Tag: malware
-
Malicious Hugging Face Repository Typosquats OpenAI
HiddenLayer reveals infostealer malware in a Hugging Face repository First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/malicious-hugging-face-repo/
-
Microsoft Warns: MistralAI PyPI Package Compromised with Malware
Mistral’s official Python client on PyPI has been pulled into the ongoing wave of AI supply”‘chain attacks, with Microsoft warning that version 2.4.6 of the mistralai package was backdoored to silently deploy a credential”‘stealing payload on Linux systems. The logic is designed to execute automatically whenever the package is imported, meaning developers simply using the library in…
-
Android banking Trojan TrickMo evolves using TON network for C2
ThreatFabric found a new TrickMo Android trojan focused on stealth and persistence, moving its command-and-control traffic to the TON network. Security researchers at ThreatFabric have recently identified a new version of TrickMo, a dangerous Android banking trojan that shows how malware operators are focusing less on flashy new features and more on improving stealth, flexibility,…
-
TrickMo Android Malware Targets Banking, Wallet, and Authenticator Apps
TrickMo, the Android banking malware, has resurfaced with a significantly redesigned architecture, targeting banking, fintech, wallet, and authenticator applications while introducing advanced stealth and network capabilities. Rather than introducing entirely new user-facing functionality, the latest TrickMo variant focuses on backend improvements. The malware retains its core device takeover (DTO) capabilities but enhances stealth, persistence, and…
-
OpenClaw Malware Targets Crypto Wallets and Bitwarden Credentials
OpenClaw users are being targeted in a fresh malware campaign that abuses a fake installer to steal credentials from popular crypto wallets and password managers, including MetaMask, Phantom, and Bitwarden. The archive contains a 130MB Rust executable padded with fake documentation to evade antivirus file-size scanning limits and many automated sandbox upload thresholds. The PE…
-
Offizielle Website gehackt: JDownloader-Installer mit Trojaner verseucht
Tags: malwareWer zuletzt einen JDownloader-Installer von der offiziellen Website des Projektes heruntergeladen hat, hat wahrscheinlich Malware auf seinem System. First seen on golem.de Jump to article: www.golem.de/news/offizielle-website-gehackt-jdownloader-installer-mit-trojaner-verseucht-2605-208514.html
-
Hackers Trick DigiCert Into Issuing Certificates Used to Sign Malware
DigiCert revokes 60 code signing certificates after hackers used a malicious support chat attachment to sign the Zhong Stealer malware. First seen on hackread.com Jump to article: hackread.com/hackers-digicert-issue-certificates-sign-malware/
-
Hackers Hijack JDownloader Site to Deliver Malware Through Installers
JDownloader confirms a security breach where hackers manipulated official download links to distribute malicious files between 6 and 7 May 2026. First seen on hackread.com Jump to article: hackread.com/hackers-hijack-jdownloader-site-malware-installers/
-
Official JDownloader site served malware to Windows and Linux users between May 6 and May 7
JDownloader website was hacked to distribute malicious Windows and Linux installers carrying a Python RAT between May 67, 2026. JDownloader official website was compromised in a supply chain attack that replaced legitimate Windows and Linux installers with malicious files between May 6 and May 7, 2026. JDownloader is a free, open-source download management application designed…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 96
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter CloudZ RAT potentially steals OTP messages using Pheno plugin Backdoored PyTorch Lightning package drops credential stealer A rigged game: ScarCruft compromises gaming platform in a supply-chain attack Muddying the Tracks: The State-Sponsored Shadow Behind…
-
TrickMo Android banker adopts TON blockchain for covert comms
A new variant of the TrickMo Android banking malware, delivered in campaigns targeting users across Europe, introduces new commands and uses The Open Network (TON) for stealthy command-and-control communications. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trickmo-android-banker-adopts-ton-blockchain-for-covert-comms/
-
Hackers abuse Google ads, Claude.ai chats to push Mac malware
Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for “Claude mac download” may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/
-
Fake Claude Campaign Uses PlugX-Style DLL Sideloading Chain
Hackers are abusing a fake Claude AI download site to deliver a PlugX”‘style DLL sideloading chain that ultimately deploys a new Windows backdoor dubbed “Beagle.” The campaign blends malvertising, a trojanized installer, and signed security software components to achieve stealthy persistence and remote control. Attackers registered claude-pro[.]com, a site that visually imitates Anthropic’s legitimate Claude…
-
Trending Hugging Face Repo With 200K Downloads Spreads Windows Malware
A malicious Hugging Face repository, Open-OSS/privacy-filter, that abused the platform’s trust and trending algorithm to deliver a sophisticated Rust-based infostealer to Windows users. The project briefly reached the #1 trending position with roughly 244,000 downloads and hundreds of likes before Hugging Face took it down, strongly suggesting the threat actor artificially boosted its popularity to…
-
PCPJack Worm Targets Docker, Kubernetes, Redis, and MongoDB Credentials
Tags: breach, cloud, container, credentials, cyber, data-breach, docker, extortion, framework, fraud, infrastructure, kubernetes, malware, spam, threat, wormA newly identified malware framework dubbed PCPJack is targeting exposed cloud and container infrastructure to steal credentials at scale while actively removing artifacts linked to the TeamPCP threat actor. Unlike typical cloud-focused campaigns, PCPJack skips cryptomining entirely and instead appears optimized for fraud, spam, extortion, and resale of stolen access. TeamPCP itself drew attention earlier in 2026…
-
NWHStealer Campaign Deploys Bun Loader, Anti-VM Evasion, and Encrypted C2
A new distribution method for the NWHStealer infostealer that leverages the Bun JavaScript runtime, marking a significant evolution in the malware’s delivery infrastructure. The threat actors behind this Rust-based stealer are exploiting Bun’s relative newness and high-performance capabilities to package malicious code into larger executables that evade traditional detection methods. Bun is a legitimate, fast…
-
Hackers Use Fake Claude AI Site to Infect Users With New Beagle Malware
Researchers have discovered a new malvertising campaign using a fake Claude AI website to plant a new, undocumented backdoor named Beagle on user devices. First seen on hackread.com Jump to article: hackread.com/hackers-fake-claude-ai-site-infect-beagle-malware/
-
New TCLBanker malware self-spreads over WhatsApp and Outlook
A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI installer for Logitech AI Prompt Builder to infect systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-tclbanker-malware-self-spreads-over-whatsapp-and-outlook/
-
After Replacing TeamPCP Malware, ‘PCPJack’ Steals Cloud Secrets
PCPJack makes innovative use of parquet files for stealthy, pre-validated target discovery as it canvasses multiple cloud environments. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/teampcp-malware-pcpjack-steals-cloud-secrets
-
New PCPJack worm steals credentials, cleans TeamPCP infections
A new malware framework called PCPJack is stealing credentials from exposed cloud infrastructure while actively removing TeamPCP’s access to the systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-pcpjack-worm-steals-credentials-cleans-teampcp-infections/
-
Microsoft-Edge speichert Passwörter im RAM als Klartext
Windows 10 und 11 nutzen eine Speicherisolation, damit Prozesse in voneinander getrennten virtuellen Adressräumen ausgeführt werden. Unter bestimmten Bedingungen kann jedoch ein gewöhnlicher Anwendungsprozess weiterhin auf den Speicher eines anderen Prozesses im Benutzermodus zugreifen. Das wirft die Befürchtung auf, dass Malware, die mit normalen Benutzerrechten ausgeführt wird, sensible Informationen wie Passwörter und Authentifizierungs-Tokens direkt aus…
-
Identitäten wie Perimeter behandeln
Der World-Password-Day ist nicht mehr nur ein Anstoß, sich stärkere Passwörter zu wählen, sondern ein Anlass, das Thema Identität neu zu überdenken. Cyberkriminelle müssen sich kaum noch reinhacken, sie stehlen die Zugangsdaten einfach über Phishing, Malware oder gehackte Datenbanken und loggen sich einfach ein. Wiederverwendete Passwörter ermöglichen es ihnen, sich über mehrere Dienste und Plattformen…
-
Fake Claude AI website delivers new ‘Beagle’ Windows malware
A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/
-
Fake Claude AI Installers Used to Spread Malware in New Cyber Scam
Hackers are abusing fake Claude AI installer pages promoted through Google Ads to trick users into running malware in a campaign. The operation combines highly realistic install guides with a stealthy, multi”‘stage infection chain that abuses trusted Windows components, fileless execution, and advanced evasion techniques to stay under the radar. Victims who click these ads…
-
PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux
Cybersecurity researchers have discovered three packages on the Python Package Index (PyPI) repository that are designed to stealthily deliver a previously unknown malware family called ZiChatBot on Windows and Linux systems.”While these wheel packages do implement the features described on their PyPI web pages, their true purpose is to covertly deliver malicious files,” Kaspersky First…
-
Entwickler bestätigt: Daemon Tools Lite mit Schadcode verseucht
Der Entwickler von Daemon Tools hat bestätigt, dass die Lite-Variante seiner Software zuletzt Malware enthielt. Eine neue Version korrigiert das. First seen on golem.de Jump to article: www.golem.de/news/entwickler-bestaetigt-daemon-tools-lite-mit-schadcode-verseucht-2605-208417.html
-
UAT-8302 Targets Government Agencies With Custom Malware and Open-Source Tools
A new China-linked hacking group, tracked as UAT-8302, that is using custom malware and open-source tools to spy on government organizations in South America and southeastern Europe. The campaign focuses on long-term access and data theft, combining advanced backdoors like NetDraft and CloudSorcerer with aggressive network reconnaissance and credential theft. Researchers assess with high confidence…
-
Mirai-Based xlabs_v1 Botnet Exploits ADB to Hijack IoT Devices for DDoS Attacks
Cybersecurity researchers have exposed a new Mirai-derived botnet that self-identifies as xlabs_v1 and targets internet-exposed devices running Android Debug Bridge (ADB) to enlist them in a network capable of carrying out distributed denial-of-service (DDoS) attacks.Hunt.io, which detailed the malware, said it made the discovery after identifying an exposed directory on a Netherlands-hosted First seen on…
-
DAEMON Tools devs confirm breach, release malware-free version
Disc Soft Limited, the maker of DAEMON Tools Lite, confirmed that the software had been trojanized in a supply chain attack and released a new, malware-free version. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/daemon-tools-devs-confirm-breach-release-malware-free-version/