Tag: malware
-
Hackers Disguise Malware as Popular Games and Software to Hijack Windows PCs
An evolving fake-download campaign that disguises trojanized installers as popular games, cracked software, and utilities to monetize Windows computers. Rather than delivering one payload, the operation distributes multiple software “offers” during a single installation session, converting victims’ bandwidth and computing resources into revenue streams. Microsoft’s November 3 investigation identified three confirmed branches: WorldProxyPool proxyware, CharityEngine…
-
Binance says fake job interview led to $6.3 billion crypto heist
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company’s wallet infrastructure and steal about $6.34 billion in digital assets. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/
-
Russia-linked cyber spies target Ukraine’s war crimes investigations, military aid routes
The hackers use relatively simple malware to steal sensitive documents, login credentials and other information from Ukrainian organizations, particularly those near the front line and the Russian border. First seen on therecord.media Jump to article: therecord.media/russia-linked-cyber-spies-target-ukraine-war-support
-
Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations.”Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector,” ESET researcher…
-
NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure
The UK’s cyber chief has warned that AI-powered malware is highly likely to feature in ransomware attacks targeting British critical infrastructure by 2028 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ncsc-ai-ransomware-threat-uk-cni/
-
Zscaler-ThreatLabz analysiert einen weltweiten KI-gestützten Cyberangriff
Im Oktober 2026 deckte Zscaler ThreatLabz eine umfangreiche KI-gestützte Cyberangriffskampagne auf. Die Malware-Akteure kombinierten dabei das KI-Penetrationstest-Framework <> mit maßgeschneiderten Automatisierungsskripten und verschiedenen KI-Codierungsassistenten, um Angriffe weltweit zu koordinieren. Die wichtigsten Erkenntnisse im Überblick: â— Globale Reichweite: Die Cyberangriffskampagne ging weit über die zunächst bekannt gewordenen Angriffe auf südkoreanische Finanzinstitute hinaus. Organisationen verschiedener Branchen sind…
-
Inside XCPE, the botnet that turned 1.3M set-top boxes into proxy servers
Google dismantled a 1.3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.3 million set-top boxes in a botnet. The result of the investigation into the malware operation is the striking part:…
-
Inside XCPE, the botnet that turned set-top boxes into proxy servers
Google dismantled a 1.3 million-device botnet allegedly built by Android TV box maker Videostrong to enable ad fraud and proxy abuse. Google and its partners dismantled a backdoor called XCPE that had enrolled more than 1.3 million set-top boxes in a botnet. The result of the investigation into the malware operation is the striking part:…
-
Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/
-
Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research published its findings on October 27, 2026, after about two months of tracking. The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading. The…
-
Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research published its findings on October 27, 2026, after about two months of tracking. The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading. The…
-
Hackers Exploit DLL Sideloading in Signed OpenAI and Anthropic Binaries to Deploy YobaLoader Malware
A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects. Check Point Research published its findings on October 27, 2026, after about two months of tracking. The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading. The…
-
DarkBlinders APT Hackers Target Israel and Iraqi Kurdistan With StarkMeet Malware and GitHub-Based Backdoors
Tags: apt, backdoor, cloud, credentials, cyber, cyberespionage, github, government, hacker, iraq, malware, phishing, theftDarkBlinders has compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in Iraqi Kurdistan, combining credential phishing, a fake meeting application, and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026 and reported that it remained active at publication. Confirmed activity included credential theft and…
-
Hackers Hide PapRAT Malware in Fake Diplomatic Invitations to Take Control of Windows Systems
A campaign by the BITTER threat group that delivers a custom remote access trojan (RAT) called PapRAT to South Asian organizations. FortiGuard attributes the activity to the group with high confidence, based on lure filenames, command-and-control (C2) patterns, file metadata, and malware analysis The campaign uses three chains. The first relies on a malicious LNK…
-
Google Dismantles XCPE Botnet That Infected 1.3 Million Android TV Devices With Preinstalled Malware
Google and industry partners have dismantled the XCPE botnet. This firmware-level backdoor enrolled more than 1.3 million Android set-top boxes. Google Threat Intelligence Group (GTIG) assesses with high confidence that Android OEM and ODM Videostrong Technology Co. built and operated the backdoor for profit. The Google Threat Intelligence report calls it intentional, not a rogue…
-
Chinese Firm Built a Botnet With PreInfected Android Devices
TV Boxes, Telehealth Devices and Digital Signage Sold With Unwanted Bonus. Google disrupted an Android botnet operated by Chinese manufacturer Videostrong, which preinstalled persistent XCPE malware in device firmware and sold criminal affiliates access to more than 1 million compromised devices for advertising fraud, residential proxy abuse and data theft worldwide. First seen on govinfosecurity.com…
-
Chinese Firm Built a Botnet With PreInfected Android Devices
TV Boxes, Telehealth Devices and Digital Signage Sold With Unwanted Bonus. Google disrupted an Android botnet operated by Chinese manufacturer Videostrong, which preinstalled persistent XCPE malware in device firmware and sold criminal affiliates access to more than 1 million compromised devices for advertising fraud, residential proxy abuse and data theft worldwide. First seen on govinfosecurity.com…
-
Chinese Firm Built a Botnet With PreInfected Android Devices
TV Boxes, Telehealth Devices and Digital Signage Sold With Unwanted Bonus. Google disrupted an Android botnet operated by Chinese manufacturer Videostrong, which preinstalled persistent XCPE malware in device firmware and sold criminal affiliates access to more than 1 million compromised devices for advertising fraud, residential proxy abuse and data theft worldwide. First seen on govinfosecurity.com…
-
Chinese Firm Built a Botnet With PreInfected Android Devices
TV Boxes, Telehealth Devices and Digital Signage Sold With Unwanted Bonus. Google disrupted an Android botnet operated by Chinese manufacturer Videostrong, which preinstalled persistent XCPE malware in device firmware and sold criminal affiliates access to more than 1 million compromised devices for advertising fraud, residential proxy abuse and data theft worldwide. First seen on govinfosecurity.com…
-
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/
-
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-disrupts-million-device-xcpe-android-malware-botnet-bans-tv-box-maker/
-
Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign
Bitter used three infection chains against South and Southeast Asian targets, one with no malware executable First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/paprat-bitter-cyberespionage/
-
KI-Flaggschiffe als Köder Malware ‘Yoba” tarnt sich als ChatGPT- und Claude-App
Die Sicherheitsforscher von Check Point Research (CPR), der Forschungsabteilung von Check Point Software Technologies. haben eine Malware-Kampagne aufgedeckt, die gezielt das Interesse an bekannten KI-Tools ausnutzt. Unter dem Namen ‘Yoba” verbreiten Cyberkriminelle Schadsoftware über gefälschte Github-Projekte, die vermeintliche Desktop-Anwendungen von ChatGPT und Claude bewerben. Um ihre Downloads glaubwürdig wirken zu lassen, missbrauchen sie legitime, digital…
-
KI-Flaggschiffe als Köder: Malware »Yoba« tarnt sich als ChatGPT- und Claude-App
Check Point Research hat eine Kampagne aufgedeckt, die über gefälschte GitHub-Projekte und legitim signierte Dateien von OpenAI und Anthropic Schadsoftware auf Windows-Rechner schleust. Die Projekte tauchten prominent in der Google-Suche auf. Die Sicherheitsforscher von Check Point Research (CPR), der Forschungsabteilung von Check Point® Software Technologies Ltd. , haben eine Malware-Kampagne aufgedeckt, die gezielt das Interesse an……
-
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim’s stolen data by their monetization value.Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;…
-
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data
A self-deleting Windows infostealer named VOLTA uses commercial AI models to turn stolen credentials, sessions, and cryptocurrency data into prioritized victim assessments. The malware, self-named “VOLTA-AUTODOXER,” combines extensive collection capabilities with automated identity enrichment. Its distinguishing feature is analytical outsourcing: after harvesting information, it asks a large language model to determine who the victim is,…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 121
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps deepveindrilling.com: Magento CMS block loader hits 953 stores CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC…
-
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
Cybersecurity researchers have disclosed details of what has been described as a “highly sophisticated infection chain” targeting government organizations in Asia.The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed First seen on…