Tag: malware
-
Wenn KI den Angriff erfindet Browser-native Ransomware
Keine App. Kein Exploit. Keine technischen Kenntnisse erforderlich schon ein einziger Klick zur Erteilung einer Browserberechtigung könnte Jahre an Handyfotos, Ausweisdaten und Wiederherstellungscodes gefährden. Die Sicherheitsforscher von Check Point Research haben ein von Deepseek generiertes Malware-Sample aufgedeckt. Dabei hat ein KI-Modell eigenständig ein theoretisches Browser-Risiko mit einer funktionierenden Ransomware-Technik verknüpft. Diese wird vollständig im […]…
-
RustDuck: The Botnet That’s Still Small but Engineering Like It Plans to Grow
RustDuck is a small, evolving DDoS botnet migrating to Rust. It uses advanced encryption, anti-analysis evasion, and exploits known IoT flaws. Since February 2026, researchers at QiAnXin’s XLab have been tracking a new malware family, called RustDuck, that hijacks routers, cameras, Android set-top boxes, and exposed servers, then uses them to flood targets with junk…
-
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
Tags: ai, attack, chatgpt, cybercrime, LLM, malicious, malware, programming, ransomware, software, toolesearch by:Alexey Bukhteyev Key Takeaways Introduction Over the past several years, large language models have reshaped software development, and malware development has followed the same path. Check Point Research has documented this trend from early experiments showing that AI systems could generate offensive components, to cases of cybercriminals using ChatGPT to create malicious tools, and…
-
Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware
Large language models keep inventing web addresses that do not exist. Attackers have started buying those made-up domains before anyone else can, then hosting phishing pages on them to catch traffic that AI tools point their way.Palo Alto Networks’ Unit 42 calls the trick phantom squatting, and its new research shows it is already happening…
-
Attackers Register AI-Hallucinated Domains to Deliver Phishing Kits and Malware
An emergent supply-chain attack vector they term >>phantom squatting,<< in which large language models (LLMs) routinely hallucinate plausible but nonexistent domains for legitimate brands and adversaries then preemptively register those domains to host phishing kits, malware, and other malicious infrastructure. By systematically probing two distinct LLM families across temperature settings, Unit 42 generated a 2.1…
-
Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery
ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office.New research shows the malicious commands behind its fake “prove you’re human” pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise. The same research also turned up a new…
-
Gamaredon group expands malware arsenal in ongoing Ukraine cyberattacks
First seen on scworld.com Jump to article: www.scworld.com/brief/gamaredon-group-expands-malware-arsenal-in-ongoing-ukraine-cyberattacks
-
Fake tax notices used to deliver remote access malware in India
First seen on scworld.com Jump to article: www.scworld.com/brief/fake-tax-notices-used-to-deliver-remote-access-malware-in-india
-
New SharkLoader malware campaign deploys Cobalt Strike Beacon
Tags: malwareFirst seen on scworld.com Jump to article: www.scworld.com/brief/new-sharkloader-malware-campaign-deploys-cobalt-strike-beacon
-
RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline.Researchers at QiAnXin’s XLab have tracked it since February 2026, and say the real story is not how big it is today, but…
-
Critical flaw in SimpleHelp exploited in attacks targeting sensitive credentials
Researchers found two previously undisclosed malware samples used to steal AI assistant tokens and other valuable secrets. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/critical-flaw-simplehelp-exploited-attacks-credentials/824105/
-
Hackers Use Fake FIFA World Cup 2026 T-Shirt Offers to Spread Voidrift Malware
A fake FIFA World Cup 2026 T-shirt giveaway scam is spreading Voidrift malware through personalized emails using company logos and trusted websites to bypass security filters. First seen on hackread.com Jump to article: hackread.com/hackers-fake-fifa-world-cup-2026-t-shirt-voidrift-malware/
-
Critical SimpleHelp Vulnerability Exploited For Malware Delivery
Attackers exploited a critical SimpleHelp RMM bug to deploy TaskWeaver and Djinn Stealer malware First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/simplehelp-rmm-vulnerability/
-
SimpleHelp Flaw Exploited to Deploy Malware Targeting Windows, macOS, and Linux
A SimpleHelp authentication flaw is being exploited to deploy Djinn Stealer, a cross-platform malware targeting cloud, developer, and AI credentials. The post SimpleHelp Flaw Exploited to Deploy Malware Targeting Windows, macOS, and Linux appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-simplehelp-flaw-djinn-stealer-developer-credentials/
-
DOJ Seizes 400 Illegal FIFA World Cup Streaming Domains
Officials from the US Department of Justice seized nearly 400 domains linked to illegal World Cup streams and warned viewers about the risks of malware, phishing, and data theft. The post DOJ Seizes 400 Illegal FIFA World Cup Streaming Domains appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-doj-illegal-world-cup-streaming-domains/
-
USB drives carrying China-linked malware infected Japanese military networks for nearly a year
Read more in my article on the Hot for Security blog. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/usb-drives-carrying-china-linked-malware-infected-japanese-military-networks-for-nearly-a-year
-
SystemBC Malware Turns Windows Machines Into SOCKS5 Proxies for Ransomware Attacks
SystemBC (also tracked as Coroxy) remains a versatile and persistent Windows malware family that operators routinely deploy to convert compromised hosts into SOCKS5 proxy gateways and to maintain remote access for follow-on operations. First observed as a payload in exploit kits around 20182019, SystemBC has evolved into a widely traded commodity tool used by multiple…
-
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer.The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated First seen on thehackernews.com Jump…
-
SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)
Attackers are exploiting CVE-2026-48558, a recently patched authentication bypass vulnerability in SimpleHelp RMM, to drop the novel Djinn Stealer malware on victim computers. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/
-
Hackers Leverage Blockchain to Hit Japan’s Hotels Through Booking.com Phishing
A wave of phishing emails sent to Booking.com partner accommodations in Japan in May led to blockchain-hosted malware First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hackers-blockchain-japan-hotels/
-
Mustang Panda Targets India’s Government and Energy Sectors With ZOHOMURK and MINIRECON
Two concurrent espionage campaigns by Mustang Panda targeting Indian government and energy-sector organisations, deploying a novel malware suite that includes SHARDLOADER, MINIRECON and ZOHOMURK. The intrusions, observed in June 2026, focused on hydropower entities and government offices engaged in MOUs with Taiwanese institutions, using geopolitically themed lures and weaponised archives that sideload malicious DLLs via…
-
Mistic Malware Blends Into Microsoft Endpoint Components Using Malicious EndpointDlp.dll
A newly identified Windows backdoor, dubbed Mistic, that has been observed in intrusions since April 2026 and appears designed for stealthy, long-term access. The malware uses DLL sideloading, in-memory execution, and self-deletion to blend into enterprise environments and minimize forensic traces. Mistic is introduced via a DLL sideloading chain that abuses a legitimate executable named…
-
North Korea-Linked macOS Malware Uses Prompt Injection to Evade AI Analysis
SentinelOne says macOS.Gaslight uses prompt injection to mislead AI-based malware analysis, steal data, and use Telegram for C2. The post North Korea-Linked macOS Malware Uses Prompt Injection to Evade AI Analysis appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-macos-gaslight-malware-ai-prompt-injection/
-
Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks
The China-aligned espionage group Mustang Panda is running two campaigns against the Indian government and hydropower targets, deploying new malware and turning a legitimate cloud service into its command channel.Acronis Threat Research Unit found active compromises inside Indian government networks, including machines used by senior administrative staff, and worked with First seen on thehackernews.com Jump…
-
âš¡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More
This week was a reminder that attackers do not always need big tricks. One small mistake, one old access path, one missed patch, and suddenly the door is open.The noise is not all noise, either. Forums are talking, researchers are finding easy cracks, and defenders have more cleanup waiting.Here’s the full Monday recap.âš¡ Threat of…
-
DOJ Seizes 400 Illegal FIFA World Cup Streaming Domains
The DOJ seized nearly 400 illegal World Cup streaming domains, warning that piracy sites also pose malware and phishing risks. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/doj-seizes-400-illegal-fifa-world-cup-streaming-domains/
-
Critical SimpleHelp flaw exploited to deploy new stealer malware
Hackers are exploiting a recently disclosed critical vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a previously undocumented cross-platform information stealer targeting Windows, macOS, and Linux. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-critical-simplehelp-flaw-deploy-new-djinn-infostealer-taskweaver-malware/
-
Gefälschtes Vertrauen wird zur neuen Währung der Cyberkriminalität
Die Kampagne rund um manipulierte Krypto-Tools macht deutlich, wie sehr sich Cyberangriffe inzwischen verändert haben. Malware muss sich heute nicht mehr nur verstecken, sie kann sich auch gezielt als vertrauenswürdiges Produkt inszenieren. In diesem Fall wurde eine gesamte Fake-Reputation-Ökonomie aufgebaut, um einen Crypto-Clipboard-Hijacker als beliebtes, geprüftes und sicheres Tool erscheinen zu lassen. Gefälschte Github-Sterne, künstlich…