Collecting Cyber-News from over 60 sources

Tag: malicious

Malicious npm packages target the n8n automation platform in a supply chain attack

Jan 12, 2026 2:02 PM

Tags: attack, automation, detection, infrastructure, malicious, monitoring, network, risk, service, supply-chain

Tips for reducing risks: Workflow automation platforms like n8n are widely adopted for their capability to let teams link disparate systems without hand-coding every integration. But the community node ecosystem depends on npm packages and, therefore, inherits associated risks.To mitigate exposure, Endor Labs researchers recommended measures such as preferring built-in integrations over community nodes, auditing…
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 79

Jan 11, 2026 1:02 PM

Tags: botnet, detection, international, malicious, malware, risk, worm

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion A Broken System Fueling Botnets Malicious NPM Packages Deliver NodeCordRAT Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil CNCERT: Risk Warning Regarding…
North Korealinked APT Kimsuky behind quishing attacks, FBI warns

Jan 10, 2026 6:02 PM

Tags: apt, attack, email, government, group, malicious, phishing, qr, spear-phishing

FBI warns that North Korealinked APT group Kimsuky is targeting governments, think tanks, and academic institutions with quishing attacks. North Korealinked APT group Kimsuky is targeting government agencies, academic institutions, and think tanks using spear-phishing emails that contain malicious QR codes (quishing), the FBI warns. >>As of 2025, Kimsuky actors have targeted think tanks, academic…
MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors

Jan 10, 2026 1:01 PM

Tags: finance, iran, malicious, middle-east, phishing, rat, rust, spear-phishing, threat

The Iranian threat actor known as MuddyWater has been attributed to a spear-phishing campaign targeting diplomatic, maritime, financial, and telecom entities in the Middle East with a Rust-based implant codenamed RustyWater.”The campaign uses icon spoofing and malicious Word documents to deliver Rust based implants capable of asynchronous C2, anti-analysis, registry persistence, and modular First seen…
Cybercriminals Exploit Maduro Arrest News to Spread Backdoor Malware

Jan 10, 2026 7:01 AM

Tags: attack, backdoor, cyber, cybercrime, email, exploit, malicious, malware, phishing, social-engineering, spear-phishing, threat

Cybercriminals are leveraging reports of Venezuelan President NicolÃ¡s Maduro’s arrest on January 3, 2025, to distribute backdoor malware through a sophisticated social engineering campaign. Security researchers at Darktrace have uncovered a malicious operation that exploits this high-profile geopolitical event to compromise unsuspecting victims. Attack Method The threat actors likely used spear-phishing emails containing a ZIP…
ZombieAgent ChatGPT attack shows persistent data leak risks of AI agents

Jan 10, 2026 1:01 AM

Tags: ai, attack, backdoor, chatgpt, cloud, data, email, injection, leak, LLM, malicious, microsoft, openai, risk, service, tool, vulnerability, worm

Worm-like propagation: The email attack even has worming capabilities, as the malicious prompts could instruct ChatGPT to scan the inbox, extract addresses from other email messages, exfiltrate those addresses to the attackers using the URL trick, and send similar poisoned messages to those addresses as well.If the victim is the employee of an organization that…
Radware Discloses ZombieAgent Technique to Compromise AI Agents

Jan 9, 2026 7:02 PM

Tags: ai, injection, malicious, vulnerability

Radware this week announced it has discovered a zero-click indirect prompt injection (IPI) vulnerability targeting the Deep Research agent developed by OpenAI. Dubbed ZombieAgent, Radware researchers have discovered that it is possible to implant malicious rules directly into the long-term memory or working notes of an AI agent. That technique enables a malicious actor to..…
Use of XMRig Cryptominer by Threat Actors Expanding: Expel

Jan 9, 2026 7:02 PM

Tags: corporate, cybersecurity, malicious, open-source, threat, tool

Security researchers last year wrote about a surge in the use by threat actors of the legitimate XMRig cryptominer, and cybersecurity firm Expel is now outlining the widening number of malicious ways they’re deploying the open-source tool against corporate IT operations. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/use-of-xmrig-cryptominer-by-threat-actors-expanding-expel/
xRAT Malware Targets Windows Users via Fake Adult Game

Jan 9, 2026 7:02 PM

Tags: cyber, intelligence, malicious, malware, service, threat, windows

AhnLab Security Intelligence Center (ASEC) has uncovered a dangerous distribution campaign targeting Windows users through Korean web hard services. Threat actors are leveraging xRAT (QuasarRAT) malware, disguising it as legitimate adult game content to deceive unsuspecting users into downloading and executing malicious files. Korean webhard services have become a prime vector for malware distribution, with…
PeekBoo! ðŸ«£ Emoji Smuggling and Modern LLMs FireTail Blog

Jan 9, 2026 3:01 PM

Tags: ai, computer, control, cybersecurity, data, exploit, injection, LLM, malicious, monitoring, risk, social-engineering, tactics, threat, tool, vulnerability

Jan 09, 2026 – Viktor Markopoulos – We often trust what we see. In cybersecurity, we are trained to look for suspicious links, strange file extensions, or garbled code. But what if the threat looked exactly like a smiling face sent by a colleague?Based on research by Paul Butler and building on FireTail’s previous disclosures…
PeekBoo! ðŸ«£ Emoji Smuggling and Modern LLMs FireTail Blog

Jan 9, 2026 3:01 PM

Tags: ai, computer, control, cybersecurity, data, exploit, injection, LLM, malicious, monitoring, risk, social-engineering, tactics, threat, tool, vulnerability

Jan 09, 2026 – Viktor Markopoulos – We often trust what we see. In cybersecurity, we are trained to look for suspicious links, strange file extensions, or garbled code. But what if the threat looked exactly like a smiling face sent by a colleague?Based on research by Paul Butler and building on FireTail’s previous disclosures…
Breach Roundup: Firewalls Headed for Obsolescence

Jan 9, 2026 1:01 PM

Tags: breach, browser, chrome, firewall, flaw, infrastructure, malicious, microsoft

Also, Sedgwick Confirms Breach, Romanian Power Firm Hit, D-Link Flaws Exploited. This week, Moody’s said firewalls will be obsolete, Romanian critical infrastructure hacked, Sedgwick breach and a D-Link DSL flaw. Finland seized the Fitburg. Microsoft said Direct Send not to blame for Exchange phishing. Malicious Chrome extensions, European hotels targeted and health breaches. First seen…
FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing

Jan 9, 2026 9:01 AM

Tags: advisory, government, hacker, malicious, north-korea, phishing, qr, spear-phishing, threat

The U.S. Federal Bureau of Investigation (FBI) on Thursday released an advisory warning of North Korean state-sponsored threat actors leveraging malicious QR codes in spear-phishing campaigns targeting entities in the country.”As of 2025, Kimsuky actors have targeted think tanks, academic institutions, and both U.S. and foreign government entities with embedded malicious Quick Response (QR) First…
Cisco identifies vulnerability in ISE network access control devices

Jan 9, 2026 5:01 AM

Tags: access, advisory, breach, cisco, control, credentials, cvss, data, exploit, firewall, google, identity, malicious, network, sans, theft, vulnerability

rotate ISE credentials for those with existing and approved access;ensure only those who need access have credentials;reduce the number of devices that can access the ISE server;patch as soon as it’s possible to take the server offline.In its notice to customers, Cisco says a vulnerability [CVE-2026-20029] in the licensing features of ISE and Cisco ISE…
135% Surge: Inside the Holiday Bot Attacks of December 2025

Jan 8, 2026 11:01 PM

Tags: ai, attack, malicious

DataDome detected a 135% surge in malicious bot attacks during December 2025. Discover how AI-powered bots targeted retailers and how we defended customers First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/135-surge-inside-the-holiday-bot-attacks-of-december-2025/
Why FIM Add-Ons Aren’t Integrity Monitoring ( Why EDR Still Isn’t Enough)

Jan 8, 2026 11:01 PM

Tags: edr, endpoint, malicious, monitoring

<div cla If you are running a strong EDR platform, you’re doing something right. EDR is essential. It’s great at detecting and responding to malicious activity: suspicious processes, behaviors, lateral movement, and indicators of compromise. But here’s the uncomfortable truth: EDR does not tell you, with certainty, whether your systems are still in a known and…
Breach Roundup: Firewalls Headed for Obsolesce

Jan 8, 2026 11:01 PM

Tags: breach, browser, chrome, firewall, flaw, infrastructure, malicious, microsoft

Also, Sedgwick Confirms Breach, Romanian Power Firm Hit, D-Link Flaws Exploited. This week, Moody’s said firewalls will be obsolete, Romanian critical infrastructure hacked, Sedgwick breach and a D-Link DSL flaw. Finland seized the Fitburg. Microsoft said Direct Send not to blame for Exchange phishing. Malicious Chrome extensions, European hotels targeted and health breaches. First seen…
Astaroth banking Trojan spreads in Brazil via WhatsApp worm

Jan 8, 2026 10:02 PM

Tags: banking, malicious, malware, worm

A WhatsApp worm spread the Astaroth banking trojan across Brazil by automatically sending malicious messages to victims’ contacts. Astaroth, a long-running Brazilian banking malware, has evolved in a new campaign dubbed Boto Cor-de-Rosa by abusing WhatsApp Web for propagation. The malware harvests the victim’s WhatsApp contact list and automatically sends malicious messages to each contact,…
The 2 faces of AI: How emerging models empower and endanger cybersecurity

Jan 8, 2026 8:02 PM

Tags: ai, api, attack, compliance, credentials, cyber, cybersecurity, data, deep-fake, defense, detection, endpoint, espionage, exploit, finance, flaw, framework, GDPR, google, governance, government, group, guide, hacker, HIPAA, incident response, injection, intelligence, LLM, malicious, malware, mandiant, microsoft, network, PCI, penetration-testing, privacy, risk, russia, scam, security-incident, service, social-engineering, strategy, tactics, threat, tool, vulnerability, zero-day

Self-modifying, evasive malware More recently, the researchers at Google Threat Intelligence Group (GTIG) identified a disturbing new trend: malware that uses LLMs during execution to dynamically alter its own behavior and evade detection. This is not pre-generated code, this is code that adapts mid-execution.In June 2025, GTIG identified an experimental malware called PROMPTFLUX, which connects…
The 2 faces of AI: How emerging models empower and endanger cybersecurity

Jan 8, 2026 8:02 PM

Tags: ai, api, attack, compliance, credentials, cyber, cybersecurity, data, deep-fake, defense, detection, endpoint, espionage, exploit, finance, flaw, framework, GDPR, google, governance, government, group, guide, hacker, HIPAA, incident response, injection, intelligence, LLM, malicious, malware, mandiant, microsoft, network, PCI, penetration-testing, privacy, risk, russia, scam, security-incident, service, social-engineering, strategy, tactics, threat, tool, vulnerability, zero-day

Self-modifying, evasive malware More recently, the researchers at Google Threat Intelligence Group (GTIG) identified a disturbing new trend: malware that uses LLMs during execution to dynamically alter its own behavior and evade detection. This is not pre-generated code, this is code that adapts mid-execution.In June 2025, GTIG identified an experimental malware called PROMPTFLUX, which connects…
How Attackers Hide Processes by Abusing Kernel Patch Protection

Jan 8, 2026 7:02 PM

Tags: api, cyber, data, malicious, microsoft, monitoring, tool, update, windows

Security researchers have identified a sophisticated technique that allows attackers to hide malicious processes from Windows Task Manager and system monitoring tools, even on systems with Microsoft’s most advanced kernel protections enabled. The bypass leverages legitimate Windows APIs to manipulate core data structures before integrity checks can detect tampering, circumventing both PatchGuard and Hypervisor-Protected Code…
WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging

Jan 8, 2026 7:02 PM

Tags: attack, banking, cybersecurity, malicious, malware, threat, windows, worm

Cybersecurity researchers have disclosed details of a new campaign that uses WhatsApp as a distribution vector for a Windows banking trojan called Astaroth in attacks targeting Brazil.The campaign has been codenamed Boto Cor-de-Rosa by Acronis Threat Research Unit.”The malware retrieves the victim’s WhatsApp contact list and automatically sends malicious messages to each contact to further…
Discord Controlled NodeCordRAT Steals Chrome Data via NPM Packages

Jan 8, 2026 6:03 PM

Tags: browser, chrome, data, malicious, virus

Zscaler ThreatLabz identifies three malicious NPM packages mimicking Bitcoin libraries. The NodeCordRAT virus uses Discord commands to exfiltrate MetaMask data and Chrome passwords. First seen on hackread.com Jump to article: hackread.com/discord-nodecordrat-steal-chrome-data-npm-packages/
Fake ChatGPT and DeepSeek Extensions Spied on Over 1 Million Chrome Users

Jan 8, 2026 4:01 PM

Tags: ai, browser, chatgpt, chrome, malicious, tool

Security researchers have identified two malicious Chrome extensions recording AI chats. Learn how to identify and remove these tools to protect your privacy. First seen on hackread.com Jump to article: hackread.com/fake-chatgpt-deepseek-extensions-spy-chrome-users/
Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages

Jan 8, 2026 1:01 PM

Tags: cybersecurity, malicious, malware

Cybersecurity researchers have discovered three malicious npm packages that are designed to deliver a previously undocumented malware called NodeCordRAT.The names of the packages, all of which were taken down as of November 2025, are listed below. They were uploaded by a user named “wenmoonx.”bitcoin-main-lib (2,300 Downloads)bitcoin-lib-js (193 Downloads)bip40 (970 Downloads)”The First seen on thehackernews.com Jump…
Three Malicious NPM Packages Target Developers’ Login Credentials

Jan 8, 2026 10:01 AM

Tags: access, attack, credentials, cyber, exploit, login, malicious

Security researchers at Zscaler ThreatLabz have uncovered three malicious npm packages designed to install a sophisticated remote access trojan (RAT) targeting JavaScript developers. The packages, named bitcoin-main-lib, bitcoin-lib-js, and bip40, collectively registered over 3,400 downloads before being removed from the npm registry in November 2025. The attack exploits developer trust in the legitimate BitcoinJS project…
Top cyber threats to your AI systems and infrastructure

Jan 8, 2026 9:01 AM

Tags: ai, api, attack, best-practice, business, chatgpt, ciso, cloud, cyber, cybersecurity, data, defense, detection, exploit, framework, governance, hacker, infrastructure, injection, intelligence, LLM, malicious, mitre, monitoring, open-source, RedTeam, risk, sans, service, skills, software, strategy, supply-chain, tactics, theft, threat, tool, training, unauthorized, usa, vulnerability

Data poisoning Data poisoning is a type of attack in which bad actorsmanipulate, tamper with, and pollute the data used to develop or train AI systems, including machine learning models. By corrupting the data or introducing faulty data, attackers can alter, bias, or otherwise render inaccurate a model’s performance.Imagine an attack that tells a model…
A Single Browser Flaw, Millions at Risk: What the Chrome WebView Vulnerability Teaches Us About Exposure Windows

Jan 8, 2026 5:01 AM

Tags: android, application-security, browser, chrome, cybersecurity, flaw, google, malicious, risk, update, vulnerability, windows

A recent security update reveals that Google patched a high-severity Chrome WebView vulnerability that could allow attackers to bypass application security restrictions and execute malicious content within Android and enterprise applications, according to Cybersecurity News. Because Chrome WebView is embedded inside countless applications, the flaw expanded risk far beyond traditional browser usage. Many organizations were…
Holes in Veeam Backup suite allow remote code execution, creation of malicious backup config files

Jan 8, 2026 5:01 AM

Tags: access, backup, credentials, cve, cvss, cybersecurity, data, exploit, jobs, malicious, monitoring, password, ransomware, remote-code-execution, risk, risk-management, sans, threat, update, veeam, vulnerability

CVE-2025-59470 (with a CVSS score of 9) allows a Backup or Tape Operator to perform remote code execution (RCE) as the Postgres user by sending a malicious interval or order parameter;CVE-2025-59469 (with a severity score of 7.2) allows a Backup or Tape Operator to write files as root;CVE-2025-55125 (with a severity score of 7.2) allows a Backup…
900,000 Users Hit as Malicious Chrome Extensions Steal ChatGPT, DeepSeek Chats

Jan 7, 2026 11:01 PM

Tags: ai, browser, chatgpt, chrome, data, data-breach, malicious

OX Security reveals how malicious Chrome extensions exposed AI chats from ChatGPT and DeepSeek, silently siphoning sensitive data from 900,000 users. The post 900,000 Users Hit as Malicious Chrome Extensions Steal ChatGPT, DeepSeek Chats appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-900k-users-chrome-extensions-steal-chatgpt-deepseek-chats/