Tag: malware
-
Threat Actors Test a Highly Obfuscated, Modified Variant of the Shai Hulud Malware
Security researchers have identified what appears to be the first instance of a newly modified Shai Hulud malware strain uploaded to the npm registry approximately 30 minutes ago, disguised within the package @vietmoney/react-big-calendar. The discovery suggests threat actors are testing updated payloads before launching widespread attacks, with significant code modifications indicating access to the original…
-
New GlassWorm malware wave targets Macs with trojanized crypto wallets
A fourth wave of the “GlassWorm” campaign is targeting macOS developers with malicious VSCode/OpenVSX extensions that deliver trojanized versions of crypto wallet applications. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-glassworm-malware-wave-targets-macs-with-trojanized-crypto-wallets/
-
React2Shell under attack: RondoDox Botnet spreads miners and malware
RondoDox botnet exploits the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js servers with malware and cryptominers. CloudSEK researchers warn that the RondoDox botnet is exploiting the critical React2Shell flaw (CVE-2025-55182) to drop malware and cryptominers on vulnerable Next.js servers. >>CloudSEK’s report details a persistent nine-month RondoDoX botnet campaign targeting IoT devices and web applications. Recently, the…
-
Breach Roundup: Clop Tied to Korean Air Vendor Breach
Also: China-Linked APT Hijack Updates, Condé Nast Data Leaked, La Poste Hit. This week, a Clop-linked vendor breach hit Korean Air, a China-linked APT hijacked software updates, a critical zero-day flaw remained unpatched, Condé Nast faced a data leak, La Poste was disrupted and Korean police extradited a malware operation suspect. First seen on govinfosecurity.com…
-
Malicious Jackson Lookalike Library Slips Into Maven Central
A malicious Jackson lookalike library was used to distribute Cobalt Strike malware through Maven Central. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/malicious-jackson-lookalike-library-slips-into-maven-central/
-
GlassWorm Malware Turns VS Code Extensions into an Attack Vector Against macOS
GlassWorm has returned with a dangerous new evolution. The notorious self-propagating malware, which first surfaced in October as an invisible Unicode-based threat in VS Code extensions, has completed a significant platform pivot to macOS with 50,000 downloads and a fully operational infrastructure. Security researchers have identified three malicious extensions on the Open VSX marketplace linked…
-
DarkSpectre Malware Campaign Hits Chrome, Edge, and Firefox Users
A sophisticated Chinese threat actor dubbed DarkSpectre has compromised 8.8 million users across Chrome, Edge, and Firefox through three distinct malware campaigns that have operated undetected for over seven years, researchers revealed today. The operation represents one of the most extensive and professionally organized browser extension threats ever documented, combining long-term infrastructure investment with nation-state-level…
-
RondoDox botnet exploits React2Shell flaw to breach Next.js servers
The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js servers with malware and cryptominers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/rondodox-botnet-exploits-react2shell-flaw-to-breach-nextjs-servers/
-
Cybersecurity Predictions 2026: An AI Arms Race and Malware Autonomy
The year ahead will see an intensified AI-driven cybersecurity arms race, with attackers leveraging autonomous malware and advanced AI technologies to outpace defenders, while security teams adopt increasingly sophisticated AI tools to combat evolving threats amidst growing vendor consolidation and platformization in the industry. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/cybersecurity-predictions-2026-an-ai-arms-race-and-malware-autonomy
-
New AI-Enhanced Crypter Promoted as Capable of Evading Windows Defender
Cybersecurity researchers have spotted a new high-sophistication malware loader being advertised on dark web forums, marketed as a commercial solution for evading modern endpoint protection. The tool, dubbed InternalWhisper x ImpactSolutions, is being promoted by a threat actor known as >>ImpactSolutions.
-
EmEditor Website Breach Turns Trusted Installer Into Infostealer Malware
A supply chain attack on the EmEditor website delivered a trojanized installer that installed infostealer malware. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/emeditor-website-breach-turns-trusted-installer-into-infostealer-malware/
-
2 Cyber Pros Admit to Being BlackCat Ransomware Affiliates
Americans Extorted at Least 5 Firms, Earning $1 Million From a Medical Device Maker. Two American cybersecurity professionals who moonlighted as BlackCat ransomware gang affiliates pleaded guilty to using the crypto-locking malware to extort at least five victims in the United States, including a medical device maker that paid a cryptocurrency ransom worth over $1…
-
Hackers Promote “VOID” AV Killer Claiming Kernel-Level Defense Evasion
A threat actor operating under the handle Crypt4You has begun advertising a sophisticated new offensive tool on underground cybercrime forums, marketed as a >>kernel-level>crypters
-
ESET Flags Rising Threat of AI-Driven Malware and Ransomware
The cybersecurity landscape entered a critical new era in the second half of 2025 as AI-powered malware transitioned from theoretical threat to tangible reality, while the ransomware-as-a-service economy expanded at an unprecedented pace. According to ESET Research’s latest Threat Report, these twin forces are reshaping how organizations must approach cyber defense. ESET discovered PromptLock, the…
-
Hackers Impersonated Jackson JSON Library to Infiltrate Maven Central
Security researchers have uncovered a sophisticated multi-stage malware campaign targeting Maven Central, the primary repository for Java dependencies. The attack centered on a malicious package impersonating the legitimate Jackson JSON library marking the first significant detection of advanced malware in an ecosystem that has historically remained resilient against supply chain attacks. The malicious package, published…
-
Chinese Hackers Deploy Rootkit to Stealthily Mask ToneShell Malware
Tags: apt, backdoor, china, cyber, cyberespionage, government, group, hacker, malicious, malware, technology, toolA sophisticated cyberespionage campaign leveraging kernel-mode rootkit technology has been discovered targeting government organizations across Southeast and East Asia, with Myanmar and Thailand bearing the brunt of attacks. Security researchers identified a malicious driver delivering the ToneShell backdoor, a hallmark tool of the Chinese-nexus HoneyMyte APT group, also tracked as Mustang Panda or Bronze President.…
-
Top 5 real-world AI security threats revealed in 2025
Tags: access, ai, api, attack, breach, chatgpt, cloud, control, credentials, cybercrime, data, data-breach, defense, email, exploit, flaw, framework, github, gitlab, google, injection, least-privilege, LLM, malicious, malware, microsoft, nvidia, open-source, openai, rce, remote-code-execution, risk, service, software, supply-chain, theft, threat, tool, vulnerabilityA critical remote code execution (RCE) in open-source AI agent framework Langflow that was also exploited in the wildAn RCE flaw in OpenAI’s Codex CLIVulnerabilities in NVIDIA Triton Inference ServerRCE vulnerabilities in major AI inference server frameworks, including those from Meta, Nvidia, Microsoft, and open-source projects such as vLLM and SGLangVulnerabilities in open-source compute framework…
-
Evasive Panda ändert das DNS, statt Updates lädt man Malware
Die Hacker-Gruppe Evasive Panda nutzte das Domain Name System, um unzählige Computer zu verseuchen. Das DNS ist elementar und keine Beilage. First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/cyberangriffe/evasive-panda-aendert-das-dns-statt-updates-laedt-man-malware-324673.html
-
Cybersicherheitstrends 2026: Welche Angriffe ohne Malware zunehmen
Da Malware-freie Angriffe mittlerweile den Großteil der kriminellen Aktivitäten ausmachen, steht außer Frage, dass die Trends in der gesamten Landschaft dazu geführt haben, dass sich diese Bedrohungen ausbreiten konnten. Für 2026 erwartet Zero Networks eine weitere Zunahme der Angriffe ohne Malware. Dazu gehören insbesondere: Maschinenidentitäten schaffen Sicherheitslücken Maschinenidentitäten wie Dienstkonten, die bekanntermaßen überprivilegiert und… First…
-
Cybersicherheitstrends 2026: Welche Angriffe ohne Malware zunehmen
Da Malware-freie Angriffe mittlerweile den Großteil der kriminellen Aktivitäten ausmachen, steht außer Frage, dass die Trends in der gesamten Landschaft dazu geführt haben, dass sich diese Bedrohungen ausbreiten konnten. Für 2026 erwartet Zero Networks eine weitere Zunahme der Angriffe ohne Malware. Dazu gehören insbesondere: Maschinenidentitäten schaffen Sicherheitslücken Maschinenidentitäten wie Dienstkonten, die bekanntermaßen überprivilegiert und… First…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 77
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan From Linear to Complex: An Upgrade in RansomHouse Encryption Prince of Persia: A Decade of Iranian Nation-State APT Campaign…
-
Zero Network erwartet weitere Zunahme von Angriffen ohne Malware
Da Malware-freie Angriffe mittlerweile den Großteil der kriminellen Aktivitäten ausmachen, steht außer Frage, dass die Trends in der gesamten Landschaft dazu geführt haben, dass sich diese Bedrohungen ausbreiten konnten. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/zero-network-erwartet-weitere-zunahme-von-angriffen-ohne-malware/a43265/
-
MAS: Malware durch Rechtschreibfehler bei Windows-Hack
Über die Microsoft Activation Scripts (MAS) lässt sich Windows ohne Lizenz aktivieren. Ein Tippfehler bei der Domain liefert allerdings Schadsoftware. First seen on golem.de Jump to article: www.golem.de/news/mas-malware-durch-rechtschreibfehler-bei-windows-hack-2512-203619.html
-
Best of 2025: New Akira Ransomware Decryptor Leans on Nvidia GPU Power
A software programmer developed a way to use brute force to break the encryption of the notorious Akira ransomware using GPU compute power and enabling some victims of the Linux-focused variant of the malware to regain their encrypted data without having to pay a ransom. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/new-akira-ransomware-decryptor-leans-on-nvidia-gpu-power-2/
-
Fake MAS Windows activation domain used to spread PowerShell malware
A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the ‘Cosmali Loader’. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-mas-windows-activation-domain-used-to-spread-powershell-malware/