ClickFix Attack Uses Windows Terminal to Evade Detection 2026-03-09 at 15:37 By Ionut Arghire Fake CAPTCHA pages instruct victims to paste malicious commands in the Windows Terminal instead of the Run dialog. The post ClickFix Attack Uses Windows Terminal to Evade Detection appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]
ClickFix Attack Uses Windows Terminal to Evade Detection Read More »
Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign 2026-03-09 at 13:50 By Ionut Arghire Threat actors replace legitimate commands on the cloned installation webpages with malicious commands. The post Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Cloned AI Tool Sites Distribute Malware in ‘InstallFix’ Campaign Read More »
Over 100 GitHub Repositories Distributing BoryptGrab Stealer 2026-03-07 at 14:46 By Ionut Arghire The malware targets browser and cryptocurrency wallet data, along with system information and user files. The post Over 100 GitHub Repositories Distributing BoryptGrab Stealer appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Over 100 GitHub Repositories Distributing BoryptGrab Stealer Read More »
That attractive online ad might be a malware trap 2026-03-05 at 14:46 By Anamarija Pogorelec Malware increasingly travels through the infrastructure that delivers online advertising. The Media Trust’s Global Report on Digital Trust, Ad Integrity, and the Protection of People describes a digital ad ecosystem where scam campaigns, malicious redirects, and malware delivery appear alongside
That attractive online ad might be a malware trap Read More »
ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader 2026-03-05 at 14:27 By rohansinhacyblecom Executive Summary In early February 2026, Cyble Research & Intelligence Labs (CRIL) identified a new Linux malware strain delivered through a loader structure previously associated with ShadowHS activity. While ShadowHS samples deployed post-exploitation tooling, the newly observed payload is operationally different.
ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader Read More »
How Pirated Software Turns Helpful Employees Into Malware Delivery Agents 2026-03-04 at 14:48 By Kevin Townsend Employees seeking free versions of paid software may unknowingly install malware-laced “cracked” apps that can steal credentials, deploy cryptominers, or open the door to ransomware. The post How Pirated Software Turns Helpful Employees Into Malware Delivery Agents appeared first
How Pirated Software Turns Helpful Employees Into Malware Delivery Agents Read More »
Threat actors weaponize OAuth redirection logic to deliver malware 2026-03-03 at 19:46 By Zeljka Zorz An ongoing phishing campaign is abusing the OAuth authentication redirection mechanism to avoid triggering conventional email and browser defenses, Microsoft researchers have revealed. The attackers are targeting government and public-sector organizations, and redirecting unsuspecting users from trusted login pages to
Threat actors weaponize OAuth redirection logic to deliver malware Read More »
Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience 2026-02-27 at 14:30 By Ionut Arghire Aeternum operates on smart contracts, making its command-and-control (C&C) infrastructure difficult to disrupt. The post Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Aeternum Botnet Loader Employs Polygon Blockchain C&C to Boost Resilience Read More »
Google Disrupts Chinese Cyberespionage Campaign Targeting Telecoms, Governments 2026-02-25 at 18:01 By Eduard Kovacs The UNC2814 threat actor has been active since at least 2017, targeting organizations across 42 countries. The post Google Disrupts Chinese Cyberespionage Campaign Targeting Telecoms, Governments appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Google Disrupts Chinese Cyberespionage Campaign Targeting Telecoms, Governments Read More »
‘Arkanix Stealer’ Malware Disappears Shortly After Debut 2026-02-24 at 17:53 By Ionut Arghire Written in C++ and Python, the malware exfiltrates system information, browser data, and steals files. The post ‘Arkanix Stealer’ Malware Disappears Shortly After Debut appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
‘Arkanix Stealer’ Malware Disappears Shortly After Debut Read More »
Self-spreading npm malware targets developers in new supply chain attack 2026-02-24 at 15:10 By Zeljka Zorz Security researchers have uncovered another supply chain attack targeting developers: 19 typosquatting npm packages published on npmjs.com that steal credentials, infect projects, and propagate themselves across developer environments. The operation, dubbed “SANDWORM_MODE,” represents a (still) rare example of worm-like
Self-spreading npm malware targets developers in new supply chain attack Read More »
SURXRAT: From ArsinkRAT roots to LLM Module Downloads Signaling Capability Expansion 2026-02-24 at 09:07 By rohansinhacyblecom Executive Summary SURXRAT is an actively developed Android Remote Access Trojan (RAT) commercially distributed through a Telegram-based malware-as-a-service (MaaS) ecosystem under the SURXRAT V5 branding. The malware is marketed using structured reseller and partner licensing tiers, allowing affiliates to
SURXRAT: From ArsinkRAT roots to LLM Module Downloads Signaling Capability Expansion Read More »
Poland’s energy control systems were breached through exposed VPN access 2026-02-06 at 16:27 By Sinisa Markovic On 29 December 2025, coordinated cyberattacks unfolded across Poland’s critical infrastructure, targeting energy and industrial organizations. The attackers struck numerous wind and solar farms, a private manufacturing company, and a heat and power (CHP) plant, but failed to negatively
Poland’s energy control systems were breached through exposed VPN access Read More »
SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown 2026-02-05 at 14:21 By Ionut Arghire The malware is known for dropping ransomware and other payloads, and for abusing infected machines to proxy traffic. The post SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown appeared first on SecurityWeek. This article is an excerpt from SecurityWeek
SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown Read More »
Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack 2026-02-02 at 16:18 By Ionut Arghire A hacker published malicious versions of four established VS Code extensions to distribute a GlassWorm malware loader. The post Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View
Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack Read More »
Cyber Insights 2026: Malware and Cyberattacks in the Age of AI 2026-02-02 at 14:03 By Kevin Townsend Security leaders share how artificial intelligence is changing malware, ransomware, and identity-led intrusions, and how defenses must evolve. The post Cyber Insights 2026: Malware and Cyberattacks in the Age of AI appeared first on SecurityWeek. This article is
Cyber Insights 2026: Malware and Cyberattacks in the Age of AI Read More »
eScan Antivirus Delivers Malware in Supply Chain Attack 2026-01-31 at 17:24 By Ionut Arghire Hackers compromised a MicroWorld Technologies update server and fed a malicious file to eScan customers. The post eScan Antivirus Delivers Malware in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
eScan Antivirus Delivers Malware in Supply Chain Attack Read More »
Hugging Face Abused to Deploy Android RAT 2026-01-30 at 13:38 By Ionut Arghire Android users were lured to applications that served a malicious payload hosted in a Hugging Face repository. The post Hugging Face Abused to Deploy Android RAT appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source
Hugging Face Abused to Deploy Android RAT Read More »
ShadowHS: A Fileless Linux Post‑Exploitation Framework Built on a Weaponized hackshell 2026-01-30 at 07:09 By rohansinhacyblecom Executive Summary Cyble Research & Intelligence Labs (CRIL) has identified a Linux intrusion chain leveraging a highly obfuscated, fileless loader that deploys a weaponized variant of hackshell entirely from memory. Cyble tracks this activity under the name ShadowHS, reflecting
ShadowHS: A Fileless Linux Post‑Exploitation Framework Built on a Weaponized hackshell Read More »
eScan AV supply chain compromise: Users targeted with malicious updates 2026-01-29 at 17:29 By Zeljka Zorz The update infrastructure for eScan antivirus, a product of Indian cybersecurity company MicroWorld Technologies, has been compromised by unknown attackers to deliver a persistent downloader to enterprise and consumer endpoints. The supply chain compromise also resulted in the eScan
eScan AV supply chain compromise: Users targeted with malicious updates Read More »