Tag: infection
-
Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign
Bitter used three infection chains against South and Southeast Asian targets, one with no malware executable First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/paprat-bitter-cyberespionage/
-
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
Cybersecurity researchers have disclosed details of what has been described as a “highly sophisticated infection chain” targeting government organizations in Asia.The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed First seen on…
-
Apple notifications alert victims in 99 countries about mercenary spyware infections
The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. First seen on cyberscoop.com Jump to article: cyberscoop.com/apple-spyware-notifications-pall-mall-process/
-
Hackers Turn Compromised Websites Into Fake Cloudflare Verification Traps for Windows and Mac Users
Attackers are using compromised websites to present fake Cloudflare verification pages that steer Windows and macOS users toward executing malicious commands. The findings establish a delivery attempt, not a confirmed infection or identified malware family. The activity exploits the familiarity of browser security checks. Instead of completing a legitimate verification, visitors receive instructions intended to…
-
Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections
More than 400 incidents in which attackers abused Microsoft Teams external chats to impersonate IT support, obtain remote access, and deliver malware. Researchers identified recurring tenant names, deceptive display names, remote administration tools, and payload infrastructure across incidents. Teams federation, enabled by default, allows communication between organizations when both tenants permit external access. Attackers exploit…
-
Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs
Malware campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate Windows applications to conceal infections targeting users in Brazil and Portugal. The investigation covers Overlord RAT, Lampion, and an unidentified payload delivered through a malicious newdev.dll. Rather than exploiting Windows Error Reporting itself, attackers impersonated its components and naming conventions, disguising malicious executables and scheduled…
-
North Korean Hackers Use Post-Quantum Encryption to Conceal Malware in New Cyberespionage Campaign
Tags: communications, cryptography, cyber, cyberespionage, encryption, finance, group, hacker, infection, korea, lazarus, malicious, malware, north-korea, phishing, software, spear-phishingNorth Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware communications and payloads behind a multi-stage infection chain. Dubbed Operation FlashHole, the campaign combined spear-phishing, malicious websites, abuse of financial security software and modular malware that largely operated in memory. The campaign followed Operation SyncHole, a Lazarus operation…
-
NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections
Citizen Lab confirmed Pegasus on a Serbian rector’s iPhone 6 days before elections, raising the known civil society spyware target count to 16. The Citizen Lab published a research note confirming that the iPhone of Vladan Äokić, Rector of the University of Belgrade, was infected with NSO Group’s Pegasus spyware sometime in 2026. The infection…
-
Pegasus Spyware Infection Confirmed on Serbian University Rector’s iPhone Days Before Election
The iPhone of Vladan Äokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026, the Citizen Lab said on October 19.The finding came six days before Serbia’s October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Äokić…
-
Rust-Based CikaBika Bot Turns Discord into a Command Center
CikaBika Bot uses fake documents to infect Windows systems, then abuses Discord and Ngrok to execute commands, spy on victims, and steal files. Darktrace researchers have documented a new campaign distributing a remote access trojan called CikaBika Bot, written in Rust and controlled entirely through Discord. The infection chain starts with a disk image that…
-
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday.The hidden attack code ran the moment an ad loaded on the screen, and in some…
-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives First seen…
-
UAT-6275 Hackers Use WinRAR Exploit and GitHub PowerShell to Target CIS Governments
An espionage campaign targeting government organizations across the Commonwealth of Independent States (CIS), with additional interest in water, environmental, and energy sectors. The investigation found four infection chains active from June 2025 through 2026. The attackers used macro-enabled Word documents, PS2EXE-built executables, malicious shortcuts that launched GitHub-hosted PowerShell, and a crafted WinRAR archive that exploited…
-
Nippon Columbia Malware Infection Puts 8.72 Million Daiichikosho Customer Records at Risk
Japanese karaoke operator Daiichi Kosho has issued a warning about a malware infection at its outsourcing partner, Nippon Columbia Group (NCG), that may have exposed about 8.72 million personal records. This potential data exposure includes both customer and employee information, not just customer records. As of now, neither data theft nor misuse has been confirmed,…
-
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/
-
MacSync’s New Infection Chain Shows How Mac Malware Is Becoming More Sophisticated
A newly observed MacSync campaign shows a marked evolution in macOS-focused crimeware, replacing relatively simple AppleScript-driven delivery with layered binary loaders, encrypted modules, cloud-hosted staging, and a persistent backdoor. Kaspersky first identified the new infection chain in the wild in September 2026, describing it as a significant upgrade for the malware family formerly marketed as…
-
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files. The infection was detected after repeated security alerts indicated suspicious PowerShell activity. The initial execution command launched PowerShell…
-
MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2
A newly identified Windows malware framework dubbed MovieReaper is being distributed through pirated movie torrents after threat actors compromised a public torrent-file repository used by multiple tracker sites. The campaign combines a multi-stage infection chain, anti-analysis techniques, UAC bypass, file-management capabilities, and Solana blockchain-based command-and-control (C2) discovery to make disruption more difficult. Kaspersky researchers identified…
-
AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process
A five-stage AsyncRAT campaign that chains a socially engineered batch file, hidden PowerShell execution, AutoIt abuse and process injection to conceal a .NET remote-access trojan inside Microsoft’s legitimate charmap.exe process. The infection begins with a lure named “Right-click to open Invoice Details.bat”, which relies on user interaction to trigger execution. While the precise delivery method…
-
Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files
Mantax OTAX is aggressive Android malware family combines ransomware, spyware, credential theft, and remote device-control features in a single infection chain. Linked to Indonesian threat actors, the campaign targets users through sideloaded APKs and turns compromised devices into tools for surveillance, financial fraud and real-time extortion. Unlike conventional Android ransomware that focuses primarily on locking…
-
SloppyRAT: A New Tool For Ransomware Attacks
IntroductionIn June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain. The malware supports a variety of features including… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/sloppyrat-a-new-tool-for-ransomware-attacks/
-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/clearfake-webdav-infection-chain/
-
Pegasus and NoviSpy Used Against Serbian Protesters
Serbian activists were targeted with zero-click Pegasus and NoviSpy spyware, exposing a major surveillance campaign ahead of elections. A member of Serbia’s student protest movement had their iPhone infected with NSO Group’s Pegasus spyware without ever clicking a link or opening a file. The Citizen Lab confirmed the infection in collaboration with the SHARE Foundation,…
-
Pegasus, NoviSpy variant spyware found on devices of Serbian activists
It’s the first Pegasus infection of 2026 that Citizen Lab is forensically confirming, and the SHARE Foundation said it’s the biggest wave of spyware surveillance in Serbia yet. First seen on cyberscoop.com Jump to article: cyberscoop.com/pegasus-novispy-variant-spyware-found-on-devices-of-serbian-activists/
-
Fake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and Sessions
Threat actors are exploiting demand for generative AI tools to distribute RevStealer, a Windows-focused information stealer hidden inside a trojanized Electron application that impersonates a free desktop version of Anthropic’s Claude Opus 5. Instead a stealthy credential theft tool engineered to evade sandboxes, endpoint monitoring, and post-infection investigation. The primary lure, branded “Claude Opus 5…
-
Infostealer Infection Exposes Blind Eagle-Linked Operator’s Malware Production Pipeline
A compromised attacker-side workstation has given researchers an unusual view into the operational ecosystem behind a suspected Blind Eagle malware campaign, exposing RAT builders, phishing templates, bulk-mail tooling, crypter activity and infrastructure tracking records. Rather than directly exposing a modified executable, the account hosted a legitimate AutoIt interpreter alongside separately retrievable malicious script logic an…
-
First Android Malware Targeting Car Head Units Uses Firmware Updates to Build Proxy Botnet
A multi-stage Android malware campaign that abuses the firmware-update mechanism of Android-based automotive head units to deploy ad-fraud tooling and enroll vehicles into a residential proxy botnet. The activity, discovered in June 2026, is the first documented malware infection chain purpose-built for automotive head units and has been attributed with high confidence to the MoYu…
-
Hackers Use Fake CAPTCHA to Deploy Malware That Shuts Down Endpoint Security
Threat actors are pairing fake CAPTCHA verification pages with a commercial malware loader capable of disabling endpoint defenses, creating a high-impact infection chain that begins with a victim manually executing a malicious PowerShell command. In late July 2026, multiple ClickFix campaigns generated through the ErrTraffic malware-as-a-service platform and used to deliver Cruciferra, a loader advertised…