Tag: backdoor
-
Hackers Use Fake GitHub Security Tools to Spread Malware, Infecting Over 2,000 Computers
Tags: access, backdoor, blockchain, computer, credentials, crypto, cyber, cybersecurity, github, hacker, malware, threat, toolThreat actors are distributing malware through GitHub repositories masquerading as security utilities, infecting more than 2,000 computers. According to Doctor Web’s November 5 investigation, the campaign targets cybersecurity professionals alongside blockchain gaming enthusiasts, weaponizing Visual Studio projects and Python and Go scripts to deploy remote access backdoors, cryptocurrency clippers, and credential stealers. The operation initially…
-
Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/
-
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin’s XLab said this week.The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root…
-
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/
-
Hackers Use ClickFix Tricks to Infect Macs With Phexia Malware That Hides Through Blockchain Infrastructure
Phexia, a modular macOS backdoor and infostealer sold to multiple threat actors. Operators deliver it through ClickFix lures. Since May 2026, newer builds have taken their command-and-control (C2) address from a Polygon smart contract, a technique known as EtherHiding. Victims reach fake verification pages through typosquatted domains and shopping listings. The page copies a command…
-
Google, Partners Disrupt 1.3 Million-Device-Strong XCPE Botnet
Google alleges that Android device manufacturer Videostrong ran the operation, which infected set-top boxes and IoT devices with a backdoor to create infrastructure for criminal activity. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/google-13-million-device-strong-xcpe-botnet
-
Google, Partners Disrupts 1.3 Million-Device-Strong XCPE Botnet
Google alleges that Android device manufacturer Videostrong ran the operation, which infected set-top boxes and IoT devices with a backdoor to create infrastructure for criminal activity. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/google-13-million-device-strong-xcpe-botnet
-
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).The campaign, observed starting July 1, 2026, is assessed to have targeted…
-
Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data/
-
cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers’ Linux servers.The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since…
-
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/
-
Cursor Distributed Claude Code Extensions With SSH Backdoor Code
Malicious Claude Code extensions targeted Windows and macOS developers through Cursor collecting device details and planting files for persistent remote access. First seen on hackread.com Jump to article: hackread.com/cursor-claude-code-extensions-ssh-backdoor-code/
-
Cursor Distributed Claude Code Extensions With SSH Backdoor Code
Malicious Claude Code extensions targeted Windows and macOS developers through Cursor collecting device details and planting files for persistent remote access. First seen on hackread.com Jump to article: hackread.com/cursor-claude-code-extensions-ssh-backdoor-code/
-
TV-Boxen und mehr: 1,3 Millionen Android-Geräte mit Backdoor verkauft
Ein chinesischer Hersteller hat TV-Boxen und andere Android-Geräte heimlich mit einer Backdoor ausgestattet und den Zugang an Kriminelle verkauft. First seen on golem.de Jump to article: www.golem.de/news/tv-boxen-und-mehr-1-3-millionen-android-geraete-mit-backdoor-verkauft-2611-214785.html
-
TV-Boxen und mehr: 1,3 Millionen Android-Geräte mit Backdoor verkauft
Ein chinesischer Hersteller hat TV-Boxen und andere Android-Geräte heimlich mit einer Backdoor ausgestattet und den Zugang an Kriminelle verkauft. First seen on golem.de Jump to article: www.golem.de/news/tv-boxen-und-mehr-1-3-millionen-android-geraete-mit-backdoor-verkauft-2611-214785.html
-
Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers
Google dismantled a 1.3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.3 million set-top boxes in a botnet. The result of the investigation into the malware operation is the striking part:…
-
TV-Boxen und mehr: 1,3 Millionen Android-Geräte mit Backdoor verkauft
Ein chinesischer Hersteller hat TV-Boxen und andere Android-Geräte heimlich mit einer Backdoor ausgestattet und den Zugang an Kriminelle verkauft. First seen on golem.de Jump to article: www.golem.de/news/tv-boxen-und-mehr-1-3-millionen-android-geraete-mit-backdoor-verkauft-2611-214785.html
-
Inside XCPE, the botnet that turned set-top boxes into proxy servers
Google dismantled a 1.3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.3 million set-top boxes in a botnet. The result of the investigation into the malware operation is the striking part:…
-
DarkBlinders APT Hackers Target Israel and Iraqi Kurdistan With StarkMeet Malware and GitHub-Based Backdoors
Tags: apt, backdoor, cloud, credentials, cyber, cyberespionage, github, government, hacker, iraq, malware, phishing, theftDarkBlinders has compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in Iraqi Kurdistan, combining credential phishing, a fake meeting application, and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026 and reported that it remained active at publication. Confirmed activity included credential theft and…
-
Google Dismantles XCPE Botnet That Infected 1.3 Million Android TV Devices With Preinstalled Malware
Google and industry partners have dismantled the XCPE botnet. This firmware-level backdoor enrolled more than 1.3 million Android set-top boxes. Google Threat Intelligence Group (GTIG) assesses with high confidence that Android OEM and ODM Videostrong Technology Co. built and operated the backdoor for profit. The Google Threat Intelligence report calls it intentional, not a rogue…
-
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code.”SIMATIC IoT2050 Advanced devices running First seen on…
-
Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access
A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google.Google says it is highly confident that device maker Videostrong intentionally put a backdoor in the boxes and sold access to criminals.They used the boxes for ad fraud and…
-
Google disrupts XCPE botnet, bans the company behind it
Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/02/xcpe-botnet-android-backdoor/
-
Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS
Malicious Claude Code extensions distributed through Cursor’s VS Code The Extension Marketplace tried to create persistent SSH backdoors on Windows and macOS developer systems. The affected packages were the Anthropic.claude-code versions 2.1.312 and 2.1.313, which were available on October 29, 2026, between approximately 2:27 a.m. and 1:35 p.m. Cursor stated that Anthropic did not develop…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 121
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps deepveindrilling.com: Magento CMS block loader hits 953 stores CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC…
-
Backdoor eingebaut: Offizielle Claude-Code-Erweiterung für Cursor kompromittiert
Angreifer haben Schadcode in die offizielle Cursor-Erweiterung von Claude Code eingeschleust. Tausende Entwicklersysteme sind betroffen. First seen on golem.de Jump to article: www.golem.de/news/claude-code-millionenfach-installierte-vs-code-erweiterung-kompromittiert-2610-214680.html
-
Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction
Russia-aligned threat actors are exploiting a flaw in MDaemon mail server software to run code on the server. Victims don’t have to open or click anything. ESET’s APT Activity Report for Q2Q3 2026 describes an active campaign in Ukraine. ESET could not attribute it to a known Russia-aligned group. Mdaemon mail server flaw According to…
-
Malicious Claude Code extension on Cursor planted SSH backdoors
A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
-
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Cybersecurity researchers have disclosed that a trojanized version of Anthropic’s official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.The malicious update, version 2.1.313, was distributed under the extension’s legitimate publisher identity, prompting Cursor to temporarily shut First seen on thehackernews.com…