Tag: malware
-
Hackers Use Fake GitHub Security Tools to Spread Malware, Infecting Over 2,000 Computers
Tags: access, backdoor, blockchain, computer, credentials, crypto, cyber, cybersecurity, github, hacker, malware, threat, toolThreat actors are distributing malware through GitHub repositories masquerading as security utilities, infecting more than 2,000 computers. According to Doctor Web’s November 5 investigation, the campaign targets cybersecurity professionals alongside blockchain gaming enthusiasts, weaponizing Visual Studio projects and Python and Go scripts to deploy remote access backdoors, cryptocurrency clippers, and credential stealers. The operation initially…
-
Hackers Use Fake Streaming Apps to Spread Mirax Android Malware and Steal Bank Accounts
Hackers are using streaming app lures to distribute Mirax. This Android banking trojan lets operators remotely control victims’ phones and initiate fraudulent transfers. Estimated losses reach millions of dollars, although confirmed cases capture only part of the campaign’s impact. The operation remained active when Group-IB published its November 5 investigation. Researchers linked the infections through…
-
ChatGPT Lockdown Mode Bypass Allowed Hackers to Steal Private Chats Without User Interaction
Research found a flaw that bypassed ChatGPT’s Lockdown Mode. It let attackers silently exfiltrate full chat histories, deliver malware, and phish credentials from inside a trusted interface. Researcher Alexey Bukhteyev published the findings on November 5, 2026. In the ChatGPT Classic desktop app, simply having a conversation triggered the leak. OpenAI built Lockdown Mode as…
-
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/
-
ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration
esearch by: Alexey Bukhteyev Key Takeaways Introduction Earlier this year, Check Point Research disclosed a security flaw in ChatGPT’s code-execution runtime that allowed sensitive conversation data to be silently exfiltrated to an attacker-controlled server through DNS tunneling, a hidden outbound channel that bypassed the runtime’s network isolation. A fix for this issue was promptly deployed.…
-
Fake ChatGPT and Claude Apps Use Signed Executables to Install Yoba Malware
Fake ChatGPT and Claude apps spread Yoba malware through GitHub, using signed executables to load a cryptominer on… First seen on hackread.com Jump to article: hackread.com/fake-chatgpt-claude-apps-software-yoba-malware/
-
Scammers capitalize on GTA 6 hype to push malware and crypto cons
Scammers are offering supposed leaked builds, early copies and phone versions of Grand Theft Auto VI (GTA 6) weeks before the game’s November 19 launch, Netcraft warned in a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/05/gta-6-scams-fake-leaks-early-access/
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies
Marsalek, a free malware-as-a-service (MaaS) platform that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. It was active from mid-December 2025 to late May 2026. Researchers counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs. Its dashboard let users build…
-
Hackers Spread Marsalek Infostealer Through Fake Game Downloads to Steal Browser Passwords and Cookies
Marsalek, a free malware-as-a-service (MaaS) platform that disguised infostealers as game cheats and utilities for Roblox, Fortnite, Counter-Strike 2, Minecraft, and Grim Dawn. It was active from mid-December 2025 to late May 2026. Researchers counted more than 1,560 registered accounts, over 400 malicious files and more than 29 distribution URLs. Its dashboard let users build…
-
A banking malware sample led researchers to an Android bug that can loop-crash phones
Bitdefender Labs researchers built an Android app that contains no executable code and requests no permissions, and installing it leaves a Pixel 10 in a crash loop that can … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/05/ghostmap-android-bug-research/
-
Hackers Use ClickFix Tricks to Infect Macs With Phexia Malware That Hides Through Blockchain Infrastructure
Phexia, a modular macOS backdoor and infostealer sold to multiple threat actors. Operators deliver it through ClickFix lures. Since May 2026, newer builds have taken their command-and-control (C2) address from a Polygon smart contract, a technique known as EtherHiding. Victims reach fake verification pages through typosquatted domains and shopping listings. The page copies a command…
-
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
Tags: apple, authentication, cisa, cve, cybersecurity, exploit, flaw, hacker, infrastructure, kev, malware, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with First seen on thehackernews.com…
-
Fake GTA VI Download Sites Push Malware Ahead of Launch
Fake GTA VI download sites lure gamers with leaked builds, malware, crypto payment demands and mobile versions ahead… First seen on hackread.com Jump to article: hackread.com/fake-gta-vi-download-sites-malware-launch/
-
NIKKE PC game launcher hacked to spread remote access, data-stealing malware
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game’s PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nikke-pc-game-launcher-hacked-to-spread-remote-access-data-stealing-malware/
-
China-Aligned Group Abuses Sogou Input Method to Deliver Malware
SlippyNunchucks used DNS hijacking to turn Sogou brand promotions into a malware channel First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/slippynunchucks-sogou-dns-hijacking/
-
The Sandbox Fights Back: Joe Security Launches Adaptive Detonation
Reinach, Switzerland, November 4th, 2026, CyberNewswire AI agents help Joe Sandbox uncover malicious behavior concealed by evasion techniques and unmet execution conditions. Joe Security’s Adaptive Detonation brings active intervention to malware analysis, helping security teams investigate threats that may conceal their behavior during an initial sandbox run. Adaptive Detonation uses AI agents to examine execution…
-
Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
Tags: apt, control, cve, cyber, cyberespionage, defense, exploit, group, intelligence, law, malware, russia, threat, ukraine, vulnerabilityA targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against Ukrainian organizations. Active since at least February 2025, the group prioritizes law enforcement, justice institutions, frontline local administrations, and defense organizations, using compact malware designed for rapid intelligence collection rather than prolonged remote control The findings, detailed…
-
Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
Tags: apt, control, cve, cyber, cyberespionage, defense, exploit, group, intelligence, law, malware, russia, threat, ukraine, vulnerabilityA targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against Ukrainian organizations. Active since at least February 2025, the group prioritizes law enforcement, justice institutions, frontline local administrations, and defense organizations, using compact malware designed for rapid intelligence collection rather than prolonged remote control The findings, detailed…
-
Hackers Abuse LuaJIT and Windows Process Injection to Hide XLoader Credential-Stealing Malware
A new XLoader infection chain. It hides the credential stealer inside an embedded LuaJIT interpreter. It moves it into another Windows process through shared-section injection. The campaign uses business-themed email lures. It also delivered Agent Tesla, Remcos and XWorm . The chain starts with order and payment emails. One Greek-language message has a subject starting…
-
Malware bereits ab Werk: 1,3 Mio. TV-Boxen weltweit Teil eines kriminellen Botnets
X.CPE-Botnet zerschlagen: 1,3 Millionen TV-Boxen waren ab Werk mit Malware infiziert. Der Takedown könnte 10 Millionen weitere Geräte schützen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/malware-bereits-ab-werk-13-mio-tv-boxen-weltweit-teil-eines-kriminellen-botnets/a46998/
-
What AI-generated malware looks like under the microscope
In this Help Net Security interview, Lindsay Kaye, VP of Threat Intelligence at HUMAN Security, talks about what AI-generated malware looks like on the bench. She points to … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/04/lindsay-kaye-human-security-ai-generated-malware/
-
Hackers Disguise Malware as Popular Games and Software to Hijack Windows PCs
An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers. Rather than delivering one payload, the operation distributes multiple software “offers” during a single installation session, converting victims’ bandwidth and computing resources into revenue streams. Microsoft’s November 3 investigation identified three confirmed branches: WorldProxyPool proxyware, CharityEngine…
-
Hackers Disguise Malware as Popular Games and Software to Hijack Windows PCs
An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers. Rather than delivering one payload, the operation distributes multiple software “offers” during a single installation session, converting victims’ bandwidth and computing resources into revenue streams. Microsoft’s November 3 investigation identified three confirmed branches: WorldProxyPool proxyware, CharityEngine…
-
Hackers Disguise Malware as Popular Games and Software to Hijack Windows PCs
An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers. Rather than delivering one payload, the operation distributes multiple software “offers” during a single installation session, converting victims’ bandwidth and computing resources into revenue streams. Microsoft’s November 3 investigation identified three confirmed branches: WorldProxyPool proxyware, CharityEngine…
-
Hackers Disguise Malware as Popular Games and Software to Hijack Windows PCs
An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers. Rather than delivering one payload, the operation distributes multiple software “offers” during a single installation session, converting victims’ bandwidth and computing resources into revenue streams. Microsoft’s November 3 investigation identified three confirmed branches: WorldProxyPool proxyware, CharityEngine…
-
Hackers Disguise Malware as Popular Games and Software to Hijack Windows PCs
An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers. Rather than delivering one payload, the operation distributes multiple software “offers” during a single installation session, converting victims’ bandwidth and computing resources into revenue streams. Microsoft’s November 3 investigation identified three confirmed branches: WorldProxyPool proxyware, CharityEngine…
-
Hackers Disguise Malware as Popular Games and Software to Hijack Windows PCs
An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers. Rather than delivering one payload, the operation distributes multiple software “offers” during a single installation session, converting victims’ bandwidth and computing resources into revenue streams. Microsoft’s November 3 investigation identified three confirmed branches: WorldProxyPool proxyware, CharityEngine…