Tag: malware
-
ClipXDaemon Malware, a Stealthy Cryptocurrency Clipboard Hijacker on Linux
Security researchers have identified a new Linux malware strain called ClipXDaemon, a stealthy threat designed to target cryptocurrency users by manipulating copied wallet addresses. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/clipxdaemon-linux-malware/
-
ClipXDaemon Malware, a Stealthy Cryptocurrency Clipboard Hijacker on Linux
Security researchers have identified a new Linux malware strain called ClipXDaemon, a stealthy threat designed to target cryptocurrency users by manipulating copied wallet addresses. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/clipxdaemon-linux-malware/
-
Critical ExifTool Vulnerability Allows Malicious Images to Execute Code on macOS
Many users believe macOS is inherently resistant to malware, but a newly discovered vulnerability proves otherwise. Kaspersky’s Global Research and Analysis Team (GReAT) recently uncovered a critical flaw, tracked as CVE-2026-3102, within ExifTool. ExifTool is a widely popular open-source application and library for extracting and editing file metadata. If a macOS user processes a specially…
-
Transparent Tribe’s ‘Vibeware’ Move Points to AI-Made Malware at Scale
Transparent Tribe (APT36) is moving from traditional, off”‘the”‘shelf tools to an AI-assisted malware model researchers now call “vibeware,” signaling how large language models are starting to industrialize mediocre but relentless attacks at scale.”‹ In its latest campaigns against Indian government bodies, embassies and regional targets, the group has shifted to an AI-driven development pipeline that…
-
Massive GitHub malware operation spreads BoryptGrab stealer
Trend Micro found BoryptGrab stealer spreading through 100+ GitHub repositories, stealing browser data, crypto wallets, system information, and user files. Trend Micro uncovered a campaign distributing the BoryptGrab information stealer through more than 100 GitHub repositories. BoryptGrab is designed to collect browser and cryptocurrency wallet data, system details, and common files. Some variants also deploy…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 87
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Malware Reverse Engineering is no longer a human problem! StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer Inside a fake Google security check that becomes a browser RAT SloppyLemming…
-
Week in review: Weaponized OAuth redirection logic delivers malware, Patch Tuesday forecast
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: BlacksmithAI: Open-source AI-powered penetration testing framework … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/08/week-in-review-weaponized-oauth-redirection-logic-delivers-malware-patch-tuesday-forecast/
-
Termite ransomware breaches linked to ClickFix CastleRAT attacks
Ransomware threat actors tracked as Velvet Tempest are using the ClickFix technique and legitimate Windows utilities to deploy the DonutLoader malware and the CastleRAT backdoor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/termite-ransomware-breaches-linked-to-clickfix-castlerat-attacks/
-
Vibeware: Wie gut ist Vibe-Code-Malware?
Tags: malwareEmojis im Quellcode sind kein Qualitätsmerkmal. Bei der Hackergruppe APT36 sind sie es trotzdem, als unfreiwilliger Beweis dafür, dass hier kein Mensch, sondern ein Sprachmodell die Finger im Spiel hatte. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/vibeware-vibe-code-malware
-
The Chrome Extension Backdoor: How ‘Productivity Tools’ Became Enterprise Attack Vectors
Millions installed ‘productivity’ Chrome extensions that became malware after acquisition. Here’s how browser extensions became enterprise security’s weakest link. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/the-chrome-extension-backdoor-how-productivity-tools-became-enterprise-attack-vectors/
-
ClickFix attackers using new tactic to evade detection, says Microsoft
AppData\Local that is then invoked through cmd.exe to write a VBScript to %Temp%. The batch script is executed via cmd.exe with the /launched command-line argument, and is then executed again through MSBuild.exe, resulting in LOLBin abuse. The script connects to Crypto Blockchain RPC endpoints, indicating etherhiding technique, and also performs QueueUserAPC()-based code injection into chrome.exe…
-
China-Linked Hackers Use Malware Trio for Telecom Espionage
Tags: access, china, cisco, communications, cyberespionage, espionage, group, hacker, infrastructure, malware, tool, usaResearchers Tie UAT-9244 Intrusion to Famous Sparrow and Tropic Trooper. A China-linked cyberespionage group has been targeting telecommunications providers in South America since 2024 using a set of newly discovered malware tools designed to maintain persistent access to critical communications infrastructure, Cisco Talos researchers found. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/china-linked-hackers-use-malware-trio-for-telecom-espionage-a-30940
-
Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations
Iran-linked APT MuddyWater targeted U.S. organizations, deploying the new Dindoor backdoor across sectors including banks, airports, and nonprofits. Broadcom’s Symantec Threat Hunter Team uncovered a campaign by the Iran-linked MuddyWater (aka SeedWorm, TEMP.Zagros, Mango Sandstorm, TA450, and Static Kitten) APT group targeting several U.S. organizations. >>Activity associated with Iranian APT group Seedworm has been spotted on the networks of multiple…
-
Transparent Tribe Uses AI to Mass-Produce Malware Implants in Campaign Targeting India
The Pakistan-aligned threat actor known as Transparent Tribe has become the latest hacking group to embrace artificial intelligence (AI)-powered coding tools to strike targets with various implants.The activity is designed to produce a “high-volume, mediocre mass of implants” that are developed using lesser-known programming languages like Nim, Zig, and Crystal and rely on trusted services…
-
Multi-Stage VOID#GEIST Malware Delivering XWorm, AsyncRAT, and Xeno RAT
Cybersecurity researchers have disclosed details of a multi-stage malware campaign that uses batch scripts as a pathway to deliver various encrypted remote access trojan (RATs) payloads that correspond to XWorm, AsyncRAT, and Xeno RAT.The stealthy attack chain has been codenamed VOID#GEIST by Securonix Threat Research.At a high level, the obfuscated batch script is used to…
-
Iran-nexus APT Dust Specter targets Iraq officials with new malware
A campaign by Iran-linked group Dust Specter is targeting Iraqi officials with phishing emails delivering new malware families. Zscaler ThreatLabz researchers linked the Iran-nexus group Dust Specter to a campaign targeting Iraqi government officials. Threat actors impersonated the country’s Ministry of Foreign Affairs in phishing messages that delivered previously unseen malware, including SPLITDROP, TWINTASK, TWINTALK,…
-
Teenage hacker myth primed for a middle-age criminal makeover
Tags: access, breach, business, corporate, crypto, cyber, cybercrime, cybersecurity, data, detection, extortion, finance, group, hacker, hacking, infrastructure, jobs, malware, network, penetration-testing, programming, ransomware, service, skills, software, technology, threat, vulnerabilityCybercrime cartels: Dray Agha, senior security operations manager at managed detection and response services firm Huntress, said the analysis illustrates that the “Hollywood image of a teenage lone wolf hacking for bragging rights” is vastly outdated since the threat landscape is dominated by “highly organised, profit-driven syndicates.””While young people may still engage in digital vandalism…
-
China-Nexus Hackers Target Telecommunication Providers with New Malware Attack
A highly sophisticated China-linked threat actor, identified as UAT-9244, has been actively targeting critical telecommunications infrastructure across South America since 2024. Security researchers assess with high confidence that UAT-9244 exhibits close operational overlap with known espionage groups such as FamousSparrow and Tropic Trooper. To maintain a strong foothold in victim networks, the hackers deploy a…
-
Whitelisting im Unternehmen: Wie Allow-Listing Zero-Day-Angriffe stoppt und die Angriffsfläche reduziert
Unternehmen stehen heute vor einer Sicherheitslage, in der klassische Abwehrmechanismen allein nicht mehr ausreichen. Malware, Ransomware, Schatten-IT, komplexe Multi-Cloud-Architekturen und strenge Datenschutzvorgaben treffen auf eine Arbeitswelt, die von Dynamik und Flexibilität geprägt ist. In diesem Spannungsfeld gewinnt ein Sicherheitsprinzip zunehmend an Bedeutung, das zwar traditionell wirkt aber gerade deshalb enorme Stärke entfaltet: konsequentes Whitelisting. First…
-
Raubkopien öffnen Tür für Malware
Mehrere aktuelle Vorfälle zeigen, dass das Risiko nicht nur von außen kommt: Das Sicherheitsteam von Barracuda Managed XDR hat im vergangenen Monat wiederholt Versuche registriert, bei denen Mitarbeitende raubkopierte oder manipulierte Software auf ihren Dienstgeräten installieren wollten. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/raubkopien-oeffnen-tuer-fuer-malware
-
Whitelisting im Unternehmen: Wie konsequentes Allow-Listing Zero-Day-Angriffe stoppt und die Angriffsfläche dauerhaft reduziert Kontrolle statt reaktiver Abwehr
Unternehmen stehen heute vor einer Sicherheitslage, in der klassische Abwehrmechanismen allein nicht mehr ausreichen. Malware, Ransomware, Schatten-IT, komplexe Multi-Cloud-Architekturen und strenge Datenschutzvorgaben treffen auf eine Arbeitswelt, die von Dynamik und Flexibilität geprägt ist. In diesem Spannungsfeld gewinnt ein Sicherheitsprinzip zunehmend an Bedeutung, das zwar traditionell wirkt aber gerade deshalb enorme Stärke entfaltet: konsequentes Whitelisting. First…
-
Europa im Visier von Cyber-Identitätsdieben
Deutsche Unternehmen müssen sich warm anziehen: Sowohl staatliche als auch ‘private” Akteure haben es auf sie abgesehen.ShutterstockWie die Experten von Darktrace in ihrem aktuellen Threat Report 2026 darstellen, bleiben Cloud- und E-Mail-Konten das Einfallstor Nummer Eins in Europa. Dem Bericht zufolge begannen im vergangenen Jahr in Europa 58 Prozent der Attacken mit kompromittierten Cloud-Accounts oder…
-
Chinese state hackers target telcos with new malware toolkit
A China-linked advanced persistent threat actor tracked as UAT-9244 has been targeting telecommunication service providers in South America since 2024, compromising Windows, Linux, and network-edge devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-state-hackers-target-telcos-with-new-malware-toolkit/
-
Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware
Fake OpenClaw installers hosted in GitHub repositories and promoted by Microsoft Bing’s AI-enhanced search feature instructed users to run commands that deployed information stealers and proxy malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/
-
Nation-State Actor Embraces AI Malware Assembly Line
Pakistan’s APT36 threat group has begun using vibe-coding to churn out mediocre malware, but at a scale that could overwhelm defenses. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/nation-state-actor-ai-malware-assembly-line
-
New Jersey county says malware attack took down phone lines, IT systems
Passaic County, home to nearly 600,000 people in Northern New Jersey, published a statement on Wednesday evening warning residents that it is aware of a “malware attack” affecting county IT systems and phone lines. First seen on therecord.media Jump to article: therecord.media/new-jersey-county-says-malware-attack-took-down-phones
-
Latest OpenClaw Security Risk: Fake GitHub Repositories Used to Deploy Infostealers
Huntress researchers said actors used a malicious repository on GitHub to lure victims into downloading a bogus OpenClaw installer that delivered infostealer malware and the GhostSocks proxy. The fake installer was given greater legitimacy by being hosted on GitHub and its high ranking in Bing AI searches. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/latest-openclaw-security-risk-fake-github-repositories-used-to-deploy-infostealers/
-
Russian APT targets Ukraine with BadPaw and MeowMeow malware
Researchers uncovered a Russian campaign targeting Ukrainian entities with new malware families BadPaw and MeowMeow delivered through phishing emails. Researchers reported a phishing campaign linked to Russia that targets Ukrainian organizations using two new malware families, BadPaw and MeowMeow. The attack chain begins with a phishing email carrying a link to a ZIP archive. When…
-
Nation-State Hackers Play the Vibes
Who Knew APT Hackers Liked Emojis So Much?. All the nation-state hackers are vibe coding. Vibeware won’t win any coding awards. It’s not pretty. It doesn’t target any zero-day vulnerabilities or known flaws in innovative new ways – but it does allow polyglot malware to be generated at scale. First seen on govinfosecurity.com Jump to…