Malware

Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers

AI, botnet, Don't miss, GitHub, Hot stuff, Malware, News /

Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers 2026-10-08 at 13:24 By Sinisa Markovic Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, dubbed PoeLLM, breaks into exposed AI services and […]

Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers Read More »

What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor

backdoor, critical infrastructure, cybercrime, ESET, Malware, News, Russian Federation, Ukraine /

What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor 2026-10-08 at 12:00 By Mirko Zorz ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in Ukraine. GUI displayed at MATCHBOIL’s runtime (Source: ESET) Every victim in […]

What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor Read More »

FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware

arrested, ATM jackpotting, cybercrime, Malware, Ploutus, Tracking & Law Enforcement /

FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware 2026-10-06 at 15:47 By Ionut Arghire An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026. The post FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware appeared first on SecurityWeek. This […]

FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware Read More »

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

Malware, Malware & Threats, NPM, supply chain attack, Supply Chain Security /

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads 2026-10-06 at 13:34 By Ionut Arghire Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign. The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads Read More »

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

ClingSTUN, Linux malware, Malware, Malware & Threats /

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws 2026-10-05 at 16:00 By Ionut Arghire ClingSTUN operates as a back-connect proxy backdoor, sets up persistence, and contains exploits for self-propagation. The post Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws Read More »

Treasury Blacklists Most-Wanted ATM Malware Developer and His Network

cybercrime, Malware, Ploutus, Sanctions, Tracking & Law Enforcement, Treasury /

Treasury Blacklists Most-Wanted ATM Malware Developer and His Network 2026-10-01 at 13:51 By Eduard Kovacs The US government continues its crackdown on Tren de Aragua over its ATM jackpotting scheme. The post Treasury Blacklists Most-Wanted ATM Malware Developer and His Network appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Treasury Blacklists Most-Wanted ATM Malware Developer and His Network Read More »

Hackers Use ChatGPT Custom GPTs in ClickFix Attacks

Artificial Intelligence, ChatGPT, ClickFix, Malware, Malware & Threats /

Hackers Use ChatGPT Custom GPTs in ClickFix Attacks 2026-09-29 at 16:03 By Ionut Arghire The personalized versions of ChatGPT were used to impersonate legitimate products and trick users into executing PowerShell commands. The post Hackers Use ChatGPT Custom GPTs in ClickFix Attacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

Hackers Use ChatGPT Custom GPTs in ClickFix Attacks Read More »

Malicious Custom GPT on chatgpt.com lures users into installing a RAT

ChatGPT, Don't miss, Hot stuff, Huntress, malvertising, Malware, News, Remote Access Trojan /

Malicious Custom GPT on chatgpt.com lures users into installing a RAT 2026-09-29 at 14:55 By Zeljka Zorz Malware peddlers are using sponsored Google results to push a malicious ChatGPT Custom GPT named “Plus 5.6,” created to lead users to a fake Cloudflare CAPTCHA check and, ultimately, make them download and run a remote access trojan […]

Malicious Custom GPT on chatgpt.com lures users into installing a RAT Read More »

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

AI, botnet, Malware, Malware & Threats, X47.c /

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining 2026-09-26 at 15:00 By Ionut Arghire The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions. The post New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining appeared first on SecurityWeek. This article is an excerpt from […]

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining Read More »

MacSync info-stealing malware hides malicious commands in an iCloud calendar

backdoor, Crypto, Kaspersky, macOS, Malware, News /

MacSync info-stealing malware hides malicious commands in an iCloud calendar 2026-09-25 at 12:22 By Sinisa Markovic A new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, crypto wallet data, and files, according to Kaspersky. Researchers found the malware spreading through a crypto wallet app called Toria, which had […]

MacSync info-stealing malware hides malicious commands in an iCloud calendar Read More »

Fake payroll desktop apps hand attackers a route to company paychecks

Allure Security, cybercrime, Don't miss, Hot stuff, Malware, News /

Fake payroll desktop apps hand attackers a route to company paychecks 2026-09-25 at 10:52 By Sinisa Markovic An attacker has been offering “desktop apps” for three large US payroll and HR platforms that have never released one, Allure Security have found. Anyone who runs the installer gets a copy of ScreenConnect, a legitimate remote access […]

Fake payroll desktop apps hand attackers a route to company paychecks Read More »

New Android malware RemControl steals banking PINs and blocks removal attempts

Android, cybercrime, Don't miss, financial industry, Group-IB, Hot stuff, Malware, mobile security, News, online banking /

New Android malware RemControl steals banking PINs and blocks removal attempts 2026-09-24 at 12:40 By Sinisa Markovic A new Android banking trojan called RemControl tricks victims into installing a fake TV app, then takes control of their phones to steal banking PINs, Group-IB has found. Researchers confirmed that the malware targets customers of more than […]

New Android malware RemControl steals banking PINs and blocks removal attempts Read More »

Researchers uncover malware that uses AI to choose its next move

AI, Cisco, Don't miss, Hot stuff, Malware, News, open source /

Researchers uncover malware that uses AI to choose its next move 2026-09-22 at 16:56 By Sinisa Markovic To help security practitioners catch malware that leans on AI, researchers from Cisco Talos shared an open-source framework that they hope will be used to classify and analyze the threat. The tool, called CAIRN, works entirely from metadata […]

Researchers uncover malware that uses AI to choose its next move Read More »

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

EDR killer, infostealer, LastPass, Malware, Malware & Threats, Rapuncel /

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer 2026-09-21 at 18:46 By Ionut Arghire The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware. The post Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer Read More »

The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files

APT, attack tools, backdoor, cybersecurity, Don't miss, Hot stuff, Malware, News, PowerShell, research, Securonix, Threat Intelligence, Windows /

The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files 2026-09-21 at 17:00 By Mirko Zorz Researchers have taken apart TASK#STOMP, a Windows backdoor that searches a victim’s drives for business documents, uploads them to attacker servers, and then stays put to grab each new or edited document. The same malware steals saved Wi-Fi […]

The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files Read More »

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Brevo, ClickFix, Featured, Malware, Malware & Threats, supply chain attack, Supply Chain Security, WordPress /

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites 2026-09-18 at 12:46 By Ionut Arghire Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts. The post Brevo Supply Chain Attack Injects Malware Into 100,000 Websites appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites Read More »

US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware

Chosen Brick, espionage, Government, Iran, Malware, Malware & Threats, spyware, surveillance /

US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware 2026-09-16 at 15:00 By Eduard Kovacs US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C. The post US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware appeared first on SecurityWeek. This […]

US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware Read More »

Attackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz

cybercrime, Don't miss, Hot stuff, Hudson Rock, Malware, News, social engineering /

Attackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz 2026-09-15 at 13:10 By Sinisa Markovic Attackers compromised the verified official HBO Max Reddit account, u/hbomax, and used its trusted advertising status to launch a ClickFix campaign targeting macOS and Windows devices with information-stealing malware. Screenshot of the fraudulent ad (Source: Alex Cutts) ClickFix has […]

Attackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz Read More »

Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack

ClickFix, Mac malware, malvertising, Malware, Malware & Threats, Reddit /

Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack 2026-09-15 at 12:09 By Ionut Arghire Ads led to a ClickFix page designed to trick macOS and Windows users into installing malware. The post Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack appeared first on SecurityWeek. This article is […]

Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack Read More »

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

infostealer, Malware, Threat Intelligence /

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline 2026-09-10 at 13:45 By Ashish Khaitan Infostealer malware is behind a large share of today’s credential compromise — and it usually doesn’t start with a breach at all. When a security team hears “data breach,” the instinct is to look for […]

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline Read More »

Scroll to Top