Tag: malware
-
GhostPoster Malware Hit 50K Users via Firefox Extension Icons
The GhostPoster campaign hid malware inside Firefox extension icons, infecting tens of thousands of users through trusted add-ons. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/ghostposter-malware-hit-50k-users-via-firefox-extension-icons/
-
Critical React2Shell flaw exploited in ransomware attacks
A ransomware gang exploited the critical React2Shell vulnerability (CVE-2025-55182) to gain initial access to corporate networks and deployed the file-encrypting malware less than a minute later. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-react2shell-flaw-exploited-in-ransomware-attacks/
-
Hacking Hardware, Unraveling Malware: Black Hat Europe at 25
Also: macOS Naughty or Nice, Cybercrime Karma, Spoofing Legacy Rail Infrastructure London in December: Early to dark, quick to rain but also festive – and a mecca for cybersecurity researchers there for the annual Black Hat Europe conference. This year’s event featured nearly 50 briefings that touched on everything from hardware hacking to combing infostealer…
-
Hacking Hardware, Unraveling Malware: Black Hat Europe at 25
Also: macOS Naughty or Nice, Cybercrime Karma, Spoofing Legacy Rail Infrastructure London in December: Early to dark, quick to rain but also festive – and a mecca for cybersecurity researchers there for the annual Black Hat Europe conference. This year’s event featured nearly 50 briefings that touched on everything from hardware hacking to combing infostealer…
-
Santastealer: Weihnachtliche Windows-Malware meidet russische Systeme
Ein Malware-Entwickler eröffnet die Weihnachtssaison für Cyberkriminelle. Doch sein Santastealer ist längst nicht so gut, wie er verspricht. First seen on golem.de Jump to article: www.golem.de/news/amateurhafte-malware-santastealer-sammelt-weihnachtsgeschenke-fuer-cyberkriminelle-2512-203346.html
-
New ClickFix Attack Uses Fake Browser Fix to Install DarkGate Malware
Researchers at Point Wild have discovered a new ClickFix attack campaign that tricks users into manually installing DarkGate malware via fake browser extension alerts. Learn how this attack bypasses security by using the Windows Run box and how you can stay safe. First seen on hackread.com Jump to article: hackread.com/clickfix-attack-fake-browser-install-darkgate-malware/
-
Malware in Bewegung: Animierte Köder infizieren PCs
Cyberkriminelle verfeinern ihre Methoden zunehmend, um Erkennungssysteme zu umgehen. Laut dem aktuellen Threat Insights Report von HP Inc. setzen Angreifer auf überzeugende Animationen, gefälschte Plattformen und käufliche Malware-Dienste, um ihre Angriffe schwerer erkennbar zu machen. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/malware-animierte-koeder-infizieren-pcs
-
Russische APT-Gruppe greift westliche KRITIS-Betreiber an
Tags: access, apt, authentication, backup, blizzard, cloud, credentials, cve, cyberattack, cyberespionage, infrastructure, intelligence, kritis, malware, mfa, mssp, router, service, threat, veeam, vpn, vulnerability, zero-dayEine russische Cyberspionage-Kampagne zielt auf Energieversorger.Das Team von Amazon Threat Intelligence stellte fest, dass eine vom russischen Staat geförderte Cyberspionagegruppe vermehrt Energieunternehmen und Anbieter kritischer Infrastrukturen (KRITIS) ins Visier genommen hat.Die Gruppe ist demnach seit mindestens 2021 aktiv und hat es vor allem auf Fehlkonfigurationen von Geräten abgesehen. Die Angreifer nutzen aber auch bekannte Schwachstellen…
-
Russische APT-Gruppe greift westliche KRITIS-Betreiber an
Tags: access, apt, authentication, backup, blizzard, cloud, credentials, cve, cyberattack, cyberespionage, infrastructure, intelligence, kritis, malware, mfa, mssp, router, service, threat, veeam, vpn, vulnerability, zero-dayEine russische Cyberspionage-Kampagne zielt auf Energieversorger.Das Team von Amazon Threat Intelligence stellte fest, dass eine vom russischen Staat geförderte Cyberspionagegruppe vermehrt Energieunternehmen und Anbieter kritischer Infrastrukturen (KRITIS) ins Visier genommen hat.Die Gruppe ist demnach seit mindestens 2021 aktiv und hat es vor allem auf Fehlkonfigurationen von Geräten abgesehen. Die Angreifer nutzen aber auch bekannte Schwachstellen…
-
Russische APT-Gruppe greift westliche KRITIS-Betreiber an
Tags: access, apt, authentication, backup, blizzard, cloud, credentials, cve, cyberattack, cyberespionage, infrastructure, intelligence, kritis, malware, mfa, mssp, router, service, threat, veeam, vpn, vulnerability, zero-dayEine russische Cyberspionage-Kampagne zielt auf Energieversorger.Das Team von Amazon Threat Intelligence stellte fest, dass eine vom russischen Staat geförderte Cyberspionagegruppe vermehrt Energieunternehmen und Anbieter kritischer Infrastrukturen (KRITIS) ins Visier genommen hat.Die Gruppe ist demnach seit mindestens 2021 aktiv und hat es vor allem auf Fehlkonfigurationen von Geräten abgesehen. Die Angreifer nutzen aber auch bekannte Schwachstellen…
-
China-Linked Ink Dragon Hacks Governments Using ShadowPad and FINALDRAFT Malware
The threat actor known as Jewelbug has been increasingly focusing on government targets in Europe since July 2025, even as it continues to attack entities located in Southeast Asia and South America.Check Point Research is tracking the cluster under the name Ink Dragon. It’s also referenced by the broader cybersecurity community under the names CL-STA-0049,…
-
Malware zum Weihnachtsfest: Santastealer sammelt Geschenke für Cyberkriminelle
Tags: malwareEin Malware-Entwickler eröffnet die Weihnachtssaison für Cyberkriminelle. Doch sein Santastealer ist längst nicht so gut, wie er verspricht. First seen on golem.de Jump to article: www.golem.de/news/amateurhafte-malware-santastealer-sammelt-weihnachtsgeschenke-fuer-cyberkriminelle-2512-203346.html
-
GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads
A new campaign named GhostPoster has leveraged logo files associated with 17 Mozilla Firefox browser add-ons to embed malicious JavaScript code designed to hijack affiliate links, inject tracking code, and commit click and ad fraud.The extensions have been collectively downloaded over 50,000 times, according to Koi Security, which discovered the campaign. The add-ons are no…
-
BlindEagle Targets Colombian Government Agency with Caminho and DCRAT
Tags: access, attack, authentication, cloud, communications, control, cybercrime, defense, detection, dkim, dmarc, dns, email, encryption, flaw, government, group, infrastructure, injection, Internet, malicious, malware, microsoft, open-source, phishing, powershell, rat, service, spear-phishing, startup, tactics, threat, tool, update, usa, windowsIntroductionIn early September 2025, Zscaler ThreatLabz discovered a new spear phishing campaign attributed to BlindEagle, a threat actor who operates in South America and targets users in Spanish-speaking countries, such as Colombia. In this campaign, BlindEagle targeted a government agency under the control of the Ministry of Commerce, Industry and Tourism (MCIT) in Colombia using…
-
Cellik Android Malware Uses One-Click APK Builder to Hide in Play Store Apps
A newly discovered Android Remote Access Trojan (RAT) called Cellik is democratizing sophisticated mobile surveillance attacks by bundling advanced spyware capabilities with an automated tool that allows attackers to inject malicious code into legitimate Google Play Store applications seamlessly. The malware address a significant escalation in Android-targeted threats, combining complete device control, real-time surveillance, and…
-
New Moonwalk++ PoC Demonstrates How Malware Can Forge Windows Call Stacks to Evade Detection
Security researchers have unveiled a dangerous new technique that allows malware to completely hide its tracks by faking Windows call stacks a method designed to bypass modern endpoint detection systems. The technique, called Moonwalk++, extends previous research on Stack Moonwalking and demonstrates a critical vulnerability in how security tools validate whether malware is calling sensitive…
-
Cellik Android Malware Uses One-Click APK Builder to Hide in Play Store Apps
A newly discovered Android Remote Access Trojan (RAT) called Cellik is democratizing sophisticated mobile surveillance attacks by bundling advanced spyware capabilities with an automated tool that allows attackers to inject malicious code into legitimate Google Play Store applications seamlessly. The malware address a significant escalation in Android-targeted threats, combining complete device control, real-time surveillance, and…
-
Blind Eagle Hackers Exploit Trust to Bypass Email Security Controls
Tags: attack, control, cyber, cybersecurity, email, exploit, government, group, hacker, malware, phishing, spear-phishing, threatBlindEagle threat actors are exploiting compromised internal email accounts to launch spear-phishing campaigns that bypass traditional email security controls, targeting Colombian government agencies with sophisticated multi-stage malware attacks, according to Zscaler ThreatLabz research. The cybersecurity firm discovered the campaign in early September 2025, revealing that the South American threat group targeted a government agency under…
-
New Moonwalk++ PoC Demonstrates How Malware Can Forge Windows Call Stacks to Evade Detection
Security researchers have unveiled a dangerous new technique that allows malware to completely hide its tracks by faking Windows call stacks a method designed to bypass modern endpoint detection systems. The technique, called Moonwalk++, extends previous research on Stack Moonwalking and demonstrates a critical vulnerability in how security tools validate whether malware is calling sensitive…
-
Parked Domains Emerge as a Primary Channel for Malware and Phishing
The landscape of domain parking has transformed dramatically over the past decade, shifting from a relatively benign monetization strategy to a sophisticated vector for cybercrime. New research into the modern parking ecosystem reveals a startling reality: over 90% of visitors to parked domains encounter malicious content, scams, or phishing attacks a stark reversal from conditions…
-
New Moonwalk++ PoC Demonstrates How Malware Can Forge Windows Call Stacks to Evade Detection
Security researchers have unveiled a dangerous new technique that allows malware to completely hide its tracks by faking Windows call stacks a method designed to bypass modern endpoint detection systems. The technique, called Moonwalk++, extends previous research on Stack Moonwalking and demonstrates a critical vulnerability in how security tools validate whether malware is calling sensitive…
-
React2Shell-Attacken: Nordkoreanische Hacker nutzen EtherRAT-Malware
Die Analyse einer aktuellen Angriffskampagne zeigt, wie schnell sich bekannte Schwachstellen zu hochentwickelten Einfallstoren entwickeln können. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/react2shell-attacken-nordkoreanische-hacker-etherrat-malware
-
Cellik Android malware builds malicious versions from Google Play apps
A new Android malware-as-a-service (MaaS) named Cellik is being advertised on underground cybercrime forums offering a robust set of capabilities that include the option to embed it in any app available on the Google Play Store. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cellik-android-malware-builds-malicious-versions-from-google-play-apps/
-
Real Attacks of the Week: How Spyware Beaconing and Exploit Probing Are Shaping Modern Intrusions
Over the past week, enterprise security teams observed a combination of covert malware communication attempts and aggressive probing of publicly exposed infrastructure. These incidents, detected across firewall and endpoint security layers, demonstrate how modern cyber attackers operate simultaneously. While quietly activating compromised internal systems, they also relentlessly scan external services for exploitable weaknesses. Although the…
-
SantaStealer Joins the Naughty List of New Infostealers
SantaStealer is a new malware-as-a-service infostealer that steals credentials and data using largely in-memory techniques. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/santastealer-joins-the-naughty-list-of-new-infostealers/
-
React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors
The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security.”KSwapDoor is a professionally engineered remote access tool designed with stealth in mind,” Justin Moore, senior manager of threat intel research at Palo Alto…
-
React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors
The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security.”KSwapDoor is a professionally engineered remote access tool designed with stealth in mind,” Justin Moore, senior manager of threat intel research at Palo Alto…