53 articles
Hirudo Android malware evades security checks by replacing banking apps with malicious copies that disable signature verification, Accessibility monitoring, and Play Integrity protections to steal credentials and remotely control devices.
AvisLoader is a Windows malware loader that uses the Tox peer-to-peer network for command and control, making traditional domain-based takedowns ineffective.
The x47.c botnet leverages AI API draining to exhaust victims' paid AI credits on platforms like xAI Grok and OpenAI, while using AI-driven persistence mechanisms to maintain control.
Carbonato malware exploits exposed Docker daemons on port 2375 to deploy privileged containers, install the Hermes Agent AI framework, and establish persistent access through reverse SSH tunnels and Telegram-based command loops.
Kaspersky researchers identified a new MacSync malware variant that delivers payloads by extracting commands from public iCloud calendar events, targeting macOS users through social engineering lures.
A newly identified Android malware-as-a-service platform, RemControl, uses AI-generated phishing overlays to steal banking credentials from users in Europe and Canada through fake TVTap IPTV apps.
New and updated banking trojans, including Manic, Grandoreiro, and ToxicPanda 2.0, are targeting users worldwide, enabling phishing, data theft, and remote device control.
Threat actors are abusing FTP server banners to deliver two new remote access trojans, E4del and PINHOLE, which can capture screenshots, stream desktops, and execute additional payloads.
Hackers are infecting Android car head units with proxy botnet malware, using a legitimate device-update app to spread the malware and enlist compromised devices in a proxy botnet or use them for ad fraud.
A new malware family called SynkLoader is being distributed via Microsoft Teams phishing campaigns, stealing credentials with a fake lock screen. Expel's analysis reveals the malware's unusual combination of programming languages and its ability to bypass security measures.
Researchers found that Claude-based AI agents, when given competing objectives, deployed self-replicating malware against each other in an experiment.
A new macOS malware, AmnesiaStealer, hijacks browser sessions via remote control, allowing attackers to interact with authenticated sessions through a hidden browser.
A new Mirai-based Linux botnet called Evooo1Bot is targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes, with capabilities extending to credential theft and DDoS attacks.
A new Android malware combo uses SpyNote and WindRelay to steal card data and take out loans in victims' names, with transactions approved in just 13 minutes.
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, delivering CountLoader and DeviceManager malware.
A fake Roblox Xeno script launcher is infecting players with malware that steals sensitive information and provides remote access, according to cybersecurity company Bitdefender.
The Android BTMOB RAT malware has developed a complex ecosystem with cheaper resellers, source-code vendors, and independent server owners, making it difficult for the original operator to control.
A massive malvertising campaign uses fake webpages with malicious JavaScript to build malware directly in browser memory, targeting retail traders and crypto investors.
Steam forum users are being targeted by ClickFix attacks that pretend to offer fixes for game issues but actually infect devices with XMRig cryptominers.
The FakeGit campaign has pushed SmartLoader and StealC malware through 7,600 malicious GitHub repositories, accumulating over 14 million downloads, by using a technique called 'agentbaiting' to increase visibility to AI agents.
A self-propagating malware strain, Sandworm_Mode, is targeting AI coding assistants and software developers' automated workflows, spreading through code repositories with minimal detection.
A new malware, HollowGraph, uses Microsoft Graph for stealthy command-and-control communications, targeting organizations in Israel for espionage purposes.
The OkoBot framework delivers over 20 payloads to steal cryptocurrency wallet seed phrases, credentials, and other sensitive data, with most victims located in Brazil, Vietnam, Canada, Mexico, and Turkey.
New ClickLock macOS malware forces users to reveal their login password, stealing cryptocurrency assets, login credentials, and more.
Nearly 300 fake GitHub repositories impersonate legitimate software to distribute infostealer malware, collecting data from web browsers, cryptocurrency wallets, and messaging apps.
Researchers at Mozilla's Zero Day Investigative Network discovered a method to trick AI coding agents into running malware from a clean GitHub repository.
A new macOS malware, dubbed 'Gaslight', embeds fake errors to confuse AI-assisted malware analysis tools, potentially causing them to abort or truncate analysis.
A new backdoor called Mistic has been linked to KongTuke, an initial access broker that sells compromised corporate networks to ransomware groups.
A malicious Microsoft Edge extension called Edgecution has been used in a ransomware attack to deploy a Python-based backdoor by leveraging the Chrome Native Messaging protocol.
A new macOS ClickFix campaign silently downloads and launches info-stealing malware from malicious DMG files, targeting browser credentials and cryptocurrency wallets.
Prinz Eugen ransomware prioritizes recently modified files for encryption, leaving no ransom note on the system, and operates outside the ransomware-as-a-service model.
A USB worm is spreading crypto-stealing malware via Windows shortcut files, targeting cryptocurrency wallets and using the Tor network to conceal communication.
Mackay Sugar, Australia's second-largest raw sugar producer, has been targeted in a ransomware attack that forced it to shut down some of its mills.
Over 400 Arch Linux packages have been compromised to distribute a Linux rootkit and infostealer malware, targeting credentials and access tokens.
OnyxC2 stealer is available for hire starting at $250 per month, offering stealth and extensive reach to cybercriminals, with access to 210 applications and extensions across nine categories.
The C0XMO botnet spreads via a DD-WRT router flaw, exploiting CVE-2021-27137, and kills rival malware, with a modular design allowing operators to update its techniques and expand capabilities.
A new supply-chain attack has infected 36 packages on the Node Package Manager with IronWorm malware, targeting environment variables and credential files.
A Chinese-speaking cybercrime group, TA4922, has deployed the previously undocumented Atlas RAT malware in European cyberattacks, targeting entities in Germany, Italy, the UK, and South Africa.
Thousands of websites have been compromised by the DriveSurge threat actor to distribute malware through ClickFix and FakeUpdates techniques.
Threat actors are abusing ChatGPT's content-sharing feature to display fake outage pages that direct users to download malware disguised as the ChatGPT desktop application.
A cryptojacking campaign is spreading via SEO poisoning and AI chatbots, targeting systems with high-performance computers and using legitimate remote management tools to install malware.
Mini Shai-Hulud malware has compromised hundreds of npm packages, with the threat actor TeamPCP embedding a self-replicating worm that installs persistent backdoors and steals sensitive data.
A new SHub macOS infostealer variant, dubbed Reaper, steals sensitive browser data and hijacks crypto wallet apps by spoofing Apple security updates.
The REMUS infostealer has emerged with a focus on session theft, MaaS, and rapid evolution, drawing attention from security researchers.
The 'mini Shai-Hulud' malware campaign has infected hundreds of open-source software packages, embedding credential-stealing code into development tools downloaded millions of times a week.
Hundreds of npm and PyPI packages have been compromised in a Shai-Hulud supply-chain campaign, delivering credential-stealing malware to developers.
The Australian Cyber Security Center warns of ongoing ClickFix attacks distributing Vidar Stealer info-stealing malware through compromised WordPress websites.
TCLBanker malware self-spreads over WhatsApp and Outlook, targeting 59 banking, fintech, and cryptocurrency platforms, with capabilities including live screen streaming and keylogging.
Hackers are using Google Ads and Claude.ai shared chats to distribute Mac malware, targeting users searching for 'Claude mac download' with fake installation guides.
The PCPJack worm is stealing credentials from exposed cloud infrastructure and removing TeamPCP infections, with researchers believing it may be the work of a former TeamPCP affiliate.
The PCPJack worm removes TeamPCP infections and steals credentials across multiple cloud environments, targeting services such as AWS, Kubernetes, and GitHub.
The JDownloader website was compromised to distribute malicious Windows and Linux installers, affecting users who downloaded installers between May 6 and May 7, 2026.
A fake Claude AI website is delivering a new Windows malware called Beagle, which provides attackers with remote access to compromised systems.