Tag: malware
-
Fake US Court Notices Target 100,000+ Businesses With LodaRAT
Fake US court notices target over 100,000 businesses, luring recipients to download LodaRAT malware that steals passwords, records… First seen on hackread.com Jump to article: hackread.com/fake-us-court-notices-target-businesses-lodarat/
-
INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup
The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/inj3ctor3-jomangy-freepbx-credential-theft/
-
Hackers Hijack Camera Management Software to Deploy Reverse Shells and Hidden Windows Malware
Attackers are compromising camera management software to gain remote access, run malicious DLLs through a legitimate Windows component, and maintain persistent footholds in enterprise environments. The incidents show how overlooked surveillance applications can become entry points into broader corporate networks. Huntress observed several intrusions during September and October involving CMS.exe, a camera management application installed…
-
Malicious npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials and Spread Malware
Research has identified 42 weaponized GitHub repositories belonging to 11 legitimate owners in the testmetest npm campaign, exposing an operation that combines credential theft, development-tool execution hooks, and malicious package publishing. The findings establish that the campaign extended beyond attacker-controlled test packages into established developers’ repositories. Researchers Guy Korolevski and Yair Benamou uncovered oversized payload…
-
Hackers Use Signed ChatGPT and Claude Binaries to Deploy Yoba Malware
Hackers are exploiting growing interest in AI tools to spread Yoba malware through fraudulent GitHub projects that claim to offer non-existent desktop applications named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. According to Check Point Research, these repositories and GitHub Pages attracted users through apparent SEO poisoning, with download buttons that delivered malicious ZIP files.…
-
‘Aokigahara’ Stealer Targets ‘Developer Keyrings’ & AI Assistants
The malware’s focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint. First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/aokigahara-stealer-developer-keyrings-ai-assistants
-
Watchguard Global Threat Report H1 2026 – Weniger Angriffe, aber fast jede Malware ist ein Einzelstück
First seen on security-insider.de Jump to article: www.security-insider.de/watchguard-weniger-angriffe-mehr-neue-malware-a-b5c072a982a4c2e6dad4bf9325d24c9c/
-
Hackers Abuse Microsoft Teams External Chats to Access Corporate PCs
Hackers impersonate IT support in Microsoft Teams external chats, tricking employees into granting remote access and installing malware on corporate computers. First seen on hackread.com Jump to article: hackread.com/hackers-abuse-microsoft-teams-external-chats-pc/
-
Tricks from the Past deployed via signed ChatGPT and Claude binaries
ey Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. The attackers use fake GitHub projects that pretend to be AI desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude…
-
Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes
Cybercriminals are stuffing infostealer malware into bogus apps aimed at tracking gas prices, police activity, drone strikes and other information of concern to average Russians, researchers said. First seen on therecord.media Jump to article: therecord.media/malicious-apps-russian-anxiety-gas-prices-drone-strikes
-
Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes
Cybercriminals are stuffing infostealer malware into bogus apps aimed at tracking gas prices, police activity, drone strikes and other information of concern to average Russians, researchers said. First seen on therecord.media Jump to article: therecord.media/malicious-apps-russian-anxiety-gas-prices-drone-strikes
-
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
Tags: cyber, cybersecurity, encryption, espionage, group, kaspersky, korea, lazarus, malware, north-korea, russia, softwareThe North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It’s assessed to pick up First seen…
-
Hackers Abuse Magento CMS Blocks to Infect Online Stores and Evade Malware Detection
Hackers are injecting JavaScript into Magento CMS blocks to maintain access to compromised storefronts while selectively hiding malicious responses from security scanners. Registered on October 6, 2026, the domain appeared on infected stores the following evening. Sixty of the 83 victims previously loaded infrastructure belonging to the same operator, including 34 infected since October 2025.…
-
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency’s operators gained access to the criminal’s operation’s backend and cut it off from those computers.”The next steps that we took were to disconnect…
-
Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections
More than 400 incidents in which attackers abused Microsoft Teams external chats to impersonate IT support, obtain remote access, and deliver malware. Researchers identified recurring tenant names, deceptive display names, remote administration tools, and payload infrastructure across incidents. Teams federation, enabled by default, allows communication between organizations when both tenants permit external access. Attackers exploit…
-
26th October Threat Intelligence Report
Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malware on customer servers. More than 26,000 servers were potentially affected. The provider […] First seen on research.checkpoint.com Jump to article: research.checkpoint.com/2026/26th-october-threat-intelligence-report/
-
New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentials
A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets. The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. Rather than exploiting an identified vulnerability in these products, the malware…
-
StealC Malware Returns as Stadia RAT After Operation Endgame Takedown
StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using… First seen on hackread.com Jump to article: hackread.com/stealc-malware-stadia-rat-operation-endgame-takedown/
-
Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs
Malware campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate Windows applications to conceal infections targeting users in Brazil and Portugal. The investigation covers Overlord RAT, Lampion, and an unidentified payload delivered through a malicious newdev.dll. Rather than exploiting Windows Error Reporting itself, attackers impersonated its components and naming conventions, disguising malicious executables and scheduled…
-
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.The company caught the attempt on a real customer’s machine and stopped the agent before any code ran. It could not determine how…
-
TrendAI-Studie: So nutzen China, Russland, Nordkorea und Iran KI für Cyberangriffe
Staatliche Hacker nutzen KI für Spionage, Malware und Cyberangriffe. TrendAI zeigt, wie China, Russland, Nordkorea und Iran ihre Strategien verändern. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/trendai-studie-so-nutzen-china-russland-nordkorea-und-iran-ki-fuer-cyberangriffe/a46915/
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable […]…
-
Hackers Use Fake Chocolatey and Microsoft Activation Websites to Spread New Armorsteal Malware
Hackers are distributing ArmorSteal, a Python-based malware family, through fake Chocolatey and Microsoft Activation-Script websites promoted via search engine poisoning. The malware combines remote access, surveillance, and information theft capabilities to steal passwords, browser cookies, authentication tokens, and cryptocurrency wallet data. Zscaler’s Threat Hunting team identified the campaign in September 2026 and published its findings…
-
Trust Is Not What It Seems, And Fraudsters Are Counting on It
Threat actors don’t need to rely on malware to breach organizations anymore. They’re simply calling help desks and politely asking for access, with a little help from artificial intelligence. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/trust-is-not-what-it-seems-and-fraudsters-are-counting-on-it
-
Overlord RAT Uses Fake Legal Notices to Infect Windows PCs in New Campaign
WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access… First seen on hackread.com Jump to article: hackread.com/overlord-rat-fake-legal-notices-infect-windows-pcs/
-
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led…