Tag: malware
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147
-
WordPress SEO plugin Rank Math compromised to backdoor websites
Some downloads of the Rank Math PRO WordPress plugin from the vendor’s official website carried malware that planted hidden backdoors in a supply-chain attack last week. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/
-
Hackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI’s servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/
-
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16.Any site that installed and activated…
-
DHS to ban DeepSeek from federal civilian agencies
The order cites national security concerns, including sending data to servers in China, the potential malware and the overall risk to federal IT systems. First seen on cyberscoop.com Jump to article: cyberscoop.com/dhs-bans-deepseek-federal-agencies/
-
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps First…
-
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.”The tools delivered information-stealing malware and backdoors for macOS and Windows machines,” Elastic First…
-
Exploit-Code geleakt: Plex-Server werden attackiert
Wer einen Plex-Media-Server betreibt, sollte diesen dringend auf die neueste Version updaten. Angreifer schleusen mittels Plex2Shell-Angriff Malware ein. First seen on golem.de Jump to article: www.golem.de/news/exploit-code-geleakt-angreifer-schleusen-malware-auf-plex-server-2610-214242.html
-
Exploit-Code geleakt: Angreifer schleusen Malware auf Plex-Server
Wer einen Plex-Media-Server betreibt, sollte diesen dringend auf die neueste Version updaten. Angreifer schleusen mittels Plex2Shell-Angriff Malware ein. First seen on golem.de Jump to article: www.golem.de/news/exploit-code-geleakt-angreifer-schleusen-malware-auf-plex-server-2610-214242.html
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 119
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime AI models may be capable of self-replicating without access to a datacenter XWorm Reborn: From infostealer to surveillance platform Hirudo: From Fake Updates…
-
U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog
Tags: cisa, cybersecurity, exploit, firewall, flaw, fortinet, infrastructure, kev, malware, vulnerabilityU.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: This week, Palo Alto Netwoks researchers reported that PEERSTITCH malware exploited FortiManager to expose 500+ firewalls,…
-
(g+) Android-Sicherheit: Diese Tools schützen das Smartphone vor Malware
Malware kann auf Android großen Schaden anrichten. Wir zeigen, welche Tools Schadsoftware erkennen und wie man das eigene Smartphone schützt. First seen on golem.de Jump to article: www.golem.de/news/android-sicherheit-diese-tools-schuetzen-das-smartphone-vor-malware-2610-214198.html
-
GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises malicious JavaScript as a font file and targets developer workstations through Visual Studio Code tasks. Jenn Gile identified 94 compromised repositories belonging to 66 owners, confirming the payload in all 79 repositories available for analysis. The remaining 15 were inaccessible.…
-
SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with spear-phishing attacks that deploy ReverseRAT on Windows systems. The October 15, 2026, advisory classifies the threat as medium severity and highlights malware that can steal passwords, capture screenshots, and collect sensitive information. The campaign combines deceptive attachments, malicious Windows shortcuts,…
-
New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs
A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts interactions inside legitimate Google Pay and MobiKwik interfaces. The findings extend Cyble’s October 2025 investigation, which documented GhostBat spreading through fraudulent mParivahan applications, harvesting banking messages, and stealing UPI PINs through…
-
New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads
ROMULUS, a shared ClickFix delivery platform operating across six identified servers, with confirmed routes distributing a trojanized Stardock package and LegionLoader. The discovery connects infrastructure from a recently documented ChatGPT Custom GPT abuse campaign to an independently investigated incident, exposing a reusable backend capable of delivering different malicious payloads. The investigation began after researchers found…
-
Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
A server linked to a malware campaign attributed to a Midnight Blizzard-associated cluster was still delivering malicious files on October 5, 2026. The server returned HTTP 200 responses for multiple payload paths, including one used by simple Windows Internet Shortcut files to launch a PowerShell stager. The finding shows that public disclosure and low reputation…
-
Android Malware Exposes Its Own Operators While Hijacking Phones and Stealing Sensitive Data
An Android remote-access Trojan, YuanKong, whose weakly protected dropper reveals more than its hidden payload: it exposes the operator account identifiers embedded in each build. Analysis of 110 droppers uncovered 57 distinct child payloads, 42 operator accounts and 44 rotating build brands, all tied together by a shared signing certificate and command-and-control (C2) infrastructure. Its…
-
Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks
Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity. The findings, published in two research blogs, examine what happens after victims fall for ClickFix lures. These attacks trick users into copying and running malicious…
-
Fake Arch Linux AUR packages exploit typos to run malware with root privileges
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/16/arch-linux-aur-malware-yay-paru/
-
Warnung des BSI: Angriffe auf Zero-Day-Lücke in Cisco Secure Email Gateway
Der Malware-Scanner von Ciscos Secure Email Gateway reagiert fehlerhaft auf speziell gestaltete E-Mails. Hacker erhalten so Root-Rechte. First seen on golem.de Jump to article: www.golem.de/news/warnung-des-bsi-angriffe-auf-zero-day-luecke-in-cisco-secure-email-gateway-2610-214183.html
-
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and…
-
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and…
-
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
PEERSTITCH malware exploited FortiManager to expose 500+ firewalls, evade detection inside FortiOS memory, and maintain stealthy access. PEERSTITCH, a stealthy implant deployed during a prolonged intrusion, helped attackers maintain access to a telecom managed service provider after compromising its FortiManager appliance. Palo Alto Networks Unit 42 documented the operation, which began in September 2024 and…
-
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH.The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a First…
-
Targeted ads delivered 0-click exploits to install mercenary malware
The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware/
-
Targeted ads delivered 0-click exploits to install mercenary malware
The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/targeted-ads-delivered-0-click-exploits-to-install-mercenary-malware/
-
The 2026 Infostealer Intelligence Shortlist: Top 10 Vendors Security Teams Should Know
Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal’s kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright. First seen on thecyberexpress.com Jump to…
-
Fake Arch Linux packages push malware with root privileges
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/