Tag: malware
-
The 2026 Infostealer Intelligence Shortlist: Top 10 Vendors Security Teams Should Know
Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal’s kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright. First seen on thecyberexpress.com Jump to…
-
Cisco Warns of Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks
Cisco has warned that attackers are actively exploiting a zero-day flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. An unauthenticated remote attacker can use it to write arbitrary files and run commands as root on the underlying operating system. The advisory, cisco-sa-esa-afw-zqYJkjxp, says Cisco PSIRT learned of active exploitation in…
-
Fake CAPTCHAs are tricking users into running malware on their own devices
Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/15/barracuda-fake-captcha-phishing-attacks/
-
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
PEERSTITCH, a memory-resident ARM64 implant deployed against FortiGate firewalls during a prolonged intrusion into a telecommunications managed service provider. The malware hijacks legitimate FortiOS processes, leaving no persistent executable, opening no listening ports, and initiating no outbound connections of its own. Published October 14, the investigation tracks the activity as CL-STA-0954, also known as UNC5820.…
-
New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access
A ClickFix campaign uses the Lorem Ipsum Loader to install a Python-based tunneling implant, giving attackers a covert route into victims’ networks and potentially laying the groundwork for ransomware deployment. In an incident investigated in late September, defenders contained the intrusion before ransomware was deployed; the tunnel’s remote-access capability nevertheless made the compromised host a…
-
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets. Similar attacks First seen on…
-
KGB RAT Uses FUD Crypter to Evade Windows Defender and Spy on Victims
KGB RAT, a Windows remote access trojan marketed as legitimate administration software, combines surveillance, credential theft, and configurable malicious functions with a built-in crypter advertised to evade Windows Defender. Researchers identified unobfuscated payloads, obfuscated variants, and encrypted loaders that reconstruct malware during execution. This distinction matters: the crypter conceals the underlying payload, while the deployed…
-
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance’s operating system, Cisco said in an advisory on Wednesday.The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance…
-
ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads
Tags: malwarege-item”> ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/romulus-malware-clickfix-deliver/
-
Hirudo Android malware replaces banking apps to evade security checks
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/
-
How a leaked builder of XWorm turned a remote access trojan into a surveillance kit
Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold. Netskope Threat Labs has been following XWorm since September 2024, and its latest report shows the malware has changed a lot. Over the past year the team identified four distinct versions…
-
New macOS Malware Uses Fake System Prompts to Steal Passwords and Deploy RAT
A newly marketed macOS malware-as-a-service platform, ICMacOS, is using fake Apple system dialogs to steal login passwords before deploying an information stealer that has evolved into a persistent remote-access trojan (RAT). The operator markets the toolkit across cybercrime forums and Telegram as part of a broader “ICARUS” criminal suite that also includes a ClickFix delivery…
-
Fake Web3 Accelerator Offers Claude and Gemini Credits to Spread Malware
A sophisticated campaign in which threat actors posed as a Web3 venture-capital accelerator to target cryptocurrency start-ups, developers and founders with free Claude and Gemini credits, AI coding tools and smart-contract security audits. It claimed to support more than 200 portfolio projects and to have raised over $124 million, while promoting founder assessments, security audits,…
-
New macOS Malware Clones Chrome Profiles and Browses With Victims’ Live Logins
A newly reported macOS implant tracked as GhostProfile clones browser profiles and remotely operates concealed copies of Chrome or Firefox, allowing attackers to browse using victims’ authenticated sessions. The researchers described it as a hidden-VNC implant that does not mirror the victim’s screen. Instead of exposing the desktop, GhostProfile reportedly creates a disposable browser-profile clone…
-
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa.The preinstalled First seen…
-
Kimsuky Uses Fake Zoom Installers and Malicious LNK Files to Deploy Malware
Tags: cyber, espionage, group, international, korea, malicious, malware, north-korea, phishing, powershell, spear-phishing, ukraine, windowsNorth Korea-linked cyber espionage group Kimsuky has expanded its Operation GitPower campaign by using fake Zoom installers and malicious Windows shortcut files to target Ukrainian experts working in diplomacy, security, and international policy. Researchers at Genians Security Center found that the campaign combines reply-baiting spear phishing, PDF-themed LNK files, public code-hosting platforms, hidden PowerShell execution,…
-
âš¡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That’s not much time to read the warning, let alone do something about it.But speed is only part of the problem. A secure connection didn’t always mean a safe destination.…
-
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/
-
Nippon Columbia Malware Infection Puts 8.72 Million Daiichikosho Customer Records at Risk
Japanese karaoke operator Daiichi Kosho has issued a warning about a malware infection at its outsourcing partner, Nippon Columbia Group (NCG), that may have exposed about 8.72 million personal records. This potential data exposure includes both customer and employee information, not just customer records. As of now, neither data theft nor misuse has been confirmed,…
-
Low-cost Android phones are arriving with malware that owners can’t uninstall
People who buy low-cost Android phones from online marketplaces may be carrying malware that was placed on the device before it reached them, Bitdefender has found. The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/12/midnight-mimosa-malware-cheap-android-phones/
-
WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM
A WhatsApp-delivered financial-document lure is being used to deploy a sophisticated Windows malware chain that injects code into the Task Scheduler service and executes subsequent payloads with LocalSystem privileges. The executable acts as an NRV2E-compressed wrapper that reconstructs its malicious loader entirely in memory, limiting obvious artifacts on disk and obscuring imports, strings, and control-flow…
-
Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
Midnight Mimosa, an Android malware campaign embedded in firmware that monetizes compromised smartphones through advertising fraud and residential proxy services. Disclosed on October 8, the operation affected thousands of devices across more than 150 countries over roughly two years, predominantly inexpensive phones built on MediaTek platforms. Unlike malware requiring a malicious download, Midnight Mimosa arrives…
-
Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites
A Casbaneiro banking trojan campaign in August 2026 that targeted Latin American users via phishing emails and malicious PDFs disguised as invoices and legal notices. Its defining feature is conditional command-and-control activation: the malware initiates banking-related C2 communication only when victims visit targeted financial websites, making infected systems appear inactive during automated analysis. That restriction…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 118
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER MALFEX A malicious npm postinstall no advisory has caught for fourteen months Canto incognito: tracking the PoeLLM malware […]…
-
Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countries
Bitdefender finds Midnight Mimosa, preinstalled Android malware on cheap MediaTek phones that fakes ad clicks, drops apps and builds a proxy botnet. Bitdefender researchers discovered a campaign called Midnight Mimosa involving preinstalled Android malware on low-cost phones from different brands that use MediaTek platforms. The malware is built into the device firmware and may be…
-
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nippon-columbia-malware-incident-exposes-86-million-karaoke-fan-records/
-
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer, a C# information stealer first publicly identified in April 2026, has expanded its capabilities beyond credential theft. New samples analyzed by Flashpoint bypass Chromium app-bound encryption, support remote command execution, and transmit stolen data through small, encrypted TCP exchanges instead of uploading a single archive. Flashpoint has not observed widespread adoption among threat actors.…
-
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
A campaign in July 2026 using a trojanized Terraform provider to deploy cross-platform malware against developer environments. The operation delivers FLATROOF for credential theft and initial access, followed by ROOFDECK for broader remote control. Attribution remains provisional. ThreatLabz found similarities in targeting, tooling, and tactics but lacked unique code matches, shared infrastructure, or cryptographic evidence…