Malware

Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes

AI, botnet, cybercrime, Malware, News, Trend Micro /

Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes 2026-07-16 at 15:08 By Sinisa Markovic A Russian-speaking threat actor known as “bandcampro” used a jailbroken Gemini CLI, Google’s open-source terminal-based AI agent, to deploy and operate a small command-and-control (C2) botnet, according to Trend Micro. Operational overview (Source: Trend Micro) In […]

Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes Read More »

Ransom demands are down, email is the top way attackers get in

credentials, cybercrime, cybersecurity, Don't miss, Encryption, Malware, News, Ransomware, report, Sophos /

Ransom demands are down, email is the top way attackers get in 2026-07-16 at 08:00 By Mirko Zorz An employee opens an email that looks like any other, clicks a link, and gives up a password without noticing. A stolen login opens a door deeper in the network. Files stop opening a few days later. […]

Ransom demands are down, email is the top way attackers get in Read More »

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

Blackpoint Cyber, cybercrime, Malware, News /

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software 2026-07-15 at 17:43 By Sinisa Markovic LabubaRAT, a previously undocumented Rust-based remote access tool (RAT) masquerading as NVIDIA software that enables post-compromise operations on Windows systems, has been uncovered by Blackpoint Cyber. According to researchers, LabubaRAT creates “a reusable foothold for hands-on activity.” Once deployed, […]

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software Read More »

Threat actor impersonated hundreds of brands on GitHub to push infostealer malware

Arctic Wolf Networks, credentials, data theft, digital wallet, Don't miss, GitHub, Hot stuff, Malware, News /

Threat actor impersonated hundreds of brands on GitHub to push infostealer malware 2026-07-15 at 16:52 By Zeljka Zorz A financially motivated threat actor is impersonating hundreds of brands on GitHub and pushing a smash-and-grab infostealer masquerading as legitimate downloads of popular software, Arctic Wolf threat researchers have warned. “The 292 impersonated repositories span security tooling, […]

Threat actor impersonated hundreds of brands on GitHub to push infostealer malware Read More »

Windows Bind Link Attacks Can Hide Malware From EDR Tools

Endpoint Security, Featured, Malware, Malware & Threats, Windows /

Windows Bind Link Attacks Can Hide Malware From EDR Tools 2026-07-15 at 16:00 By Kevin Townsend Bitdefender researchers show how Windows bind links can create conflicting filesystem views to hide malware from endpoint security products. The post Windows Bind Link Attacks Can Hide Malware From EDR Tools appeared first on SecurityWeek. This article is an […]

Windows Bind Link Attacks Can Hide Malware From EDR Tools Read More »

New macOS malware steals passwords by posing as Apple’s crash-reporting tool

apple, macOS, Malware, News /

New macOS malware steals passwords by posing as Apple’s crash-reporting tool 2026-07-14 at 16:46 By Sinisa Markovic Jamf Threat Labs has uncovered a new macOS infostealer named CrashStealer that disguises itself as Apple’s crash-reporting tool to steal passwords, Keychain data, and cryptocurrency wallets. The malware was first spotted in May while it was still under […]

New macOS malware steals passwords by posing as Apple’s crash-reporting tool Read More »

GigaWiper Combines Multiple Malware for System-Level Sabotage

backdoor, GigaWiper, Malware, Malware & Threats, wiper /

GigaWiper Combines Multiple Malware for System-Level Sabotage 2026-07-10 at 12:12 By Ionut Arghire The backdoor’s destructive capabilities include a standalone wiper, ransomware encryption, and a multi-pass wiping command. The post GigaWiper Combines Multiple Malware for System-Level Sabotage appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

GigaWiper Combines Multiple Malware for System-Level Sabotage Read More »

Network of 200 GitHub Repositories Used for Malware Infection

GitHub, Malware, Malware & Threats, Muck and Load /

Network of 200 GitHub Repositories Used for Malware Infection 2026-07-10 at 11:00 By Ionut Arghire A Go module is used to load PowerShell code that fetches a resolver from public dead drops to execute Windows malware. The post Network of 200 GitHub Repositories Used for Malware Infection appeared first on SecurityWeek. This article is an […]

Network of 200 GitHub Repositories Used for Malware Infection Read More »

SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)

Blackpoint Cyber, CISA, credentials, data theft, Don't miss, Horizon3.ai, Hot stuff, Linux, macOS, Malware, MSP, News, remote management, SimpleHelp, vulnerability, Windows /

SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558) 2026-06-30 at 13:25 By Zeljka Zorz Attackers are exploiting CVE-2026-48558, a recently patched authentication bypass vulnerability in SimpleHelp RMM, to drop the novel Djinn Stealer malware on victim computers. The malware is capable of targeting Windows, macOS, and Linux systems, and “collects credentials associated with cloud […]

SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558) Read More »

Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App

Android, cyber news, Malware, trojan /

Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App 2026-06-30 at 12:58 By rohansinhacyblecom Executive Summary Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY, distributed through a fraudulent Polish apartment and house rental platform designed to lure users into downloading an Android APK. Based […]

Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App Read More »

Critical SimpleHelp Vulnerability Exploited for Malware Delivery

CISA KEV, exploited, Malware, Malware & Threats, SimpleHelp, Vulnerabilities, vulnerability /

Critical SimpleHelp Vulnerability Exploited for Malware Delivery 2026-06-30 at 11:43 By Ionut Arghire The threat actor is focused on collecting credentials, SSH keys, cryptocurrency wallets, and development tooling. The post Critical SimpleHelp Vulnerability Exploited for Malware Delivery appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Critical SimpleHelp Vulnerability Exploited for Malware Delivery Read More »

Mystery hackers use novel SharkLoader dropper against governments, software devs

Asia, Don't miss, Europe, Government, Hot stuff, Kaspersky, Malware, News, software development /

Mystery hackers use novel SharkLoader dropper against governments, software devs 2026-06-26 at 12:13 By Zeljka Zorz Kaspersky researchers have uncovered a previously unknown cyberattack campaign that has compromised government organizations and software development companies in multiple countries. They first stumbled onto the campaign while investigating an attack on a diplomatic organization in Indonesia. What initially […]

Mystery hackers use novel SharkLoader dropper against governments, software devs Read More »

Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets

APT, Malware, Malware & Threats, Russia, StockStay, Ukraine /

Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets 2026-06-26 at 11:55 By Ionut Arghire Turla has been using the backdoor against government and military organizations in Ukraine for espionage. The post Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets Read More »

Stealthy new backdoor surfaces in attacks on multiple sectors

backdoor, cybercrime, Malware, News, Ransomware, Remote Access Trojan /

Stealthy new backdoor surfaces in attacks on multiple sectors 2026-06-25 at 17:07 By Sinisa Markovic A relatively new backdoor called Mistic has been deployed in multiple attacks since April 2026 targeting organizations in the insurance, education, IT, and professional services sectors, according to Symantec. The malware appears to be associated with Woodgnat, also known as […]

Stealthy new backdoor surfaces in attacks on multiple sectors Read More »

Law enforcement hits StealC and Amadey malware networks

cybercrime, Don't miss, Europol, Hot stuff, IBM X-Force, law enforcement, Malware, Microsoft, News, Proofpoint /

Law enforcement hits StealC and Amadey malware networks 2026-06-24 at 18:05 By Zeljka Zorz Operation Endgame, the largest international law enforcement operation aimed at disrupting ransomware and cybercrime infrastructure across the world, has claimed its latest targets: StealC and Amadey. The notice on disrupted websites (Source: Microsoft) While developed by separate criminal groups, those two […]

Law enforcement hits StealC and Amadey malware networks Read More »

Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware

Amadey, cybercrime, Europol, law enforcement, Malware, Malware & Threats, Microsoft, StealC, takedown, Tracking & Law Enforcement /

Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware 2026-06-24 at 18:02 By Eduard Kovacs Hundreds of C&C servers were disrupted in an operation involving law enforcement and several cybersecurity companies. The post Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware appeared first on SecurityWeek. This article is an excerpt […]

Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware Read More »

New ‘Mistic’ RAT Opens Door to Several Ransomware Families

backdoor, cybercrime, initial access broker, Malware, Malware & Threats, Mistic, RAT /

New ‘Mistic’ RAT Opens Door to Several Ransomware Families 2026-06-24 at 14:42 By Ionut Arghire Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. The post New ‘Mistic’ RAT Opens Door to Several Ransomware Families appeared first on SecurityWeek. This article is an excerpt from […]

New ‘Mistic’ RAT Opens Door to Several Ransomware Families Read More »

Cybercriminals abused GitHub, YouTube and VirusTotal to push crypto-stealing malware

Check Point, Crypto, Cryptocurrency, cybercrime, Malware, News /

Cybercriminals abused GitHub, YouTube and VirusTotal to push crypto-stealing malware 2026-06-19 at 15:11 By Sinisa Markovic A cryptocurrency-stealing malware campaign used inflated GitHub activity, software reviews, YouTube tutorials and favorable VirusTotal comments to make malicious trading and gambling tools appear trustworthy, Check Point researchers found. According to the researchers, the attackers packaged the malware as […]

Cybercriminals abused GitHub, YouTube and VirusTotal to push crypto-stealing malware Read More »

CryptoBandits Malware Doubles as a Backdoor, Abuses Tor

CryptoBandits, Cryptocurrency, Malware, Malware & Threats, Tor /

CryptoBandits Malware Doubles as a Backdoor, Abuses Tor 2026-06-19 at 14:19 By Ionut Arghire CryptoBandits uses a local SOCKS5 proxy for traffic routing, blending data theft with remote code execution. The post CryptoBandits Malware Doubles as a Backdoor, Abuses Tor appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

CryptoBandits Malware Doubles as a Backdoor, Abuses Tor Read More »

Law enforcement hits SocGholish: 106 servers down, 15,000 sites cleaned

Don't miss, Hot stuff, Infoblox, law enforcement, Malware, News, Proofpoint, WordPress /

Law enforcement hits SocGholish: 106 servers down, 15,000 sites cleaned 2026-06-18 at 17:21 By Zeljka Zorz SocGholish, an operation that’s been delivering malware to users via fake software updates, has suffered a major blow: the international law enforcement coalition behind Operation Endgame has taken down 106 of its servers and domains, and cleaned up nearly […]

Law enforcement hits SocGholish: 106 servers down, 15,000 sites cleaned Read More »

Scroll to Top