Tag: malware
-
New Android Albiriox Malware Gains Traction in Dark Web Markets
Android malware Albiriox emerged as MaaS, offering device takeover and real-time fraud capabilities First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/android-maas-malware-albiriox-dark/
-
ShadyPanda browser extensions amass 4.3M installs in malicious campaign
A long-running malware operation known as “ShadyPanda” has amassed over 4.3 million installations of seemingly legitimate Chrome and Edge browser extensions that evolved into malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/shadypanda-browser-extensions-amass-43m-installs-in-malicious-campaign/
-
Malware Manipulates AI Detection in Latest npm Package Breach
Malicious npm package targets AI security with misleading prompts, exploiting automated analysis First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/malware-ai-detection-npm-package/
-
Operation Hanoi Thief: Pseudo-Polyglot Payloads Targeting IT Professionals
SEQRITE Labs APT-Team has uncovered a sophisticated cyberattack campaign dubbed >>Operation Hanoi Thief,
-
Emerging Android threat ‘Albiriox’ enables full On”‘Device Fraud
Albiriox is new Android MaaS malware enabling on-device fraud and real-time control. It targets 400+ banking, fintech, crypto, and payment apps. Albiriox is a new Android malware sold under a malware-as-a-service model on Russian”‘speaking cybercrime forums. It provides advanced capabilities for on-device fraud, screen manipulation, and real-time interaction with infected devices. It also includes a…
-
Bin ich Teil eines Botnets? GreyNoise IP-Check-Seite
Immer häufiger werden IoT-Geräte wie Router etc. durch Malware infiziert und in ein Botnetz integriert. Die Frage ist, wie man als Anwender auf einfache Art prüfen kann, ob das eigene Netzwerk Teil eines Botnetzes ist. Sicherheitsanbieter GreyNoise hat für diese … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/01/bin-ich-teil-eines-botnets-sicherheitsanbieter-gray-nose-stellt-ip-check-online/
-
New Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control
A new Android malware named Albiriox has been advertised under a malware-as-a-service (MaaS) model to offer a “full spectrum” of features to facilitate on-device fraud (ODF), screen manipulation, and real-time interaction with infected devices.The malware embeds a hard-coded list comprising over 400 applications spanning banking, financial technology, payment processors, cryptocurrency First seen on thehackernews.com Jump…
-
APT36 Deploys Python-Based ELF Malware in Targeted Attacks on Indian Government Agencies
Pakistan-linked cyberespionage group APT36 (Transparent Tribe) has escalated its campaign against Indian government institutions with the deployment of sophisticated Python-based ELF malware specifically designed to compromise Linux-based BOSS operating environments, according to research published by CYFIRMA. The threat actor, historically focused on Windows systems, has demonstrated expanded technical maturity through multi-platform tooling that bypasses conventional…
-
Bin ich Teil eines Botnets? Gray Nose IP-Check-Seite
Immer häufiger werden IoT-Geräte wie Router etc. durch Malware infiziert und in ein Botnetz integriert. Die Frage ist, wie man als Anwender auf einfache Art prüfen kann, ob das eigene Netzwerk Teil eines Botnetzes ist. Sicherheitsanbieter Grey Nose hat für … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/12/01/bin-ich-teil-eines-botnets-sicherheitsanbieter-gray-nose-stellt-ip-check-online/
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 73
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Analysis of ShadowPad Attack Exploiting WSUS Remote Code Execution Vulnerability (CVE-2025-59287) Shai-Hulud 2.0 Supply Chain Attack: 25K+ npm Repos Exposed Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications Morphisec Thwarts Russian-Linked…
-
Week in review: Fake “Windows Update” fuels malware, Salesforce details Gainsight breach
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Quantum encryption is pushing satellite hardware to its limits In this Help … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/30/week-in-review-fake-windows-update-fuels-malware-salesforce-details-gainsight-breach/
-
Contagious Interview campaign expands with 197 npm Ppackages spreading new OtterCookie malware
North Korea-linked actors behind Contagious Interview uploaded 197 new malicious npm packages to distribute a new OtterCookie malware version. North Korea-linked threat actors added 197 new malicious npm packages to spread updated OtterCookie malware as part of the ongoing Contagious Interview campaign, cybersecurity firm Socket warns. TheContagious Interviewcampaign, active since November 2023 and linked to…
-
G DATA prognostiziert neue Dynamik der Cyberkriminalität: KI-Malware und Insider-Bedrohungen bestimmen 2026 die Bedrohungslage
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/g-data-prognose-dynamik-cyberkriminalitaet-ki-malware-insider-bedrohungen-2026-bedrohungslage
-
Albiriox Malware Emerges, Targeting Android Users for Full Device Takeover
A dangerous new Android malware called Albiriox has been discovered by security researchers, posing a serious threat to mobile banking and cryptocurrency users worldwide. The malware operates as a Malware-as-a-Service (MaaS), allowing cybercriminals to rent access to this powerful hacking tool for monthly fees ranging from $650 to $720. The Cleafy Threat Intelligence team first identified Albiriox…
-
North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware
The North Korean threat actors behind the Contagious Interview campaign have continued to flood the npm registry with 197 more malicious packages since last month.According to Socket, these packages have been downloaded over 31,000 times, and are designed to deliver a variant of OtterCookie that brings together the features of BeaverTail and prior versions of…
-
Werbefreies Youtube-Streaming: Smarttube-App mutiert durch Leak zur Malware-Gefahr
Eine Signatur des Entwicklers von Smarttube ist geleakt. Anwendern drohen manipulierte Updates. Google Play Protect blockiert daher die App. First seen on golem.de Jump to article: www.golem.de/news/werbefreies-youtube-streaming-signatur-leak-macht-smarttube-zur-malware-bedrohung-2511-202694.html
-
Werbefreies Youtube-Streaming: Signatur-Leak macht Smarttube zur Malware-Bedrohung
Eine Signatur des Entwicklers von Smarttube ist geleakt. Anwendern drohen manipulierte Updates. Google Play Protect blockiert daher die App. First seen on golem.de Jump to article: www.golem.de/news/werbefreies-youtube-streaming-signatur-leak-macht-smarttube-zur-malware-bedrohung-2511-202694.html
-
New Mirai variant ShadowV2 tests IoT exploits amid AWS disruption
ShadowV2, a new Mirai-based botnet, briefly targeted vulnerable IoT devices during October’s AWS outage, likely as a test run. During the late-October AWS disruption, FortiGuard Labs researchers observed the Mirai-based ‘ShadowV2’ malware exploiting IoT vulnerabilities across multiple countries and industries. The botnet was active only during the outage, suggesting a test run for future attacks.…
-
KI-Malware: Robuste Cyberabwehr braucht moderne Technik und Awareness Trainings
In den kommenden Monaten werden Angriffe dynamischer, da Cyberkriminelle neue Technologien schnell adaptieren und Angriffsmethoden verfeinern. Allerdings werden Unternehmen lernfähiger und robuster. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/ki-malware-robuste-cyberabwehr-braucht-moderne-technik-und-awareness-trainings/a42994/
-
Black Friday Scammers Are Impersonating Major Brands to Steal Your Money
Black Friday is supposed to be chaotic, sure, but not this chaotic. Amid genuine doorbusters and flash sales, a large-scale, highly polished scam campaign is hijacking web traffic and pushing shoppers to fake “survey reward” pages impersonating dozens of major brands all to steal payment card details and personal data. Security research into malvertising ahead…
-
Security researchers caution app developers about risks in using Google Antigravity
CSOonline that the nature of the flaw makes it difficult to mitigate. “Strong identity would not help mitigate this issue, because the actions undertaken by Antigravity are occurring with the identity of the user running the application,” he said. “As far as the operating system can tell, they are indistinguishable. Access management control could possibly…
-
Windows-Schwachstelle CVE-2025-59287 wird für ShadowPad-Malware-Verteilung per WSUS genutzt
In Windows Server gab es eine mit einem CVSS Score von 9.8 bewertete kritische RCE-Schwachstelle CVE-2025-59287 im WSUS-Teil, mit dem sich die Systeme übernehmen lassen. Die Schwachstelle wurde im Oktober 2025 mit Sicherheitsupdates geschlossen. Nun gibt es Berichte, dass Angreifer … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/11/28/windows-schwachstelle-cve-2025-59287-wird-fuer-shadowpad-malware-verteilung-per-wsus-genutzt/
-
“Dead Man’s Switch” Triggers Massive npm Supply Chain Malware Attack
GitLab’s security team has discovered a severe, ongoing attack spreading dangerous malware through npm, the world’s most extensive code library. The malware uses an alarming >>dead man’s switch,
-
Microsoft Teams Guest Chat Flaw Could Let Hackers Deliver Malware
Security researchers have discovered a critical vulnerability in Microsoft Teams that allows attackers to bypass all Defender for Office 365 protections by inviting users into malicious tenant environments. The flaw exploits a fundamental architectural gap in how Teams handles cross-tenant collaboration and guest access. The vulnerability centers on a critical misunderstanding held by most security…
-
ThreatsDay Bulletin: AI Malware, Voice Bot Flaws, Crypto Laundering, IoT Attacks, and 20 More Stories
Hackers have been busy again this week. From fake voice calls and AI-powered malware to huge money-laundering busts and new scams, there’s a lot happening in the cyber world.Criminals are getting creative, using smart tricks to steal data, sound real, and hide in plain sight. But they’re not the only ones moving fast. Governments and…
-
Von LLM generierte Malware wird immer besser
Forscher tricksen Chatbots aus, stoßen aber auf unzuverlässige Ergebnisse.Cyberkriminelle versuchen bereits seit geraumer Zeit, mit Hilfe von Large Language Models (LLM) ihre dunklen Machenschaften zu automatisieren. Aber können sie schon bösartigen Code generieren, der ‘marktreif” und bereit für den operativen Einsatz ist? Das wollten die Forschenden von Netskope Threat Labs herausfinden, indem sie Chatbots dazu…
-
New ShadowV2 botnet malware used AWS outage as a test opportunity
A new Mirai-based botnet malware named ‘ShadowV2’ has been observed targeting IoT devices from D-Link, TP-Link, and other vendors with exploits for known vulnerabilities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-shadowv2-botnet-malware-used-aws-outage-as-a-test-opportunity/
-
For the first time, a RomCom payload has been observed being distributed via SocGholish
RomCom malware used the SocGholish fake update loader to deliver Mythic Agent to a U.S. civil engineering firm. In September 2025, Arctic Wolf Labs observed RomCom threat actors delivering the Mythic Agent via SocGholish to a U.S. company. The researchers noticed that the payload executed about 10 minutes after initial exploitation, marking the first time…