Tag: malware
-
Global Public-Private Action Disrupts Russia-Linked Sality Botnet
US, European Law Enforcement, Cyber Firms Target Two-Decade-Old P2P Malware Network. U.S. and European authorities, CrowdStrike and Shadowserver disrupted the Russia-linked Sality botnet by exploiting its trusted-peer protocol to isolate roughly 15,000 infected machines and sever a malware network that had operated since 2003. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/global-public-private-action-disrupts-russia-linked-sality-botnet-a-32732
-
Five Men Tried to Make Kansas ATMs Spit Out Cash
Five men pleaded guilty after targeting Kansas ATMs with jackpotting malware as the FBI warns of a nationwide rise in attacks and financial losses. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/news-kansas-atm-jackpotting-malware-guilty-pleas/
-
Russian national facing 20 years for malware campaign that infected 80,000 freelancers
Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court on Monday after being arrested in Cyprus in May 2025 and extradited to the U.S. last week. First seen on therecord.media Jump to article: therecord.media/russian-national-facing-20-years-malware-campaign
-
Fake Software Update Installs a Real Crypto Wallet Rigged So It Can Never Open
Security researchers at Huntress have discovered a malware campaign that tricks victims into installing a real, fully functional copy of Exodus, a popular cryptocurrency wallet application, only to disable it so it can never actually be opened, using it instead as cover for a hidden spying tool. The firm said it identified four separate organisations…
-
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers.”The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users,” Microsoft First seen on thehackernews.com Jump to article: thehackernews.com/2026/09/fake-software-installers-disable.html
-
Threat Gang ‘Springs’ Vishing Attacks on Microsoft Teams Users
The Spring Ring operation aims to compromise users of the collaboration suite to remotely access their sessions, spread malware, and even take over infrastructure. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/threat-gang-springs-vishing-attacks-microsoft-teams-users
-
Threat Intelligence: Definition, Benefits, and Use Cases
Security teams rarely struggle because they lack data. More often, the challenge is deciding which signals actually deserve attention. Modern security environments generate information about suspicious IP addresses, malicious domains, malware samples, phishing infrastructure, ransomware activity, attacker behavior, and thousands of other indicators. Without context, that volume can quickly become another source of noise. Threat…
-
Russian Man Extradited Over Malware Campaign Targeting Freelancers
Russian man extradited to US over malware campaign that targeted 80,000 freelance users First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russian-man-extradited-malware/
-
Russian Man Extradited Over Malware Campaign Targeting Freelancers
Russian man extradited to US over malware campaign that targeted 80,000 freelance users First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russian-man-extradited-malware/
-
Sality, one of the longest-running botnets, finally gets disrupted
U.S. and European authorities disrupted the long-running botnet Sality, turning the malware’s peer-to-peer architecture against itself to cut thousands of infected computers off from operators. First seen on therecord.media Jump to article: therecord.media/sality-botnet-cyber-doj
-
Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware
Mirage Kitten used fake LinkedIn coding tests to spread NodeRabbit and PollCat, even banning AI tools that could have spotted the malware. Iran-linked Mirage Kitten hackers just found a genuinely clever way to make their own malware harder to detect: telling job candidates not to use AI tools while reviewing the trojanized code they were…
-
Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands
The U.S. Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017.Searzhudin Tamirlanovich Aktulaev, 40, was arrested in Cyprus in May 2025, the U.S. Attorney’s…
-
US charges Russian for infecting 80,000 freelancers with malware
A California federal grand jury has indicted a Russian national for his role in a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-charges-russian-for-infecting-80-000-freelancers-with-malware/
-
Sality botnet infrastructure dismantled in joint global takedown
International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/
-
Authorities Turn Sality’s P2P Network Against Itself, Cutting Off New Malware Payloads
The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation.The effort was undertaken on August 31, 2026, by authorities from the U.S., Bulgaria, Hungary, and Romania, in collaboration with private industry partners CrowdStrike and the Shadowserver Foundation.…
-
Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems
Tags: cyber, government, healthcare, infrastructure, kaspersky, malware, microsoft, software, technology, windowsAn active malware campaign that abuses counterfeit download pages for trusted software brands including Microsoft Edge, Kaspersky and Razer to compromise Windows devices. Victims span healthcare, manufacturing, gaming, technology, logistics, government and education, highlighting the broad appeal of software-download lures. Microsoft has not attributed the activity to a nation-state actor, but the campaign’s infrastructure, payload…
-
Trojanized Exodus Wallet Installer Deploys RAT to Steal Browser Credentials and Cookies
A sophisticated malware campaign has abused a trojanized installer for the legitimate Exodus cryptocurrency wallet to deploy a modular remote access trojan (RAT) capable of stealing browser credentials, session cookies, and extension data. The campaign prioritizes long-term interactive access over direct cryptocurrency theft, combining hidden VNC, SOCKS proxying, file management and browser-data theft in an…
-
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
esearch by:hasherezade Key Points Introduction JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). Its campaign activity dates back to March 2024 [1]; Check Point Research has been tracking the malware since early…
-
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
esearch by:hasherezade Key Points Introduction JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). Its campaign activity dates back to March 2024 [1]; Check Point Research has been tracking the malware since early…
-
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
esearch by:hasherezade Key Points Introduction JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). Its campaign activity dates back to March 2024 [1]; Check Point Research has been tracking the malware since early…
-
Infostealer malware compromises Claude accounts, bypassing 2FA
First seen on scworld.com Jump to article: www.scworld.com/brief/infostealer-malware-compromises-claude-accounts-bypassing-2fa
-
RevStealer malware spread through fake Claude Opus 5 download
Tags: malwareFirst seen on scworld.com Jump to article: www.scworld.com/news/revstealer-malware-spread-through-fake-claude-opus-5-download
-
Anthropic: Attackers Using Infostealers to Hijack Claude Sessions
Anthropic is warning Claude users that attackers are using infostealer malware to compromise their login sessions and stealing usage to run their nefarious activities. It’s the latest demonstration of the shift by bad actors from credentials to session tokens and authentication cookies. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/anthropic-attackers-using-infostealers-to-hijack-claude-sessions/
-
Credential Security: What Endpoint Protection Really Means for Secrets
TL;DREndpoint protection means AV or EDR: The term “endpoint protection” almost always refers to antivirus or EDR. Antivirus started as signature-based malware detection; EDR added continuous behavioral monitoring and response. Both are designed to detect and stop malicious activity on… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/credential-security-what-endpoint-protection-really-means-for-secrets/
-
Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks
A coordinated voice-phishing (vishing) campaign, named Spring Ring, used fake IT support accounts on Microsoft Teams to trick employees into installing malware or granting … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/01/spring-ring-vishing-campaign-microsoft-teams/
-
EtherHiding Exposed: What Security Leaders Need to Know
EtherHiding Exposed: What Security Leaders Need to Know September 1, 2026 Jean-Pierre Mouton BLOG 5 min. TL;DR A malware campaign has compromised at least 31 organizations’ websites to deploy a persistent backdoor. It identifies its command and control (C2) infrastructure using… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/etherhiding-exposed-what-security-leaders-need-to-know/
-
Iranian cyber spies target aviation, fintech developers with new malware
In a report published Tuesday, Kaspersky said it first discovered NodeRabbit on a system in Afghanistan and later identified variants on systems in Egypt and Ethiopia. First seen on therecord.media Jump to article: therecord.media/iranian-cyber-spies-target-aviation-fintech-new-malware
-
Five Plead Guilty to Using ATM Jackpotting Malware in Cash Theft Scheme
Five Venezuelan nationals have pleaded guilty in a federal case involving attempts to deploy ATM jackpotting malware against cash machines in Kansas. This case highlights a growing cyber-physical threat targeting financial institutions across the United States. The case arose from an FBI investigation into an alleged scheme to force automated teller machines (ATMs) to dispense…
-
Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests
The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript.Russian cybersecurity company Kaspersky is tracking the First seen…
-
Fake Claude Opus 5 app delivers malware and wipes its own tracks
A malicious GitHub repository impersonating Anthropic and claiming to offer free access to “Claude Opus 5” is delivering RevStealer, Windows information-stealing malware that … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/01/revstealer-malware-claude-opus-5-github/