Tag: malware
-
Wenn Gratis-Streams locken: Sportfans sind 2026 besonders gefährdet
Tags: malwareGroße Sportevents treiben die Nachfrage nach Gratis-Streams in die Höhe. Doch was nach einem einfachen Zugang klingt, entpuppt sich oft als Einfallstor für Malware, Tracking und Betrug. Sicherheitsexperten schlagen Alarm. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/gratis-streams-sportfans
-
Fake Claude site installs malware that gives attackers access to your computer
We found a convincing fake site that installs a trojanized Claude app while quietly deploying PlugX malware. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/fake-claude-site-installs-malware-that-gives-attackers-access-to-your-computer/
-
GraphAlgo Scam: Lazarus Hackers Register Real US LLCs to Spread Malware
ReversingLabs has discovered a fresh wave of the graphalgo campaign in which North Korean Lazarus hackers are using fake Florida LLCs, mimicking SWFT Blockchain, and using GitHub typo-squatting to target developers with malware. First seen on hackread.com Jump to article: hackread.com/graphalgo-scam-lazarus-hackers-us-llcs-malware/
-
CPUID hacked to deliver malware via CPU-Z, HWMonitor downloads
Hackers gained access to an API for the CPUID project and changed the download links on the official website to serve malicious executables for the popular CPU-Z and HWMonitor tools. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/supply-chain-attack-at-cpuid-pushes-malware-with-cpu-z-hwmonitor/
-
CPUID site hijacked to serve malware instead of HWMonitor downloads
Six-hour breach turned trusted links into a coin toss between legit tools and credential stealers First seen on theregister.com Jump to article: www.theregister.com/2026/04/10/cpuid_site_hijacked/
-
CPUID site hijacked to serve malware instead of HWMonitor downloads
Six-hour breach turned trusted links into a coin toss between legit tools and credential stealers First seen on theregister.com Jump to article: www.theregister.com/2026/04/10/cpuid_site_hijacked/
-
ClickFix campaign delivers Mac malware via fake Apple page
Security researchers at Jamf have uncovered a new ClickFix-style attack targeting Mac users via a fake Apple-themed webpage offering instructions on how to >>reclaim disk … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/10/clickfix-mac-malware-script-editor/
-
Supply chain attack at CPUID pushes malware with CPU-Z/HWMonitor
Hackers gained access to an API for the CPUID project and changed the download links on the official website to serve malicious executables for the popular CPU-Z and HWMonitor tools. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/supply-chain-attack-at-cpuid-pushes-malware-with-cpu-z-hwmonitor/
-
UAT-10362 linked to LucidRook attacks targeting Taiwan-based institutions
LucidRook is Lua malware used in phishing attacks on NGOs and universities in Taiwan, linked to UAT-10362, spread via password-protected emails. LucidRook is a new Lua-based malware used in targeted phishing attacks against NGOs and universities in Taiwan. Cisco Talos links it to a skilled group tracked as UAT-10362. In Oct 2025, attackers used password-protected…
-
CPU-Z und HWMonitor: Malware über offizielle CPUID-Website verbreitet
Tags: malwareWer kürzlich CPU-Z oder HWMonitor heruntergeladen hat, könnte sich eine Malware eingefangen haben. Auf der CPUID-Website wurden falsche Links eingeschleust. First seen on golem.de Jump to article: www.golem.de/news/cpu-z-und-hwmonitor-malware-ueber-offizielle-cpuid-website-verbreitet-2604-207426.html
-
Renovate Dependabot: The New Malware Delivery System
Recent supply chain attacks stayed live for hours. Automation tools silently merged their malware in minutes. Read how upgrade bots and AI agents became the insider threat. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/renovate-dependabot-the-new-malware-delivery-system/
-
To counter cookie theft, Chrome ships device-bound session credentials
Cookie theft follows a well-established pattern. Infostealer malware infiltrates a device, extracts authentication cookies, and exfiltrates them to an attacker-controlled … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/10/google-chrome-device-bound-session-credentials/
-
GitHub, GitLab Abused for Malware and Phishing Campaigns
Hackers are increasingly abusing trusted software development platforms GitHub and GitLab to host malware and credential phishing campaigns, making defensive detection significantly harder for enterprises. Because these Git-based platforms are deeply integrated into development and business workflows, organizations cannot simply block them at the network edge, giving threat actors a powerful, trusted delivery channel. GitHub…
-
MuddyWater Uses Russian MaaS in New ChainShell Attack
MuddyWater is now weaponizing a Russian malware-as-a-service (MaaS) platform to run a new operation dubbed “ChainShell”, blending Iranian state targeting with commercially developed cybercrime tooling. The assessment is based on a misconfigured command”‘and”‘control (C2) web server, 15 malware samples, and a previously undocumented JavaScript/Node.js payload named ChainShell. Investigators conclude that MuddyWater is running at least…
-
GlassWorm Trojan Hits VS Code, Cursor, Windsurf via OpenVSX Extension
A newly discovered supply chain attack is spreading the GlassWorm malware across multiple developer environments by abusing the OpenVSX extension marketplace. GlassWorm is not new. Researchers have tracked the campaign since March 2025, when attackers hid malicious payloads inside npm packages using invisible Unicode characters. Since then, the operation has expanded across GitHub repositories, npm…
-
DesckVB RAT Uses Fileless .NET Loader to Evade Detection
DesckVB RAT is emerging as a highly active and stealthy malware threat in 2026, leveraging layered obfuscation and fileless execution techniques to bypass traditional security defenses. The attack chain begins with a malicious JavaScript file that hides its true intent through complex encoding and code replication. This script copies its own logic into PowerShell and…
-
What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure
Tags: access, advisory, ai, attack, authentication, automation, backup, cctv, chatgpt, cisa, communications, compliance, control, credentials, crypto, cve, cyber, cybersecurity, data, data-breach, defense, detection, dns, email, exploit, finance, firewall, flaw, government, group, healthcare, infrastructure, intelligence, international, Internet, iot, iran, kev, leak, linux, malicious, malware, mitigation, mitre, monitoring, network, office, openai, password, radius, resilience, risk, router, service, siem, software, strategy, switch, technology, threat, tool, update, vpn, vulnerability, vulnerability-managementAn Iran-affiliated threat group has evolved from defacing water utility displays to deploying custom ICS malware and exploiting Rockwell Automation PLCs across multiple U.S. critical infrastructure sectors. Key takeaways: CyberAv3ngers is a state-directed threat group operating under Iran’s IRGC Cyber-Electronic Command. The U.S. Treasury sanctioned six named officials in February 2024 and the State Department…
-
Hackers have been exploiting an unpatched Adobe Reader vulnerability for months
Tags: access, adobe, attack, ciso, control, data, email, exploit, hacker, incident response, malicious, malware, monitoring, resilience, risk, sans, software, technology, threat, tool, update, vulnerabilityA high risk exploit: Kellman Meghu, chief technology officer at Canadian incident response firm DeepCove Security, called the exploit “a very high risk.”So far it looks as though this particular malware just exfiltrates data, he said. But it implies there is an ability or capability to turn it into a vehicle for remote code execution.…
-
New ‘LucidRook’ malware used in targeted attacks on NGOs, universities
A new Lua-based malware, called LucidRook, is being used in spear-phishing campaigns targeting non-governmental organizations and universities in Taiwan. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-lucidrook-malware-used-in-targeted-attacks-on-ngos-universities/
-
Google Chrome adds infostealer protection against session cookie theft
Google has rolled out Device Bound Session Credentials (DBSC) protection in Chrome 146 for Windows, designed to block info-stealing malware from harvesting session cookies. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/google-chrome-adds-infostealer-protection-against-session-cookie-theft/
-
Der Leak des Claude-Codes von Anthropic zieht Malware-Kampagnen nach sich
Ende März 2026 wurde der vollständige Quellcode von Claude, dem terminal-basierten KI-Programmier-Agenten von Anthropic, versehentlich der Öffentlichkeit preisgegeben. Ausgelöst durch einen einfachen, aber gravierenden Fehler bei der Software-Paketierung hat dieses Datenleck weitreichende Konsequenzen für die IT-Sicherheitslandschaft und die Software-Supply-Chain. Das Zscaler-ThreatLabz-Team hat die Auswirkungen des Vorfalls analysiert und warnt aktuell vor aktiven Bedrohungskampagnen. Hacker und…
-
UAT-10362 Targets Taiwanese NGOs with LucidRook Malware in Spear-Phishing Campaigns
A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations (NGOs) and suspected universities to deploy a new Lua-based malware called LucidRook.”LucidRook is a sophisticated stager that embeds a Lua interpreter and Rust-compiled libraries within a dynamic-link library (DLL) to download and First seen on thehackernews.com Jump to…
-
ClickFix, Malicious DMGs Push notnullOSX to macOS Users
Hackers are abusing ClickFix commands and booby-trapping DMG installers to deliver a new macOS stealer called notnullOSX, built to loot high-value crypto wallets from Mac users. The story starts with 0xFFF, a malware developer who abruptly quit a major Russian-speaking hacking forum in 2023 after claiming he was being investigated and accusing the forum of…
-
New macOS Malware notnullOSX Targets Crypto Wallets Over $10K
macOS Malware notnullOSX targets crypto wallets over $10K, using fake apps, Terminal tricks, and backdoors to steal funds and sensitive data. First seen on hackread.com Jump to article: hackread.com/macos-malware-notnullosx-crypto-wallets/
-
This fake Windows support website delivers password-stealing malware
A convincing Microsoft lookalike tricks users into downloading malware that steals passwords, payments, and account access. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/this-fake-windows-support-website-delivers-password-stealing-malware/
-
Fake Security Tool Spreads LucidRook in Taiwan Cyberattacks
Hackers are using fake security tools and cleverly crafted phishing emails to secretly deploy a new malware family, LucidRook, against organizations in Taiwan. The campaign, tracked as UAT-10362, focuses on Taiwanese NGOs and likely universities and shows a high level of planning, stealth, and technical sophistication. The operation relies on spear-phishing emails sent via what appears…
-
Internet-Exposed ICS Devices Raise Alarm for Critical Sectors
Exposed ICS devices and insecure protocols like Modbus increase risks to critical infrastructure, enabling disruption, data access, and potential sabotage. Malware targeting industrial control systems (ICS) poses a serious risk to critical infrastructure, with threats like Stuxnet, Industroyer, Triton, Havex, and BlackEnergy already demonstrating the ability to disrupt operations, cause outages, and even inflict physical…
-
RoningLoader Campaign Uses DLL Side-Loading, Code Injection to Slip Past Defenses
A sophisticated cyber-espionage group known as DragonBreath (APT-Q-27) has been linked to a new RoningLoader malware campaign that uses advanced evasion techniques such as DLL side-loading and code injection to bypass traditional security defenses. Active since at least 2022, DragonBreath has steadily evolved its capabilities. Earlier campaigns were documented by QianXin and Sophos, but recent…
-
Russia’s Forest Blizzard Nabs Rafts of Logins Via SOHO Routers
Heard of fileless malware? How about malwareless cyber espionage? Russia’s APT28 is spying on global organizations by modifying just one DNS setting in vulnerable routers. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/russia-forest-blizzard-logins-soho-routers
-
Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics
APT28 targets Ukraine and allies with PRISMEX malware, using stealthy techniques for espionage and command-and-control. Russia-linked group APT28 (aka UAC-0001, akaFancy Bear,Pawn Storm,Sofacy Group,Sednit,BlueDelta, andSTRONTIUM) is running a spear-phishing campaign against Ukraine and its allies, deploying a new malware suite called PRISMEX. Active since September 2025, the campaign uses advanced stealth techniques like steganography and…