Tag: malware
-
Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel
The Chaos ransomware group uses new malware “msaRAT” that hijacks browsers. The malware doesn’t communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker’s IP from victims via WebRTC over TURN. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/
-
FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations
Researchers at Huntress have disclosed a malvertising campaign that abused a public artifact hosted on Anthropic’s own claude.ai domain to distribute the SectopRAT information-stealing Trojan, compromising at least 29 organisations in the space of two days. The campaign, which Huntress has named FakeAgent, ran between 21 and 22 July 2026. Victims searching for >>Claude Desktop…
-
New msaRAT malware uses Chrome, Edge browsers to route C2 traffic
The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/
-
New TrickBot Malware Variant Uses DNS Tunneling for CommandControl
A new TrickBot malware variant that significantly evolves its command-and-control (C2) communication by leveraging DNS tunneling, replacing the traditional HTTP-based mechanisms observed in earlier campaigns. The discovery highlights a continued shift among financially motivated threat actors toward stealthier communication channels designed to evade network detection and security controls. However, the newly analyzed samples demonstrate a…
-
Attackers Are Learning to Live Off the AI Toolchain
Sandworm_Mode is an early example of malware that exploits trusted AI tools and workflows to make malicious activity virtually indistinguishable from normal activity. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/attackers-live-off-ai-toolchain
-
Fake Bahrain Alert App Deploys Android Surveillance Malware
A malicious application delivers four-stage Android spyware via phony Google Play sites, exploiting civilian fear during Iranian missile strikes. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/fake-bahrain-alert-apps-android-surveillance-malware
-
Malware is targeting AI tools in software development environments
The worm blends in with thousands of other commands occurring daily in any given environment, yet its intent and origins remain unknown. First seen on cyberscoop.com Jump to article: cyberscoop.com/sandworm-mode-malware-ai-supply-chain-crowdstrike/
-
Why Modern SOCs Need Multi-Layered Detections
The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely.The CrowdStrike Global Threat Report estimates around 79% of attacks are malware-free, as threat actors rely on First seen on thehackernews.com…
-
Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
Cybersecurity researchers have discovered a NuGet typosquat that’s unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it’s designed to rig live game results on Digitain.The package, named “Newtonsoftt.Json.Net,” masquerades as the Newtonsoft.Json library and is a trojanized fork. Seven versions of the package have been published to the First seen on thehackernews.com…
-
Cyberangriffe auf Kanzleien – KI am Telefon, Malware im Anhang
First seen on security-insider.de Jump to article: www.security-insider.de/cyberangriffe-kanzleien-ki-anrufe-malware-a-58ac369bc714d172310afb86c9f43b15/
-
Neue Malware-Verschleierung erschwert Abwehr von Cyberangriffen
Sicherheitsforscher von Proofpoint haben einen neuen Verschleierungsdienst für Schadsoftware entdeckt, der bereits von verschiedenen Cyberkriminellen eingesetzt wird. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/malware-verschleierung-abwehr
-
HollowGraph malware uses Microsoft 365 calendar for command and control
First seen on scworld.com Jump to article: www.scworld.com/brief/hollowgraph-malware-uses-microsoft-365-calendar-for-command-and-control
-
New npm malware cluster targets Vite ecosystem
Tags: malwareFirst seen on scworld.com Jump to article: www.scworld.com/brief/new-npm-malware-cluster-targets-vite-ecosystem
-
Gefälschte KI-Tools machen ChatGPT, Claude und Gemini zu unfreiwilligen Helfern von Cyberkriminellen
Eine neue Angriffsmethode zeigt, dass künftig nicht mehr nur Menschen auf Phishing oder manipulierte Downloads hereinfallen sondern auch KI-Agenten. Sicherheitsforscher von Island haben eine groß angelegte Kampagne mit dem Namen <> aufgedeckt, bei der Angreifer tausende gefälschte GitHub-Repositories erstellen, um sowohl Entwickler als auch KI-Assistenten zur Installation von Malware zu verleiten. Die Forscher bezeichnen […]…
-
Cruciferra Crypter Evades Detection to Deliver Malware
Proofpoint found Cruciferra, a sophisticated crypter used to deliver malware through phishing campaigns. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cruciferra-crypter-evades-detection-to-deliver-malware/
-
Cruciferra Crypter Evades Detection to Deliver Malware
Proofpoint found Cruciferra, a sophisticated crypter used to deliver malware through phishing campaigns. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cruciferra-crypter-evades-detection-to-deliver-malware/
-
FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware
A large-scale operation dubbed ‘FakeGit’ is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fakegit-campaign-uses-7-600-github-repos-to-push-smartloader-malware/
-
A Sneaky Hacking Tool Targeting AI Infrastructure Is Lurking in Victims’ Blind Spots
A new type of malware can worm deep into AI coding systems to steal data and logins”, and can flip a “death switch” to destroy files and keep out real users. First seen on wired.com Jump to article: www.wired.com/story/a-sneaky-hacking-tool-targeting-ai-infrastructure-is-lurking-in-victims-blind-spots/
-
ClaudeFix-Malware: Cyberangriffe über Claude Shared Chats und ClickFix-Befehle
ClaudeFix-Malware: ClaudeFix missbraucht geteilte Claude-Chats, um Entwickler zur Installation des MacSync Stealers zu verleiten. Zscaler erklärt die Angriffsmethode. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/claudefix-malware-cyberangriffe-ueber-claude-shared-chats-und-clickfix-befehle/a45818/
-
Hackers Use Cruciferra Crypter to Disable EDR and Deploy XWorm, Remcos, and AsyncRAT
Hackers are abusing the Cruciferra crypter-as-a-service to systematically turn off endpoint detection and response (EDR) tools and stealthily deploy XWorm, Remcos, AsyncRAT, and other commodity malware in email-driven campaigns targeting multiple sectors worldwide. By combining BYOVD-based driver abuse, indirect syscalls and a polymorphic encryption engine with more than 90 mix-and-match crypto routines, Cruciferra has rapidly…
-
Hackers Exploit SonicWall SMA Zero-Days to Gain Root Access and Deploy ORANGETAIL Webshell
An ongoing exploitation of two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) devices. These vulnerabilities allowed a threat actor, identified as UTA0533, to gain root-level access, install persistent malware, and deploy the ORANGETAIL Java webshell on vulnerable VPN appliances. The affected SonicWall SMA models include the 1000 series, specifically models 6210, 7210, and 8200.…
-
AgentBaiting Uses Fake AI Skills and MCP Servers to Deliver SmartLoader and StealC Malware
AgentBaiting is the clearest sign yet that AI agents and their capability ecosystems have become a first”‘class malware delivery surface, with FakeGit’s 7,600″‘repo operation pushing SmartLoader and StealC directly into AI Skills and MCP workflows. By turning agent”‘readable READMEs, public AI registries, and GitHub trust signals into a weaponized “AI capability supply chain,” attackers now…
-
HOLLOWGRAPH Malware Turns Microsoft 365 Calendar Events Into Covert CommandControl Channels
HOLLOWGRAPH, a Windows malware implant that transforms Microsoft 365 calendar events into a covert command-and-control channel. This malware, which is highly likely linked to the Cavern modular backdoor framework, utilizes the Microsoft Graph API to retrieve tasks from operators and to exfiltrate stolen data via a compromised Microsoft 365 mailbox. This technique enables malicious communications…
-
Hackers Hide C2 Traffic Inside Telegram While Targeting Middle East Governments
Hackers are increasingly blending malicious traffic with legitimate services, and a newly uncovered campaign shows how far this tactic has evolved. The activity has been attributed to a threat actor with links to East Asia, with researchers uncovering a previously undocumented malware suite comprising TELESHIM, MIXEDKEY, and a final-stage implant dubbed BINDCLOAK. The campaign demonstrates…
-
Hackers Hide C2 Traffic Inside Telegram While Targeting Middle East Governments
Hackers are increasingly blending malicious traffic with legitimate services, and a newly uncovered campaign shows how far this tactic has evolved. The activity has been attributed to a threat actor with links to East Asia, with researchers uncovering a previously undocumented malware suite comprising TELESHIM, MIXEDKEY, and a final-stage implant dubbed BINDCLOAK. The campaign demonstrates…
-
SonicWall SMA1000 flaws exploited as zero-days to push custom malware
Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-sma1000-flaws-exploited-as-zero-days-to-push-custom-malware/
-
JadePuffer agentic attacks now target AI model data with ransomware
The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/jadepuffer-agentic-attacks-now-target-ai-model-data-with-ransomware/
-
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit.”FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP First…
-
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV.What makes it more…