New BTMOB Android Malware Enables Full Device Takeover 2026-05-28 at 16:05 By Ionut Arghire Delivered via phishing lures, the malware combines financial theft with data exfiltration and remote access. The post New BTMOB Android Malware Enables Full Device Takeover appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
New BTMOB Android Malware Enables Full Device Takeover Read More »
OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight 2026-05-27 at 09:24 By rohansinhacyblecom Executive Summary Cyble Research and Intelligence Labs (CRIL) has identified a novel Android banking trojan, dubbed OverlayPhantom, actively distributed in the wild via malicious URLs. The malware employs a two-stage infection chain, using a dropper application that impersonates trusted platforms, including
OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight Read More »
Laravel-Lang Packages Poisoned for Malware Delivery 2026-05-25 at 15:31 By Ionut Arghire Published within a 15-minute window, the malicious tags introduced backdoors to exfiltrate CI secrets. The post Laravel-Lang Packages Poisoned for Malware Delivery appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Laravel-Lang Packages Poisoned for Malware Delivery Read More »
JOMANGY: INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign 2026-05-21 at 16:56 By rohansinhacyblecom Executive Summary Cyble Research & Intelligence Labs (CRIL) has identified an active FreePBX exploitation campaign, with high confidence tied to INJ3CTOR3, an actor with a documented history of targeting VoIP infrastructure for financial gain since 2019. The campaign deploys a multi-stage Bash dropper
JOMANGY: INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign Read More »
Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ 2026-05-19 at 19:07 By Eduard Kovacs Fox Tempest provides a service that cybercriminals use to distribute ransomware and other malware disguised as legitimate software. The post Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original
Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ Read More »
PureLogs infostealer is stealing credentials worldwide 2026-05-19 at 16:58 By Zeljka Zorz A phishing campaign is smuggling the powerful PureLogs information stealer onto targets’ Windows machines by hiding encrypted malicious payloads inside cat photos, Fortinet researchers discovered. The attack The attack starts with a phishing email containing a TXZ archive and using an invoice-themed lure
PureLogs infostealer is stealing credentials worldwide Read More »
Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks 2026-05-19 at 16:58 By Kevin Townsend Attackers are increasingly abusing Microsoft’s decades-old MSHTA utility to stealthily deliver stealers, loaders, and persistent malware through phishing, fake software downloads, and LOLBIN-based attack chains. The post Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks appeared first
Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks Read More »
New macOS infostealer impersonates Apple, Microsoft, and Google in a single attack chain 2026-05-19 at 15:35 By Sinisa Markovic A SHub macOS infostealer variant called Reaper impersonates Apple, Microsoft, and Google to trick users into executing malicious code, then targets browser data, password managers, and cryptocurrency wallets while establishing persistence for continued access, SentinelOne found.
New macOS infostealer impersonates Apple, Microsoft, and Google in a single attack chain Read More »
First Shai-Hulud Worm Clones Emerge 2026-05-18 at 12:57 By Ionut Arghire At least one threat actor has adopted the recently released malware source code in attacks against NPM developers. The post First Shai-Hulud Worm Clones Emerge appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
First Shai-Hulud Worm Clones Emerge Read More »
201 arrested in INTERPOL disruption of phishing and fraud networks 2026-05-18 at 12:08 By Anamarija Pogorelec Operation Ramz, a cybercrime initiative coordinated by INTERPOL across the MENA region, focused on disrupting phishing campaigns, malware activity, and cyber scams that caused substantial financial losses across the region. The operation resulted in the arrest of 201 individuals
201 arrested in INTERPOL disruption of phishing and fraud networks Read More »
TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code 2026-05-15 at 14:32 By Ionut Arghire The hacking group is encouraging miscreants to use the code in supply chain attacks, promising monetary rewards. The post TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View
TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code Read More »
Free OnlyFans Lure Used to Spread Cross-Platform CRPx0 Malware 2026-05-12 at 17:34 By Kevin Townsend CRPx0 is a complex, stealthy malware campaign that targets macOS and Windows systems, and appears to have Linux capabilities in development. The post Free OnlyFans Lure Used to Spread Cross-Platform CRPx0 Malware appeared first on SecurityWeek. This article is an
Free OnlyFans Lure Used to Spread Cross-Platform CRPx0 Malware Read More »
‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials 2026-05-08 at 11:32 By Ionut Arghire The malware framework targets web applications and cloud environments, including AWS, Docker, Kubernetes, and more. The post ‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials Read More »
Vendor Says Daemon Tools Supply Chain Attack Contained 2026-05-07 at 17:33 By Ionut Arghire The software developer has identified the impacted systems, removed potentially compromised files, and validated installation packages. The post Vendor Says Daemon Tools Supply Chain Attack Contained appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Vendor Says Daemon Tools Supply Chain Attack Contained Read More »
Operation HumanitarianBait: An Infostealer Campaign in Disguise 2026-05-07 at 12:41 By rohansinhacyblecom Executive Summary Cyble Research and Intelligence Labs (CRIL) has uncovered a targeted cyberespionage campaign leveraging social engineering and trusted infrastructure to establish persistent, covert access to victim systems. The attack is delivered via phishing emails containing a malicious LNK file disguised within a
Operation HumanitarianBait: An Infostealer Campaign in Disguise Read More »
CallPhantom Android scam reached 7.3 million downloads on Google Play 2026-05-07 at 12:00 By Anamarija Pogorelec Scams targeting Android users in India and across the Asia-Pacific region have grown around a long-standing curiosity gap: the desire to look up call records tied to a phone number. A cluster of 28 fraudulent apps on Google Play
CallPhantom Android scam reached 7.3 million downloads on Google Play Read More »
Sophisticated Quasar Linux RAT Targets Software Developers 2026-05-06 at 13:00 By Ionut Arghire The persistent, evasive implant provides remote access, surveillance, and credential exfiltration capabilities. The post Sophisticated Quasar Linux RAT Targets Software Developers appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Sophisticated Quasar Linux RAT Targets Software Developers Read More »
North Korean hackers trojanize gaming platform to spy on ethnic Koreans in China 2026-05-05 at 13:21 By Sinisa Markovic A gaming platform built for ethnic Koreans in China has been serving backdoored Windows and Android software to its users since late 2024. The platform, sqgame[.]net, hosts traditional card and board games for a community that
North Korean hackers trojanize gaming platform to spy on ethnic Koreans in China Read More »
DigiCert breached via malicious screensaver file 2026-05-04 at 18:59 By Sinisa Markovic A targeted social engineering attack against DigiCert’s support channel led to the compromise of internal systems and the unauthorized issuance of EV Code Signing certificates. DigiCert is a global Certificate Authority (CA) providing digital trust services, specializing in TLS/SSL certificates, PKI management, and
DigiCert breached via malicious screensaver file Read More »
DigiCert Revokes Certificates After Support Portal Hack 2026-05-04 at 16:22 By Ionut Arghire Hackers delivered malware via a customer chat channel, infected an analyst’s system, and accessed the internal support portal. The post DigiCert Revokes Certificates After Support Portal Hack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
DigiCert Revokes Certificates After Support Portal Hack Read More »