Tag: malware
-
Malicious Jackson Lookalike Library Slips Into Maven Central
A malicious Jackson lookalike library was used to distribute Cobalt Strike malware through Maven Central. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/malicious-jackson-lookalike-library-slips-into-maven-central/
-
GlassWorm Malware Turns VS Code Extensions into an Attack Vector Against macOS
GlassWorm has returned with a dangerous new evolution. The notorious self-propagating malware, which first surfaced in October as an invisible Unicode-based threat in VS Code extensions, has completed a significant platform pivot to macOS with 50,000 downloads and a fully operational infrastructure. Security researchers have identified three malicious extensions on the Open VSX marketplace linked…
-
DarkSpectre Malware Campaign Hits Chrome, Edge, and Firefox Users
A sophisticated Chinese threat actor dubbed DarkSpectre has compromised 8.8 million users across Chrome, Edge, and Firefox through three distinct malware campaigns that have operated undetected for over seven years, researchers revealed today. The operation represents one of the most extensive and professionally organized browser extension threats ever documented, combining long-term infrastructure investment with nation-state-level…
-
RondoDox botnet exploits React2Shell flaw to breach Next.js servers
The RondoDox botnet has been observed exploiting the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js servers with malware and cryptominers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/rondodox-botnet-exploits-react2shell-flaw-to-breach-nextjs-servers/
-
Cybersecurity Predictions 2026: An AI Arms Race and Malware Autonomy
The year ahead will see an intensified AI-driven cybersecurity arms race, with attackers leveraging autonomous malware and advanced AI technologies to outpace defenders, while security teams adopt increasingly sophisticated AI tools to combat evolving threats amidst growing vendor consolidation and platformization in the industry. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/cybersecurity-predictions-2026-an-ai-arms-race-and-malware-autonomy
-
New AI-Enhanced Crypter Promoted as Capable of Evading Windows Defender
Cybersecurity researchers have spotted a new high-sophistication malware loader being advertised on dark web forums, marketed as a commercial solution for evading modern endpoint protection. The tool, dubbed InternalWhisper x ImpactSolutions, is being promoted by a threat actor known as >>ImpactSolutions.
-
EmEditor Website Breach Turns Trusted Installer Into Infostealer Malware
A supply chain attack on the EmEditor website delivered a trojanized installer that installed infostealer malware. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/emeditor-website-breach-turns-trusted-installer-into-infostealer-malware/
-
2 Cyber Pros Admit to Being BlackCat Ransomware Affiliates
Americans Extorted at Least 5 Firms, Earning $1 Million From a Medical Device Maker. Two American cybersecurity professionals who moonlighted as BlackCat ransomware gang affiliates pleaded guilty to using the crypto-locking malware to extort at least five victims in the United States, including a medical device maker that paid a cryptocurrency ransom worth over $1…
-
Hackers Promote “VOID” AV Killer Claiming Kernel-Level Defense Evasion
A threat actor operating under the handle Crypt4You has begun advertising a sophisticated new offensive tool on underground cybercrime forums, marketed as a >>kernel-level>crypters
-
ESET Flags Rising Threat of AI-Driven Malware and Ransomware
The cybersecurity landscape entered a critical new era in the second half of 2025 as AI-powered malware transitioned from theoretical threat to tangible reality, while the ransomware-as-a-service economy expanded at an unprecedented pace. According to ESET Research’s latest Threat Report, these twin forces are reshaping how organizations must approach cyber defense. ESET discovered PromptLock, the…
-
Hackers Impersonated Jackson JSON Library to Infiltrate Maven Central
Security researchers have uncovered a sophisticated multi-stage malware campaign targeting Maven Central, the primary repository for Java dependencies. The attack centered on a malicious package impersonating the legitimate Jackson JSON library marking the first significant detection of advanced malware in an ecosystem that has historically remained resilient against supply chain attacks. The malicious package, published…
-
Chinese Hackers Deploy Rootkit to Stealthily Mask ToneShell Malware
Tags: apt, backdoor, china, cyber, cyberespionage, government, group, hacker, malicious, malware, technology, toolA sophisticated cyberespionage campaign leveraging kernel-mode rootkit technology has been discovered targeting government organizations across Southeast and East Asia, with Myanmar and Thailand bearing the brunt of attacks. Security researchers identified a malicious driver delivering the ToneShell backdoor, a hallmark tool of the Chinese-nexus HoneyMyte APT group, also tracked as Mustang Panda or Bronze President.…
-
Top 5 real-world AI security threats revealed in 2025
Tags: access, ai, api, attack, breach, chatgpt, cloud, control, credentials, cybercrime, data, data-breach, defense, email, exploit, flaw, framework, github, gitlab, google, injection, least-privilege, LLM, malicious, malware, microsoft, nvidia, open-source, openai, rce, remote-code-execution, risk, service, software, supply-chain, theft, threat, tool, vulnerabilityA critical remote code execution (RCE) in open-source AI agent framework Langflow that was also exploited in the wildAn RCE flaw in OpenAI’s Codex CLIVulnerabilities in NVIDIA Triton Inference ServerRCE vulnerabilities in major AI inference server frameworks, including those from Meta, Nvidia, Microsoft, and open-source projects such as vLLM and SGLangVulnerabilities in open-source compute framework…
-
Evasive Panda ändert das DNS, statt Updates lädt man Malware
Die Hacker-Gruppe Evasive Panda nutzte das Domain Name System, um unzählige Computer zu verseuchen. Das DNS ist elementar und keine Beilage. First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/cyberangriffe/evasive-panda-aendert-das-dns-statt-updates-laedt-man-malware-324673.html
-
Cybersicherheitstrends 2026: Welche Angriffe ohne Malware zunehmen
Da Malware-freie Angriffe mittlerweile den Großteil der kriminellen Aktivitäten ausmachen, steht außer Frage, dass die Trends in der gesamten Landschaft dazu geführt haben, dass sich diese Bedrohungen ausbreiten konnten. Für 2026 erwartet Zero Networks eine weitere Zunahme der Angriffe ohne Malware. Dazu gehören insbesondere: Maschinenidentitäten schaffen Sicherheitslücken Maschinenidentitäten wie Dienstkonten, die bekanntermaßen überprivilegiert und… First…
-
Cybersicherheitstrends 2026: Welche Angriffe ohne Malware zunehmen
Da Malware-freie Angriffe mittlerweile den Großteil der kriminellen Aktivitäten ausmachen, steht außer Frage, dass die Trends in der gesamten Landschaft dazu geführt haben, dass sich diese Bedrohungen ausbreiten konnten. Für 2026 erwartet Zero Networks eine weitere Zunahme der Angriffe ohne Malware. Dazu gehören insbesondere: Maschinenidentitäten schaffen Sicherheitslücken Maschinenidentitäten wie Dienstkonten, die bekanntermaßen überprivilegiert und… First…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 77
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan From Linear to Complex: An Upgrade in RansomHouse Encryption Prince of Persia: A Decade of Iranian Nation-State APT Campaign…
-
Zero Network erwartet weitere Zunahme von Angriffen ohne Malware
Da Malware-freie Angriffe mittlerweile den Großteil der kriminellen Aktivitäten ausmachen, steht außer Frage, dass die Trends in der gesamten Landschaft dazu geführt haben, dass sich diese Bedrohungen ausbreiten konnten. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/zero-network-erwartet-weitere-zunahme-von-angriffen-ohne-malware/a43265/
-
MAS: Malware durch Rechtschreibfehler bei Windows-Hack
Über die Microsoft Activation Scripts (MAS) lässt sich Windows ohne Lizenz aktivieren. Ein Tippfehler bei der Domain liefert allerdings Schadsoftware. First seen on golem.de Jump to article: www.golem.de/news/mas-malware-durch-rechtschreibfehler-bei-windows-hack-2512-203619.html
-
Best of 2025: New Akira Ransomware Decryptor Leans on Nvidia GPU Power
A software programmer developed a way to use brute force to break the encryption of the notorious Akira ransomware using GPU compute power and enabling some victims of the Linux-focused variant of the malware to regain their encrypted data without having to pay a ransom. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/12/new-akira-ransomware-decryptor-leans-on-nvidia-gpu-power-2/
-
Fake MAS Windows activation domain used to spread PowerShell malware
A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the ‘Cosmali Loader’. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-mas-windows-activation-domain-used-to-spread-powershell-malware/
-
Evasive Panda APT: Malware Delivery via AitM and DNS Poisoning
Evasive Panda, a sophisticated threat actor known by the aliases Bronze Highland, Daggerfly, and StormBamboo, has escalated its offensive capabilities through a two-year campaign that has deployed advanced attack techniques,, including adversary-in-the-middle (AitM) attacks and DNS poisoning. According to June 2025 research, the group maintained persistent operations between November 2022 and November 2024, targeting victims…
-
NtKiller Malware Advertised on Dark Web With Claims of Antivirus and EDR Bypass
A new and sophisticated defensive evasion tool dubbed >>NtKillerAlphaGhoul.
-
Webrat turns GitHub PoCs into a malware trap
The malicious payload and behavior: Beneath the polished README, the attackers dumped a password-protected ZIP linked in the repository. The archive password was hidden in file names, something easily missable by unsuspecting eyes. Inside, the key components include a decoy DLL, a batch file to launch the malware, and the primary executable (like rasmanesc.exe) capable…
-
Interpol sweep takes down cybercrooks in 19 countries
Tags: access, antivirus, attack, botnet, business, china, cyber, cyberattack, cybercrime, cybersecurity, data, defense, email, encryption, finance, fraud, group, incident response, infrastructure, intelligence, international, interpol, law, malicious, malware, microsoft, ransomware, russia, scam, service, theft, threatA ‘very good thing’: The fact that the same operation broke ransomware operations and a business email compromise (BEC) operation is “unique,” said DiMaggio, because most people think of Africa as the source of BEC and fraud scams.The fact that authorities are working to disrupt ransomware operations in Africa before they grow to the size…