Tag: malware
-
Infostealer riding the AI Train
ey Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments. This expanded targeting reflects…
-
StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown
StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted infostealer into a platform for persistent endpoint control. Advertised on October 16, the malware combines credential theft with hidden desktop access, command execution, file management, and payload delivery, according to research supplied by Varonis Threat Labs. The comeback follows June’s…
-
Forescout deckt neue ClickFix-Angriffsketten und Malware-Plattform ROMULUS auf
Forescout enthüllt neue ClickFix-Angriffe: Malware-Loader, ROMULUS und raffinierte Tarnmechanismen machen den Weg für Ransomware frei. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/forescout-deckt-neue-clickfix-angriffsketten-und-malware-plattform-romulus-auf/a46900/
-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led…
-
12 Malware Analysis Tools: The 2026 Buyer’s Verdict Guide
Malware analysis tooling spans a spectrum the acronyms hide: interactive sandboxes where analysts click alongside the malware, evasion-hardened hypervisor rigs for the samples that detect everything else, reputation oceans answering “has anyone seen this?”, binary-similarity engines, and the open standards (YARA above all) the whole field writes in. This verdict guide reviews twelve names across…
-
Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no optional features to be enabled. ThreatLabz observed attackers poisoning logs to trigger command execution, planting web shells and attempting to deploy a FreeBSD x64 implant. Citrix disclosed the vulnerability on September 27, 2026,…
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote First…
-
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/
-
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/litellm-compromised-supply-chain-attack-pypi-docker/
-
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/iranian-hacking-group-hosting-c2/
-
North Korean Hackers Use Post-Quantum Encryption to Conceal Malware in New Cyberespionage Campaign
Tags: communications, cryptography, cyber, cyberespionage, encryption, finance, group, hacker, infection, korea, lazarus, malicious, malware, north-korea, phishing, software, spear-phishingNorth Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware communications and payloads behind a multi-stage infection chain. Dubbed Operation FlashHole, the campaign combined spear-phishing, malicious websites, abuse of financial security software and modular malware that largely operated in memory. The campaign followed Operation SyncHole, a Lazarus operation…
-
LiteLLM Supply Chain Compromise Exposes AI Developer Credentials to Malware Attacks
Tags: ai, attack, authentication, cloud, container, credentials, cyber, malicious, malware, pypi, startup, supply-chainLiteLLM version 1.107.0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images. On October 21, 2026, researchers at Socket reported that malicious Python startup hooks could activate even if applications didn’t import LiteLLM, potentially exposing cloud credentials, developer secrets, and AI authentication files. Socket flagged seven malicious…
-
Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers’ servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/
-
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/
-
Decades-Old Windows Utility Powers Modern ClickFix Attack
The attack uses malicious Google search results related to Amazon and leverages the ‘finger’ utility to launch a CAPTCHA that installs malware, including the Lumma stealer. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attack
-
Gefälschte CAPTCHAs: Wenn »Ich bin kein Roboter« zur Malware-Falle wird
Gefälschte CAPTCHAs sehen vertraut aus und genau das macht sie gefährlich. In Verbindung mit ClickFix-Techniken bringen sie Nutzer dazu, schädliche Befehle selbst auszuführen. Unternehmen müssen deshalb technische Kontrollen, Awareness und klare Meldewege enger zusammendenken. Management Summary CAPTCHA als Tarnkappe: Angreifer nutzen vertraute Verifizierungsdialoge, um Phishing-Seiten glaubwürdig erscheinen zu lassen und automatisierte Prüfungen zu erschweren…. First…
-
Info-stealing malware slipped into OVHcloud CLI releases on GitHub
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/ovhcloud-cli-github-malware/
-
Hackers Compromise 333 Tor Exit Nodes to Steal SSH Credentials and Deploy Ebury Malware
Attackers compromised 333 Tor exit nodes in a coordinated campaign to intercept SSH connections, steal passwords, and deploy the Ebury Linux backdoor, according to a research account published on October 20, 2026. The compromised infrastructure accounted for approximately 10% of Tor’s roughly 3,000 exit relays. The researcher reported that attackers accessed the underlying servers in…
-
Rust 1.100 Will Let Developers Block Fresh Cargo Packages to Reduce Malware Supply Chain Risks
Rust 1.100, scheduled for November 12, 2026, will introduce stable support for Cargo dependency cooldowns, allowing developers to reject newly published package versions until they reach a configurable minimum age. The feature gives security researchers, maintainers, and registries time to identify malicious releases before automated updates spread them across development environments and CI pipelines access.…
-
INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds
Ransomware affiliates associated with INC and The Gentlemen exposed an intrusion ecosystem after leaving operational servers publicly accessible. The investigation began in late September 2026 with open directories on 45.227.254[.]43. Configuration files and credentials led researchers to six additional adversary servers, exposing development infrastructure, command infrastructure and ransomware staging systems. The findings describe an active…
-
AOMEI yet to notify customers after hackers hijacked its software updates
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at a time. First seen on therecord.media Jump to article: therecord.media/aomei-yet-to-notify-customers-hijack-software
-
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/
-
Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware
OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47…
-
Rank Math PRO WordPress Plugin Compromised to Spread Malware and Steal Credentials
Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3.0.123. They warn that WordPress websites using this compromised plugin are at risk if administrators activated it. The company has removed the affected files and released a clean version, 3.0.124. Rank Math PRO Compromised The incident impacts a limited number…
-
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker used a contributor’s GitHub account to replace the download archives on five existing releases of OVHcloud’s command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says.They were…
-
Hackers Turn Low-Cost Android Phones Into Hidden Proxy Botnets Through Preinstalled Malware
Midnight Mimosa, a widespread Android malware campaign, is turning inexpensive smartphones into advertising fraud engines and potential residential proxy nodes by embedding malicious apps in device firmware before purchase. Bitdefender observed thousands of infected devices across more than 150 countries over approximately two years, exposing a persistent compromise that ordinary application removal cannot resolve. The…
-
EUVD-2026-101420 / CVE-2026-76519 – Schwachstelle im Malware-Schutz von Cisco wird ausgenutzt
First seen on security-insider.de Jump to article: www.security-insider.de/cisco-secure-email-gateway-amp-schwachstelle-aktive-angriffe-a-5ddea88b41df727cb097967fa8f2f4a9/
-
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that’s being used to distribute malware such as Legion Loader.According to Forescout Research – Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their…
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147