Tag: malware
-
Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
Named “Volta-Autodoxer,” the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts. First seen on wired.com Jump to article: www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Malicious Claude Code extension on Cursor planted SSH backdoors
A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
-
Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files
Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it. NetamLoader malware Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load…
-
Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware
A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport. First seen on hackread.com Jump to article: hackread.com/fake-github-repo-ai-coding-agents-solanacry-malware/
-
Hackers target government Windows systems in Asia with new malware
The previously unknown malware, dubbed NetamLoader, uses legitimate Microsoft software components to execute malicious code, evade security tools and download additional programs onto infected computers. First seen on therecord.media Jump to article: therecord.media/hackers-target-government-windows-systems-asia-new-malware
-
New AI-Powered NIK C2 Malware Uses OpenAI API to Help Hackers Steal Data and Control Windows PCs
Cisco Talos has uncovered NIK C2, a Go-based, 64-bit Windows remote access tool that embeds a working OpenAI client. Operators can send prompts through an infected machine and read the model’s replies in their C2 panel. NIK C2 malware According to technical research published by Cisco Talos, the implant talks to its server over TLS-secured…
-
Hugging Face malware campaign returns to hijack GPUs for crypto mining
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/
-
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/
-
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/
-
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba.The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a…
-
Yoba malware hides in fake desktop versions of ChatGPT and Claude
Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/fake-chatgpt-claude-apps-github-yoba-malware-cryptominer/
-
NIK C2 Malware Can Use Victims’ OpenAI Keys for AI Queries
NIK C2 malware can fall back on victims’ OpenAI API keys to run AI queries First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/nik-c2-malware-victims-openai-keys/
-
Cisco Talos Uncovers KeyDrift Malware Targeting SD-WAN Controllers to Steal Network Encryption Keys
Tags: access, cisco, communications, control, cyber, defense, encryption, framework, malware, network, service, technology, threatUAT-11473, an advanced persistent threat actor deploying KeyDrift, a custom malware framework targeting Cisco Catalyst SD-WAN controllers. The framework embeds inside legitimate control-plane processes to maintain access, intercept decrypted communications, and extract sensitive network encryption material. Observed targets span space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence…
-
Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks
Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector. The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into…
-
A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards
Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands”, and trounce them at the tables. First seen on wired.com Jump to article: www.wired.com/story/a-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-cards/
-
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization’s SD-WAN network.The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco Talos said on October 28. Talos calls the attacks historical…
-
MR ROBOT Malware-as-a-Service Targets Indian Bank Customers
MR ROBOT Android malware rents banking trojans that steal one-time passwords and card data First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/
-
Hackers Turn Compromised Websites Into Fake Cloudflare Verification Traps for Windows and Mac Users
Attackers are using compromised websites to present fake Cloudflare verification pages that steer Windows and macOS users toward executing malicious commands. The findings establish a delivery attempt, not a confirmed infection or identified malware family. The activity exploits the familiarity of browser security checks. Instead of completing a legitimate verification, visitors receive instructions intended to…
-
CyberDakait Hackers Target Indian Banking Users, Compromise 17,960 Android Devices
CyberDakait, a financially motivated Android malware operation targeting Indian banking customers since July 2025. Researchers identified at least 17,960 compromised devices and 7,611,443 intercepted SMS messages, exposing a campaign that combines banking credential theft, remote device control, and cryptocurrency mining. Although their technical implementations differ, Group-IB clusters them together because of overlapping distribution methods, phishing…
-
Japan’s GMO Group Offers $1M Bounty for Hacker’s Identity
Extortion Group Holding to Ransom Data Stolen From Virtual Private Server Customers. Japan’s GMO Internet Group is offering a bounty of up to $1 million for information that helps unmask whoever hacked the company’s infrastructure, gaining access to over 25,000 virtual private servers and infecting customers’ home PCs with data-stealing malware when they remotely connected.…
-
GitHub’s npm package firewall can block brand-new versions before they install
GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/github-package-firewall-npm/
-
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android’s usual confirmation screens, and to update them in the background.To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores…
-
Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries
Attackers have used fake ChatGPT and Claude projects to distribute Yoba malware First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/attackers-hide-malware-behind/
-
Hackers Reuse XWorm Malware Loader Across Phishing Campaigns Targeting Colombia and the UK
A judicial-themed phishing campaign targeting Colombian organizations that delivers XWorm through obfuscated scripts, encrypted PowerShell, and a reusable .NET loader. The recovered loader is binary-identical to one documented in a September 10, 2026, UK-linked case, connecting otherwise differently packaged delivery chains. The overlap establishes loader reuse, not common attribution. Different payload hashes, execution targets, and…
-
Fake US Court Notices Target 100,000+ Businesses With LodaRAT
Fake US court notices target over 100,000 businesses, luring recipients to download LodaRAT malware that steals passwords, records… First seen on hackread.com Jump to article: hackread.com/fake-us-court-notices-target-businesses-lodarat/
-
Fake US Court Notices Target 100,000+ Businesses With LodaRAT
Fake US court notices target over 100,000 businesses, luring recipients to download LodaRAT malware that steals passwords, records… First seen on hackread.com Jump to article: hackread.com/fake-us-court-notices-target-businesses-lodarat/