Tag: malware
-
CloudZ Malware Abuses Phone Link to Steal SMS OTPs
Cisco Talos uncovers CloudZ RAT and Pheno plugin abusing Microsoft Phone Link to intercept SMS OTPs First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cloudz-rat-pheno-phone-link-otp/
-
Warum starke Passwörter nicht vor KI-Gefahren schützen
Angesichts der wachsenden KI-Bedrohungslage verkommt die Message nach starken Passwörtern mit 16 Zeichen und Symbolen am World-Password-Day zur Farce. Ein 16-stelliges Passwort ist nutzlos, wenn eine Infostealer-Malware es direkt aus dem Browser-Cache extrahiert oder ein Mitarbeiter es in einen unkontrollierten KI-Chatbot eingibt. Die Cyberbedrohungslandschaft hat sich rasch zu einer industrialisierten ‘Cybercrime-as-a-Service”-Wirtschaft (CaaS) entwickelt, die von…
-
Salat Malware Abuses QUIC and WebSockets for Stealthy C2 Control
A powerful new Windows malware family dubbed Salat Stealer, a Go-based Remote Access Trojan (RAT) that blends classic infostealing with a stealthy QUIC/WebSocket command-and-control (C2) channel and resilient blockchain-backed infrastructure. Written in Go, it supports remote shell access, desktop and webcam streaming, keylogging, clipboard theft, browser and crypto”‘wallet data theft, and SOCKS5-based pivoting, giving operators interactive…
-
New malware turns Linux systems into P2P attack networks
Persistence through rootkits and PAM backdoors: The researchers also wrote of QLNX’s use of rootkits and Linux Pluggable Authentication Modules (PAM) to establish long term persistence. According to Trend Micro, the malware leverages rootkit functionality to conceal malicious activity, processes, and components from administrative tools and security monitoring systems.The malware was also observed tampering with…
-
Daemon Tools: Offizielle Downloads enthalten seit Wochen Malware
Seit Anfang April wird über die offizielle Webseite des Entwicklers von Daemon Tools Malware verbreitet. Auch in Deutschland gibt es Infektionen. First seen on golem.de Jump to article: www.golem.de/news/daemon-tools-offizielle-downloads-enthalten-seit-wochen-malware-2605-208362.html
-
Malicious OpenClaw Skill Targets Agentic AI Workflows to Deploy RATs and Stealers
OpenClaw’s agent “skill” ecosystem to deliver both Remcos RAT and a cross”‘platform stealer called GhostLoader by hiding malware inside a deceptive DeepSeek integration called “DeepSeek”‘Claw.” The campaign shows how agentic AI workflows with high local privileges can be quietly hijacked through manipulated installation instructions rather than classic exploit chains. OpenClaw, formerly known as Clawdbot and…
-
Offizielle Daemon Tools-Downloads werden zur Malware-Falle
Ein aktueller Supply-Chain-Angriff auf Daemon Tools sorgt für weltweite Sicherheitsrisiken. Über die offizielle Downloadquelle wurde eine manipulierte Installationsdatei verbreitet, die neben der legitimen Software auch Schadcode enthält. Betroffen sind Nutzer in mehr als 100 Ländern, darunter auch Deutschland. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/daemon-tools-malware
-
North Korean hackers targeted ethnic Koreans in China with Android ‘BirdCall’ malware
Researchers at cybersecurity firm ESET attributed the campaign to APT37 and said the hackers used a backdoor attached to a suite of card games from a company called Sqgame. First seen on therecord.media Jump to article: therecord.media/north-korean-hackers-target-ethnic-koreans-in-china
-
New stealthy Quasar Linux malware targets software developers
A previously undocumented Linux implant named Quasar Linux (QLNX) is targeting developers’ systems with a mix of rootkit, backdoor, and credential-stealing capabilities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-stealthy-quasar-linux-malware-targets-software-developers/
-
Windows 11 zeigt vermehrt Malware-Warnungen: Was hinter der Cerdigent-Meldung steckt
First seen on t3n.de Jump to article: t3n.de/news/windows-11-malware-warnung-cerdigent-1740888/
-
DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware
A newly identified supply chain attack targeting DAEMON Tools software has compromised its installers to serve a malicious payload, according to findings from Kaspersky.”These installers are distributed from the legitimate website of DAEMON Tools and are signed with digital certificates belonging to DAEMON Tools developers,” Kaspersky researchers Igor Kuznetsov, Georgy Kucherin, Leonid First seen on…
-
China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions
A sophisticated China-nexus advanced persistent threat (APT) group has been attributed to attacks targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025.The activity is being tracked by Cisco Talos under the moniker UAT-8302, with post-exploitation involving the deployment of custom-made malware families that have been…
-
Hackers Abuse DAEMON Tools Distribution Channel to Deliver Malicious Payloads
A sophisticated supply-chain attack has compromised the official distribution channel for DAEMON Tools, delivering multi-stage malware to users worldwide. Since April 8, 2026, threat actors have distributed trojanized installers signed with legitimate digital certificates to conduct highly targeted cyberespionage operations. Attackers successfully breached the development pipeline of AVB Disc Soft, the creators of the widely…
-
Stealthy malware abuses Microsoft Phone Link to siphon SMS OTPs from enterprise PCs
Multi-stage infection chain: The intrusion begins with an unknown initial access vector, followed by the execution of a malicious file disguised as a ScreenConnect update, Talos said.The initial payload is a Rust-compiled loader using filenames such as “systemupdates.exe,” which drops a .NET loader disguised as a text file in a system directory, the post said.Persistence…
-
FEMITBOT Network Abuses Telegram Mini Apps for Crypto Scams and Android Malware
A massive fraud network called FEMITBOT uses Telegram Mini Apps and fake brand names like Apple, Disney, and… First seen on hackread.com Jump to article: hackread.com/femitbot-telegram-mini-apps-crypto-scam-android-malware/
-
Warum unser Passwort von gestern heute ein Problem ist
Die meisten Nutzer verschwenden erst dann einen Gedanken an ihre Passwörter, wenn eine der lästigen Aufforderungen zur Änderung aufploppt. Doch Passwort-Pflege ist weit mehr als eine ungeliebte Pflicht zum Welt-Passwort-Tag ist ein radikales Umdenken fällig. Ob durch gezieltes Phishing, Angriffe auf zentrale Verzeichnisse oder lautlose Infostealer-Malware: Cyberkriminelle haben es auf unsere Zugangsdaten abgesehen. Das […]…
-
CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs
A new version of the CloudZ remote access tool (RAT) is deploying a previously unseen malicious plugin called Pheno that hijacks the Microsoft Phone Link connection to steal sensitive codes from mobile devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/
-
ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows
The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCallto likely target ethnic Koreans residing in China.While prior versions of the backdoor have primarily targeted Windows users only, the supply chain attack is assessed to have…
-
UAT-8302 and its box full of malware
Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-8302/
-
UAT-8302 and its box full of malware
Cisco Talos is disclosing UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group targeting government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-8302/
-
ScarCruft hackers push BirdCall Android malware via game platform
The North Korean hacker group APT37 has been delivering an Android version of a backdoor called BirdCall in a supply-chain attack through a video game platform. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/scarcruft-hackers-push-birdcall-android-malware-via-game-platform/
-
New Attribution Framework Links APT Campaigns Across Key Layers
A new attribution framework is reshaping how cybersecurity analysts connect advanced persistent threat (APT) activity, moving beyond static group labels toward a dynamic, multi-layered model that reflects how modern adversaries actually operate. These profiles are built from observed tactics, techniques, procedures (TTPs), malware, and infrastructure. But this approach is increasingly strained. Threat actors evolve constantly…
-
Fake “Notepad++ for Mac” Site May Pose Malware Risk for Mac Users
A deceptive website is circulating online that claims to offer an official “Notepad++ for Mac” download, and it has already misled some users and even tech media outlets into believing that Notepad++ has finally launched a native macOS version. The site operates under the domain notepad-plus-plus-mac[.]org. It is branded to look like an official extension…
-
DigiCert Hacked in Screensaver-Based Attack to Fraudulently Obtain EV Code Signing Certificates
DigiCert, a major Certificate Authority, recently suffered a significant security breach where hackers used a malicious screensaver file to steal 60 Extended Validation (EV) Code Signing certificates. These highly trusted certificates were subsequently used to sign the >>Zhong Stealer<< malware, allowing the malicious files to bypass security warnings by appearing as legitimate software. The incident…
-
Microsoft Defender Bug Triggers False Malware Alerts for DigiCert Certificates
Microsoft fixed a Defender false positive that flagged legitimate DigiCert certificates as malware, disrupting Windows trust stores for some IT teams. The post Microsoft Defender Bug Triggers False Malware Alerts for DigiCert Certificates appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-defender-digicert-certificates-false-positive/
-
Telegram Mini Apps Abused for Crypto Scams and Android Malware Delivery
What happened CTM360 researchers have uncovered a large-scale fraud operation using Telegram’s Mini App feature to run cryptocurrency scams, impersonate major brands, and distribute Android malware. The platform behind the operation, dubbed FEMITBOT based on a string found in API responses, uses Telegram bots and embedded Mini Apps to create convincing app-like experiences within the…The…
-
Microsoft Defender Mistakenly Flags DigiCert Root Certificates as Malware
What happened A faulty Microsoft Defender antimalware signature update released around April 30, 2026, caused widespread false positive alerts by incorrectly flagging two legitimate DigiCert root certificates as high-severity malware. The detection, labeled Trojan:Win32/Cerdigent.A!dha, identified registry entries belonging to DigiCert Assured ID Root CA and DigiCert Trusted Root G4 as threats and automatically quarantined them…The…
-
Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia
The China-based cybercrime group known as Silver Fox has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor.The activity involved using phishing emails that mimic correspondence from the Income Tax Department of India in December 2025, followed by a similar campaign aimed at Russian entities.”Both waves…
-
DigiCert Root Certificates Incorrectly Detected as Malware by Microsoft Defender
On May 3, 2026, system administrators and everyday users worldwide experienced a sudden, massive spike in severe security alerts from Microsoft Defender. The native Windows security platform began aggressively flagging system files as >>Trojan:Win32/Cerdigent.A!dha.<< This unexpected detection caused widespread panic across IT departments, leading many professionals to believe a sophisticated threat actor had actively compromised…