Hackers Backdoor Linux Servers via Trojanized CWP Web Server
CWPdoor Linux malware spreads through a trojanized Control Web Panel web server to backdoor Linux servers.
Tag
#Malware
64 results in the archive.
NIKKE PC Game Launcher Hacked to Spread Data-Stealing Malware
Hackers compromised the Goddess of Victory: NIKKE PC game launcher through a supply-chain attack that distributed data-stealing malware targeting credentials and cryptocurrency wallets.
VOLTA Infostealer Uses AI for Victim Prioritization
The VOLTA infostealer steals credentials, sessions, and crypto wallets, employing AI models to profile victims and prioritize valuable targets, representing a new phase in malware tactics.
Malicious Claude Code Extension on Cursor Delivered SSH Backdoors
A compromised version of Anthropic's Claude Code extension for VS Code was available on Cursor's marketplace for 11 hours, potentially exposing thousands of developers to SSH backdoor malware.
319 Chrome Extensions with 13.4M Installs Hijack Searches for Ad Revenue
A campaign involving 319 Chrome extensions with 13.4 million installs was found hijacking user searches through Bing and Yahoo tracking servers to generate advertising revenue.
Fake ChatGPT and Claude Apps Deploy Crypto Miners via Signed Executables
Threat actors distribute cryptocurrency miners and malicious loaders disguised as AI desktop apps mimicking ChatGPT and Claude, using signed executables to evade detection.
Lazarus Group Uses South Korean Security Software to Deploy Malware
The Lazarus Group has conducted Operation FlashHole targeting South Korean firms using post-quantum encryption to deploy malware.
LiteLLM release pipeline hacked to distribute info-stealer malware
The LiteLLM project’s PyPI package and Docker images were compromised to distribute malware that steals credentials and secrets, impacting AI-related software supply chains.
Japan's Onamae Desktop Cloud hacked, nearly 27,000 servers compromised
Hackers breached Onamae Desktop Cloud, infecting up to 26,739 servers with malware, risking disruption to hosted customer infrastructure.
Rank Math PRO WordPress Plugin Compromised in Supply-Chain Attack
The Rank Math PRO WordPress plugin was compromised via its official vendor site, distributing malware with hidden backdoors that affect numerous websites.
Nippon Columbia Malware Incident Exposes 8.7 Million Records
A malware infection at Nippon Columbia, a contractor to Japanese entertainment system maker Daiichi Kosho, led to exposure of over 8.7 million customer and employee records, underscoring third-party data security risks.
Credential-Stealing GitHub Actions Workflows Found in Thousands of Repos
Attackers compromised open-source maintainer accounts to plant malicious GitHub Actions workflows stealing credentials in over 340 repositories.
Hackers Use Google Ads and Bing Redirects to Spread Claude ClickFix Malware
Attackers exploit legitimate Bing search-result redirects in Google search ads to deliver fake Claude installers, leading to ClickFix malware infections and leveraging trusted platforms for distribution.
Eight Malicious npm Packages Delivered Overlord RAT and Stealer
Researchers uncovered 12 malicious npm packages, including eight delivering Overlord RAT and stealers, downloaded over 40,000 times since August 2023, posing supply chain risks to npm users.
PoeLLM Malware Infects Over 3,400 Servers to Expand Crypto Mining Botnet
The PoeLLM malware family targets exposed AI and language model infrastructure, compromising over 3,400 servers to deploy cryptocurrency miners and grow the Canto Incognito botnet.
Linux Backdoors Evade Detection by Mimicking Email Security Tools in Asia
Linux backdoors targeting telecom and network devices in South Korea and Taiwan disguise their traffic as email services and legitimate processes to evade detection.
Realtek Jungle SDK Exploit Attempts Spread Cling Botnet via STUN C2
Threat actors exploit a patched critical flaw in the Realtek Jungle SDK to spread the Cling botnet, employing the STUN protocol for command-and-control communications.
WordPress Backdoor Rebuilds Itself Using Files, Database, and Shared Memory
Researchers uncovered a WordPress backdoor named SC that self-heals using multiple persistence methods, complicating removal efforts and increasing ongoing risks.
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Threat actors are exploiting ChatGPT Custom GPTs to impersonate legitimate products and deliver remote access trojans through ClickFix lures.
Star Blizzard advances phishing and malware with RedFlick technique
Since early 2026, Microsoft has tracked Russian state actor Star Blizzard using enhanced phishing and a new malware delivery method called RedFlick, improving their evasion capabilities.
Compromised GitHub Actions Resume Mini Shai-Hulud Malware Execution
Two GitHub Actions repositories compromised during the May 2026 Mini Shai-Hulud campaign resumed malware execution after recent unauthorized access, highlighting risks in CI/CD supply chains.
New Carbonato Botnet Uses AI Agents to Hijack Docker Hosts
The Carbonato malware exploits exposed Docker daemons by deploying the Hermes Agent AI framework to control infected hosts, marking an evolution in AI-driven hijacking.
Malicious Terraform Providers Distribute Go Malware via HashiCorp Registry
Researchers identified Go-based malware distributed through malicious Terraform providers and Go Modules hosted on the HashiCorp official registry, exposing DevOps environments to novel risks.
Contagious Interview Campaign Hits 30K Devices, Steals $10.7M Crypto
North Korean hackers behind the Contagious Interview campaign compromised over 30,000 devices worldwide, targeting crypto specialists and web designers to steal $10.7 million from more than 7,000 cryptocurrency wallets.
Fake LastPass Authenticator GitHub Repos Spread New Rapuncel Infostealer
A campaign exploits SEO-optimized fake LastPass Authenticator GitHub repositories to distribute a new information stealer named Rapuncel.
Brevo Supply-Chain Attack Injected Malicious Scripts on Customer Sites
Attackers compromised Brevo by stealing a Cloudflare API key and injecting malicious scripts into Brevo and its customers' websites, resulting in malware distribution via a supply-chain attack.
New RatHat Android Malware Uses AI for Automated Device Control
RatHat is a newly discovered Android malware that incorporates an AI-powered subsystem enabling attackers to remotely control compromised devices, streamlining exploitation actions.
Attacker Hijacks AI Coding Assistant, Spreads Malware Across 100 Repos
An attacker hijacked an AI coding assistant session to distribute the Shai-Hulud worm within approximately 100 internal code repositories at a SaaS provider, resulting in theft of repository secrets and source code.
Iranian Hackers Deploy CHOSEN BRICK Malware to Target Activists
Iranian state-linked hackers are using the CHOSEN BRICK Windows malware to conduct surveillance on activists, dissidents, and journalists worldwide, enabling persistent spying and data collection.
Iranian Hackers Deploy Telegram-Controlled Malware Against Dissidents
US, UK, and Dutch agencies report Iran's intelligence uses Windows malware controlled via Telegram to spy on dissidents and journalists globally, targeting sensitive communications and recordings.
Hackers Exploit Tencent App Flaw to Deploy GrayRabbit Malware
A China-linked espionage group exploits a critical vulnerability in Tencent's Sogou Input Method to deliver GrayRabbit backdoor malware, posing risks to users and enterprises.
Russian Hackers Use AI to Rebuild Malware Faster After Detection
Anthropic has disrupted a Russian state-sponsored threat actor's campaign that used AI to accelerate malware redevelopment and evade detection, marking an evolution in cyber espionage.
China-Linked UNC3569 Exploits Sogou Input Method Flaw for GRAYRABBIT Backdoor
The China-linked threat group UNC3569 exploited a vulnerability in Sogou Input Method on Windows to deploy the GRAYRABBIT backdoor, allowing attackers full control of the affected user's machine.
JSCeal Malware Can Bypass Google Auth Using Stolen Session Cookies
JSCeal malware is a sophisticated JavaScript-based threat that bypasses Google authentication by stealing session cookies and uses advanced obfuscation to evade detection.
5,400+ hacked sites deliver ClickFix malware via blockchain storage
Over 5,400 small-business websites have been compromised to distribute ClickFix malware payloads stored in smart contracts on the BNB Smart Chain, using blockchain to evade detection.
BraZetsu Malware Turns Windows Hosts Into Underground Marketplace Assets
Researchers identify BraZetsu, a Python-based Windows malware that enables Initial Access Brokers to commercialize compromised systems as marketplace inventory.
US Charges Russian for Malware Campaign Targeting 80,000 Freelancers
A Russian national has been indicted in the US for a phishing campaign that infected 80,000 freelancers with TVRAT and DarkVNC malware, representing significant cybercrime against remote workers.
Guildma (Astaroth) Malware Infection via Brazilian Portuguese Email
A surge of Guildma (Astaroth) malware infections is spreading through Brazilian Portuguese phishing emails, posing risks through data theft and stealthy behavior.
Microsoft alerts on TerminalFix attacks using reverse tunnels
Microsoft warns of TerminalFix malware that exploits Windows Terminal and PowerShell via fake CAPTCHA prompts to create persistent reverse tunnels on compromised systems.
19 Chrome and Edge Extensions Found Stealing Crypto Wallets
Researchers discovered 19 malicious Chrome and Edge browser extensions that steal cryptocurrency wallet secrets, indicating a coordinated campaign.
StopAndProtect Uses 2,000 Hacked WordPress Sites to Spread Malware
The StopAndProtect campaign uses nearly 2,000 compromised WordPress sites worldwide to distribute malware and collect stolen data, impacting web infrastructure security.
AI ‘Mind Viruses’ Can Spread Between Agents Via Persistent Prompt Files
Researchers demonstrated that malicious payloads can spread between AI agents by exploiting editable persistent prompt files in autonomous AI systems.
Hundreds of Fake Chrome VPN Extensions Route Traffic Through Proxy
Over 737 fake VPN and proxy extensions on the Chrome Web Store routed user traffic through SOCKS5 proxies controlled by a single entity, posing serious privacy and security risks.
Sandworm-Linked Group Uses Fake Job Interviews to Deploy Malware
CERT-UA reports Sandworm subgroup UAC-0145 targets Ukrainian IT workers with fake job interviews to deploy malware via a malicious VPN tool.
Kimsuky Develops Offline AI Stack to Enhance Phishing and Malware
North Korea’s APT group Kimsuky has implemented an offline AI infrastructure that advances their phishing tactics and automates malware development by integrating AI with internal document search and malware creation tools.
Nearly 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
A campaign distributing nearly 800 malicious npm packages with typo-squatted AI-generated names delivers a powerful RAT and infostealer targeting Windows, Mac, and Linux environments, posing a significant threat to developers and enterprises using npm packages.
ChainDrop Malware Infects 1,300+ npm Packages in Supply-Chain Attack
The ChainDrop malware has compromised over 1,300 npm packages, impacting software supply chain security with billions of downloads monthly.
How Threat Actors Are Weaponizing Cloud-Based AI: A Data-Driven Review
Talos analyzed prompt logs from various AI applications used by threat actors to understand their evolving tactics, revealing increased sophistication in leveraging cloud-based AI for malicious activities.
DOUBLECUP ClickFix Service Hides Malware in Browser Cache Images
The DOUBLECUP loader uses ClickFix attacks to embed malware within PNG images cached by browsers on Windows and macOS, complicating detection.
Chinese-Speaking Hackers Target Central Asian Governments Using OctLurk, SilkLurk
A suspected Chinese-speaking threat actor has targeted Central Asian government organizations with OctLurk and SilkLurk malware since January 2025, impacting healthcare, research, and government sectors.
Midnight Blizzard's CaptiveCrunch targets travelers with malware and credential theft
The Russian threat group Midnight Blizzard's Storm-2945 sub-cluster has compromised hospitality sign-in portals worldwide since May 2026, delivering malware and stealing traveler credentials.
DPRK-Linked macOS Malvertising Uses Fake Updates to Steal Crypto
North Korean threat actors have launched a sophisticated macOS malvertising campaign using fake update prompts to deliver crypto-stealing malware as part of the ongoing Contagious Interview operation.
Nimbus Manticore Uses NightLedger Backdoor to Target Middle East, Africa, Asia
Iranian state-backed group Nimbus Manticore deploys NightLedger backdoor and custom WebSocket tunnelers in attacks across the Middle East, Africa, and South Asia, enhancing stealth and covert activity.
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
CERT-UA has identified a campaign where a fake Notepad++ plugin delivers MATCHBOIL.V2 malware, linked to the Russia-aligned UAC-0099 threat group targeting Windows systems.
FakeGit Campaign Uses 7,600 GitHub Repos to Spread SmartLoader Malware
Nearly 7,600 malicious GitHub repositories were discovered distributing the SmartLoader malware, leveraging cloned projects and fake profiles to deceive users.
North Korean Hackers Use Steganography in Fake Coding Tests to Deliver Malware
North Korean threat actors linked to the Contagious Interview campaign employ steganography within SVG flag images in fake coding challenges to deliver multi-stage OTTERCOOKIE-aligned malware.
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
Seven malicious npm packages in the Vite ecosystem use a four-tier blockchain-based command-and-control infrastructure to deploy RAT malware, expanding the ChainVeil supply chain threat.
New OkoBot framework deploys 20 payloads targeting crypto and data theft
The OkoBot malware framework deploys more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and sensitive data, posing a notable threat to individuals and enterprises.
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
Researchers revealed TuxBot v3 Evolution, an IoT botnet framework apparently developed with help from a large language model, highlighting emerging AI-assisted malware creation risks.
Hackers Backdoor Jscrambler npm Package with Infostealer Malware
A malicious version of the Jscrambler npm package containing infostealer malware was published and downloaded nearly 1,500 times, posing risks to developers and users of this client-side security tool.
Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK GitHub repository to publish a malicious npm package that steals cryptocurrency wallet private keys and seed phrases. This malware poses a direct threat to developers and users managing crypto assets.
Microsoft Uncovers GigaWiper Backdoor Combining Disk Wiping and Spyware
Microsoft has analyzed a new Windows backdoor called GigaWiper that merges three destructive tools: full disk wiping, Windows drive overwriting, and fake ransomware that scrambles files without saving keys. This modular malware gives operators multiple ways to disrupt or destroy infected machines.
New Ghost Phishing Wave Evades Traditional Email Security
A new EvilTokens campaign uses ghost phishing to bypass traditional email security by hiding malicious pages until decrypted inside a victim’s browser. This poses high risk to businesses using Microsoft 365 and handling sensitive data.
Fake IT Support Calls on Microsoft Teams Spread EtherRAT Malware
Threat actors are impersonating IT support via Microsoft Teams voice calls to trick employees into installing EtherRAT malware, compromising corporate networks. This tactic enables attackers to gain initial access and conduct further intrusion.