Tag: malware
-
Fake Claude Code install pages highlight rise of >>InstallFix<< attacks
Users looking for Anthropic’s Claude Code agentic AI coding tool are being tricked via fake Claude Code install pages into running malware, Push Security researchers … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/09/fake-claude-code-install-pages-installfix-attacks/
-
Fake Claude Code install pages highlight rise of >>InstallFix<< attacks
Users looking for Anthropic’s Claude Code agentic AI coding tool are being tricked via fake Claude Code install pages into running malware, Push Security researchers … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/09/fake-claude-code-install-pages-installfix-attacks/
-
MaaS VIP Keylogger Campaign Uses Steganography to Steal Credentials at Scale
A large-scale spear-phishing campaign distributing aVIP Keyloggervariant sold as Malware-as-a-Service (MaaS). The campaign employs steganography, in-memory execution, and modular payload design to evade defenses while harvesting credentials across browsers, email clients, and collaboration tools. Researchers observed fraudulent purchase-order emails that encouraged victims to open an attached RAR file. The compressed archive contained an executable disguised…
-
ClipXDaemon Malware Targets Crypto Users in Linux X11 Sessions
ClipXDaemon is a new Linux malware family that hijacks cryptocurrency clipboard data in X11 sessions, operating fully offline without any command”‘and”‘control (C2) infrastructure. It reuses a ShadowHS-style loader built with the public bincrypter framework but delivers a completely different, autonomous financial payload. ShadowHS used an obfuscated shell loader to deploy an in”‘memory hackshell for long”‘term…
-
Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft
Two Google Chrome extensions have turned malicious after what appears to be a case of ownership transfer, offering attackers a way to push malware to downstream customers, inject arbitrary code, and harvest sensitive data.The extensions in question, both originally associated with a developer named “akshayanuonline@gmail.com” (BuildMelon), are listed below -QuickLens – Search Screen with First…
-
ClipXDaemon Malware, a Stealthy Cryptocurrency Clipboard Hijacker on Linux
Security researchers have identified a new Linux malware strain called ClipXDaemon, a stealthy threat designed to target cryptocurrency users by manipulating copied wallet addresses. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/clipxdaemon-linux-malware/
-
ClipXDaemon Malware, a Stealthy Cryptocurrency Clipboard Hijacker on Linux
Security researchers have identified a new Linux malware strain called ClipXDaemon, a stealthy threat designed to target cryptocurrency users by manipulating copied wallet addresses. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/clipxdaemon-linux-malware/
-
Critical ExifTool Vulnerability Allows Malicious Images to Execute Code on macOS
Many users believe macOS is inherently resistant to malware, but a newly discovered vulnerability proves otherwise. Kaspersky’s Global Research and Analysis Team (GReAT) recently uncovered a critical flaw, tracked as CVE-2026-3102, within ExifTool. ExifTool is a widely popular open-source application and library for extracting and editing file metadata. If a macOS user processes a specially…
-
Transparent Tribe’s ‘Vibeware’ Move Points to AI-Made Malware at Scale
Transparent Tribe (APT36) is moving from traditional, off”‘the”‘shelf tools to an AI-assisted malware model researchers now call “vibeware,” signaling how large language models are starting to industrialize mediocre but relentless attacks at scale.”‹ In its latest campaigns against Indian government bodies, embassies and regional targets, the group has shifted to an AI-driven development pipeline that…
-
Massive GitHub malware operation spreads BoryptGrab stealer
Trend Micro found BoryptGrab stealer spreading through 100+ GitHub repositories, stealing browser data, crypto wallets, system information, and user files. Trend Micro uncovered a campaign distributing the BoryptGrab information stealer through more than 100 GitHub repositories. BoryptGrab is designed to collect browser and cryptocurrency wallet data, system details, and common files. Some variants also deploy…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 87
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Malware Reverse Engineering is no longer a human problem! StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer Inside a fake Google security check that becomes a browser RAT SloppyLemming…
-
Week in review: Weaponized OAuth redirection logic delivers malware, Patch Tuesday forecast
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: BlacksmithAI: Open-source AI-powered penetration testing framework … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/08/week-in-review-weaponized-oauth-redirection-logic-delivers-malware-patch-tuesday-forecast/
-
Termite ransomware breaches linked to ClickFix CastleRAT attacks
Ransomware threat actors tracked as Velvet Tempest are using the ClickFix technique and legitimate Windows utilities to deploy the DonutLoader malware and the CastleRAT backdoor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/termite-ransomware-breaches-linked-to-clickfix-castlerat-attacks/
-
Vibeware: Wie gut ist Vibe-Code-Malware?
Tags: malwareEmojis im Quellcode sind kein Qualitätsmerkmal. Bei der Hackergruppe APT36 sind sie es trotzdem, als unfreiwilliger Beweis dafür, dass hier kein Mensch, sondern ein Sprachmodell die Finger im Spiel hatte. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/vibeware-vibe-code-malware
-
The Chrome Extension Backdoor: How ‘Productivity Tools’ Became Enterprise Attack Vectors
Millions installed ‘productivity’ Chrome extensions that became malware after acquisition. Here’s how browser extensions became enterprise security’s weakest link. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/the-chrome-extension-backdoor-how-productivity-tools-became-enterprise-attack-vectors/
-
ClickFix attackers using new tactic to evade detection, says Microsoft
AppData\Local that is then invoked through cmd.exe to write a VBScript to %Temp%. The batch script is executed via cmd.exe with the /launched command-line argument, and is then executed again through MSBuild.exe, resulting in LOLBin abuse. The script connects to Crypto Blockchain RPC endpoints, indicating etherhiding technique, and also performs QueueUserAPC()-based code injection into chrome.exe…
-
China-Linked Hackers Use Malware Trio for Telecom Espionage
Tags: access, china, cisco, communications, cyberespionage, espionage, group, hacker, infrastructure, malware, tool, usaResearchers Tie UAT-9244 Intrusion to Famous Sparrow and Tropic Trooper. A China-linked cyberespionage group has been targeting telecommunications providers in South America since 2024 using a set of newly discovered malware tools designed to maintain persistent access to critical communications infrastructure, Cisco Talos researchers found. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/china-linked-hackers-use-malware-trio-for-telecom-espionage-a-30940
-
Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations
Iran-linked APT MuddyWater targeted U.S. organizations, deploying the new Dindoor backdoor across sectors including banks, airports, and nonprofits. Broadcom’s Symantec Threat Hunter Team uncovered a campaign by the Iran-linked MuddyWater (aka SeedWorm, TEMP.Zagros, Mango Sandstorm, TA450, and Static Kitten) APT group targeting several U.S. organizations. >>Activity associated with Iranian APT group Seedworm has been spotted on the networks of multiple…
-
Transparent Tribe Uses AI to Mass-Produce Malware Implants in Campaign Targeting India
The Pakistan-aligned threat actor known as Transparent Tribe has become the latest hacking group to embrace artificial intelligence (AI)-powered coding tools to strike targets with various implants.The activity is designed to produce a “high-volume, mediocre mass of implants” that are developed using lesser-known programming languages like Nim, Zig, and Crystal and rely on trusted services…
-
Multi-Stage VOID#GEIST Malware Delivering XWorm, AsyncRAT, and Xeno RAT
Cybersecurity researchers have disclosed details of a multi-stage malware campaign that uses batch scripts as a pathway to deliver various encrypted remote access trojan (RATs) payloads that correspond to XWorm, AsyncRAT, and Xeno RAT.The stealthy attack chain has been codenamed VOID#GEIST by Securonix Threat Research.At a high level, the obfuscated batch script is used to…
-
Iran-nexus APT Dust Specter targets Iraq officials with new malware
A campaign by Iran-linked group Dust Specter is targeting Iraqi officials with phishing emails delivering new malware families. Zscaler ThreatLabz researchers linked the Iran-nexus group Dust Specter to a campaign targeting Iraqi government officials. Threat actors impersonated the country’s Ministry of Foreign Affairs in phishing messages that delivered previously unseen malware, including SPLITDROP, TWINTASK, TWINTALK,…
-
Teenage hacker myth primed for a middle-age criminal makeover
Tags: access, breach, business, corporate, crypto, cyber, cybercrime, cybersecurity, data, detection, extortion, finance, group, hacker, hacking, infrastructure, jobs, malware, network, penetration-testing, programming, ransomware, service, skills, software, technology, threat, vulnerabilityCybercrime cartels: Dray Agha, senior security operations manager at managed detection and response services firm Huntress, said the analysis illustrates that the “Hollywood image of a teenage lone wolf hacking for bragging rights” is vastly outdated since the threat landscape is dominated by “highly organised, profit-driven syndicates.””While young people may still engage in digital vandalism…
-
China-Nexus Hackers Target Telecommunication Providers with New Malware Attack
A highly sophisticated China-linked threat actor, identified as UAT-9244, has been actively targeting critical telecommunications infrastructure across South America since 2024. Security researchers assess with high confidence that UAT-9244 exhibits close operational overlap with known espionage groups such as FamousSparrow and Tropic Trooper. To maintain a strong foothold in victim networks, the hackers deploy a…
-
Whitelisting im Unternehmen: Wie Allow-Listing Zero-Day-Angriffe stoppt und die Angriffsfläche reduziert
Unternehmen stehen heute vor einer Sicherheitslage, in der klassische Abwehrmechanismen allein nicht mehr ausreichen. Malware, Ransomware, Schatten-IT, komplexe Multi-Cloud-Architekturen und strenge Datenschutzvorgaben treffen auf eine Arbeitswelt, die von Dynamik und Flexibilität geprägt ist. In diesem Spannungsfeld gewinnt ein Sicherheitsprinzip zunehmend an Bedeutung, das zwar traditionell wirkt aber gerade deshalb enorme Stärke entfaltet: konsequentes Whitelisting. First…
-
Raubkopien öffnen Tür für Malware
Mehrere aktuelle Vorfälle zeigen, dass das Risiko nicht nur von außen kommt: Das Sicherheitsteam von Barracuda Managed XDR hat im vergangenen Monat wiederholt Versuche registriert, bei denen Mitarbeitende raubkopierte oder manipulierte Software auf ihren Dienstgeräten installieren wollten. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/raubkopien-oeffnen-tuer-fuer-malware
-
Whitelisting im Unternehmen: Wie konsequentes Allow-Listing Zero-Day-Angriffe stoppt und die Angriffsfläche dauerhaft reduziert Kontrolle statt reaktiver Abwehr
Unternehmen stehen heute vor einer Sicherheitslage, in der klassische Abwehrmechanismen allein nicht mehr ausreichen. Malware, Ransomware, Schatten-IT, komplexe Multi-Cloud-Architekturen und strenge Datenschutzvorgaben treffen auf eine Arbeitswelt, die von Dynamik und Flexibilität geprägt ist. In diesem Spannungsfeld gewinnt ein Sicherheitsprinzip zunehmend an Bedeutung, das zwar traditionell wirkt aber gerade deshalb enorme Stärke entfaltet: konsequentes Whitelisting. First…
-
Europa im Visier von Cyber-Identitätsdieben
Deutsche Unternehmen müssen sich warm anziehen: Sowohl staatliche als auch ‘private” Akteure haben es auf sie abgesehen.ShutterstockWie die Experten von Darktrace in ihrem aktuellen Threat Report 2026 darstellen, bleiben Cloud- und E-Mail-Konten das Einfallstor Nummer Eins in Europa. Dem Bericht zufolge begannen im vergangenen Jahr in Europa 58 Prozent der Attacken mit kompromittierten Cloud-Accounts oder…
-
Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware
Fake OpenClaw installers hosted in GitHub repositories and promoted by Microsoft Bing’s AI-enhanced search feature instructed users to run commands that deployed information stealers and proxy malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/