersecurity, Don't miss, Hot stuff, Malware, News /

Fake Arch Linux AUR packages exploit typos to run malware with root privileges 2026-10-16 at 12:58 By Sinisa Markovic Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source […]

Fake Arch Linux AUR packages exploit typos to run malware with root privileges Read More »

KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims

cybercrime, Group-IB, Malware, News, Windows /

KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims 2026-10-15 at 16:51 By Sinisa Markovic A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made […]

KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims Read More »

Fake CAPTCHAs are tricking users into running malware on their own devices

Barracuda Networks, credentials, Malware, News, phishing /

Fake CAPTCHAs are tricking users into running malware on their own devices 2026-10-15 at 16:29 By Anamarija Pogorelec Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, malicious browser notifications, and commands that victims are tricked […]

Fake CAPTCHAs are tricking users into running malware on their own devices Read More »

Novel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

Android malware, Android RAT, Banking Trojan, Hirudo, Malware, Malware & Threats, RAT /

Novel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies 2026-10-15 at 13:15 By Kevin Townsend The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT. The post Novel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek. This article is an excerpt from SecurityWeek […]

Novel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies Read More »

Low-cost Android phones are arriving with malware that owners can’t uninstall

Android, Bitdefender, Don't miss, Hot stuff, Malware, mobile apps, mobile security, News /

Low-cost Android phones are arriving with malware that owners can’t uninstall 2026-10-12 at 13:53 By Sinisa Markovic People who buy low-cost Android phones from online marketplaces may be carrying malware that was placed on the device before it reached them, Bitdefender has found. The campaign, dubbed Midnight Mimosa, runs on budget Android devices from different […]

Low-cost Android phones are arriving with malware that owners can’t uninstall Read More »

What the BPFDoor backdoor tells us about attacks on the network edge

backdoor, cybersecurity, Don't miss, Endpoint Security, Features, Hot stuff, Linux, Malware, News, opinion, Rapid7, Threat Intelligence /

What the BPFDoor backdoor tells us about attacks on the network edge 2026-10-09 at 09:00 By Mirko Zorz A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts. In this interview with Help Net Security, Christiaan Beek, […]

What the BPFDoor backdoor tells us about attacks on the network edge Read More »

Scroll to Top