Tag: malware
-
UAC-0099 Is Now Hiding Malware Inside a Fake Notepad++ Plugin to Target Ukrainian Organizations
UAC-0099 delivers malware via a fake Notepad++ plugin after phishing, using a loader that sabotages itself if run without the correct arguments to hinder analysis. CERT-UA published a new advisory attributing a phishing campaign to UAC-0099, a Russia-aligned threat actor active since at least mid-2022 and previously known for exploiting WinRAR vulnerabilities and using phishing…
-
SourTrade Browser-Assembled Malware Defeats Hash-Based Detection by Design
SourTrade turns the browser itself into a malware build system, deliberately sidestepping the industry’s reliance on hash-based file fingerprints and traditional network-centric detection. SourTrade has been active since late 2024, abusing programmatic ads to reach retail traders and crypto investors in 12 geographies across APAC, LATAM, Africa, and Western markets, including Japan, Thailand, South Korea,…
-
Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings.The malware families in question are: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and a modified web browser credential First seen…
-
Hotel Wi-Fi DNS Poisoning Attacks Hijack Microsoft 365 Accounts Without Phishing
Adversaries are silently hijacking Microsoft 365 accounts by compromising hotel and conference-center Wi-Fi gateways and poisoning DNS no phishing emails, malicious attachments, or endpoint malware required. ReliaQuest assesses that the tradecraft closely mirrors prior APT28-linked router campaigns, extending them into captive-portal infrastructure used by traveling corporate staff. Since at least June 2026, threat actors have…
-
Lampion Malware Targets Portuguese Users With Multistage Phishing and 750MB RAT Payload
A highly targeted Lampion malware campaign abusing localized phishing lures to compromise users in Portugal. The activity reflects a continued evolution of the Brazilian-origin banking trojan, first documented in 2019, which has consistently focused on Portuguese-speaking victims rather than domestic Brazilian targets. In the latest campaign, attackers leverage convincing financial-themed phishing emails masquerading as routine…
-
Hackers Weaponize Notepad++ Plugins to Silently Infect Windows Systems
CERT-UA has issued a warning regarding the UAC-0099 threat cluster, which has revised its malware delivery method by exploiting the legitimate Notepad++ application to load a malicious DLL disguised as a plugin. This campaign, observed since mid-summer 2026, introduces two newly identified tools, LUNCHPOKE and BURNYBEAR, along with an updated MATCHBOIL.V2 loader. This activity highlights…
-
New Dolphin X malware uses AI to rank high-value targets
A new Dolphin X remote access trojan claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims should be targeted first. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targets/
-
Breach Roundup: Zelle Must Face NY Lawsuit Over Fraud
Also, Spain Fines 23andMe Over 2023 Data Breach. This week: Zelle can’t transfer out of a New York state lawsuit alleging poor controls over rampant fraud, a hack wiped Romania’s land registry, Spain fined 23andMe, Australia’s Origin Energy data breach and pirate World Cup streaming sites seized. Malware found hiding in Microsoft 365 calendars. First…
-
Fake Claude app promoted by Bing ads pushes SectopRAT malware
A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/
-
Chaos ransomware deploys browser-based msaRAT to evade network detection
Cisco Talos uncovered msaRAT, a Chaos ransomware RAT that hides C2 traffic by routing it through Chrome or Edge using the Chrome DevTools Protocol. Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that routes its entire command-and-control channel through the victim’s own Chrome or Edge browser. The malware…
-
Hackers abuse Notepad++ plugins to stealthily install malware
Ukraine’s CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-abuse-notepad-plus-plus-plugins-to-stealthily-install-malware/
-
How attackers hosted a fake Claude download page on the claude.ai domain
A threat actor abused Anthropic’s Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed. Employees at at least 29 organizations … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/
-
New TriBack Loader Evades EDR Using Signed Binaries and Win32 Callback APIs
A new shellcode loader, dubbed “TriBack Loader,” to a China-nexus intrusion cluster tracked as JadeProx, with the malware explicitly engineered to evade modern EDR by abusing signed binaries and uncommon Win32 callback APIs. Across at least four observed variants, the loader underpins simultaneous espionage campaigns in South-East Asia and Latin America, including targeting of a…
-
Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel
The Chaos ransomware group uses new malware “msaRAT” that hijacks browsers. The malware doesn’t communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker’s IP from victims via WebRTC over TURN. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/
-
FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations
Researchers at Huntress have disclosed a malvertising campaign that abused a public artifact hosted on Anthropic’s own claude.ai domain to distribute the SectopRAT information-stealing Trojan, compromising at least 29 organisations in the space of two days. The campaign, which Huntress has named FakeAgent, ran between 21 and 22 July 2026. Victims searching for >>Claude Desktop…
-
New msaRAT malware uses Chrome, Edge browsers to route C2 traffic
The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/
-
New TrickBot Malware Variant Uses DNS Tunneling for CommandControl
A new TrickBot malware variant that significantly evolves its command-and-control (C2) communication by leveraging DNS tunneling, replacing the traditional HTTP-based mechanisms observed in earlier campaigns. The discovery highlights a continued shift among financially motivated threat actors toward stealthier communication channels designed to evade network detection and security controls. However, the newly analyzed samples demonstrate a…
-
Attackers Are Learning to Live Off the AI Toolchain
Sandworm_Mode is an early example of malware that exploits trusted AI tools and workflows to make malicious activity virtually indistinguishable from normal activity. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/attackers-live-off-ai-toolchain
-
Fake Bahrain Alert App Deploys Android Surveillance Malware
A malicious application delivers four-stage Android spyware via phony Google Play sites, exploiting civilian fear during Iranian missile strikes. First seen on darkreading.com Jump to article: www.darkreading.com/mobile-security/fake-bahrain-alert-apps-android-surveillance-malware
-
Malware is targeting AI tools in software development environments
The worm blends in with thousands of other commands occurring daily in any given environment, yet its intent and origins remain unknown. First seen on cyberscoop.com Jump to article: cyberscoop.com/sandworm-mode-malware-ai-supply-chain-crowdstrike/
-
Why Modern SOCs Need Multi-Layered Detections
The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely.The CrowdStrike Global Threat Report estimates around 79% of attacks are malware-free, as threat actors rely on First seen on thehackernews.com…
-
Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library
Cybersecurity researchers have discovered a NuGet typosquat that’s unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it’s designed to rig live game results on Digitain.The package, named “Newtonsoftt.Json.Net,” masquerades as the Newtonsoft.Json library and is a trojanized fork. Seven versions of the package have been published to the First seen on thehackernews.com…
-
Cyberangriffe auf Kanzleien – KI am Telefon, Malware im Anhang
First seen on security-insider.de Jump to article: www.security-insider.de/cyberangriffe-kanzleien-ki-anrufe-malware-a-58ac369bc714d172310afb86c9f43b15/
-
Neue Malware-Verschleierung erschwert Abwehr von Cyberangriffen
Sicherheitsforscher von Proofpoint haben einen neuen Verschleierungsdienst für Schadsoftware entdeckt, der bereits von verschiedenen Cyberkriminellen eingesetzt wird. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/malware-verschleierung-abwehr
-
New npm malware cluster targets Vite ecosystem
Tags: malwareFirst seen on scworld.com Jump to article: www.scworld.com/brief/new-npm-malware-cluster-targets-vite-ecosystem
-
HollowGraph malware uses Microsoft 365 calendar for command and control
First seen on scworld.com Jump to article: www.scworld.com/brief/hollowgraph-malware-uses-microsoft-365-calendar-for-command-and-control
-
Gefälschte KI-Tools machen ChatGPT, Claude und Gemini zu unfreiwilligen Helfern von Cyberkriminellen
Eine neue Angriffsmethode zeigt, dass künftig nicht mehr nur Menschen auf Phishing oder manipulierte Downloads hereinfallen sondern auch KI-Agenten. Sicherheitsforscher von Island haben eine groß angelegte Kampagne mit dem Namen <> aufgedeckt, bei der Angreifer tausende gefälschte GitHub-Repositories erstellen, um sowohl Entwickler als auch KI-Assistenten zur Installation von Malware zu verleiten. Die Forscher bezeichnen […]…
-
Cruciferra Crypter Evades Detection to Deliver Malware
Proofpoint found Cruciferra, a sophisticated crypter used to deliver malware through phishing campaigns. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cruciferra-crypter-evades-detection-to-deliver-malware/
-
Cruciferra Crypter Evades Detection to Deliver Malware
Proofpoint found Cruciferra, a sophisticated crypter used to deliver malware through phishing campaigns. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cruciferra-crypter-evades-detection-to-deliver-malware/
-
FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware
A large-scale operation dubbed ‘FakeGit’ is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fakegit-campaign-uses-7-600-github-repos-to-push-smartloader-malware/