Tag: malware
-
Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data
Warden Stealer as a rapidly growing malware-as-a-service operation targeting data stored by AI assistants and coding agents, including Claude, Codex, Grok, and Cursor. The Rust-based infostealer is among the first malware families observed systematically harvesting AI-agent configuration files, local tokens, prompt histories, conversation databases, and Model Context Protocol (MCP) settings. The campaign signals a significant…
-
MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2
MATCHBOIL’s evolution from a basic C# downloader into a more evasive implant supporting recurring command-and-control communication. Operated by UAC-0099, the malware now incorporates sandbox checks, commercial .NET obfuscation, deceptive interfaces, and revised persistence mechanisms, reflecting sustained development across samples spanning April 2024 through April 2026. Compilation timestamps suggest earlier development, although timestamps alone do not…
-
What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special >>magic packet<< before it acts. In … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
-
What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special >>magic packet<< before it acts. In … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
-
What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special >>magic packet<< before it acts. In … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/christiaan-beek-rapid7-bpfdoor-backdoor/
-
FBI Seizes Domains Used in Flax Typhoon Attacks
US Authorities Say Infrastructure Supported Scanning, Phishing and Data Theft. The FBI seized seven domains allegedly used by China-linked hackers to scan critical infrastructure, deliver malware and steal files. A joint advisory urges organizations to hunt for lingering access. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/fbi-seizes-domains-used-in-flax-typhoon-attacks-a-33049
-
FBI Seizes Domains Used in Flax Typhoon Attacks
US Authorities Say Infrastructure Supported Scanning, Phishing and Data Theft. The FBI seized seven domains allegedly used by China-linked hackers to scan critical infrastructure, deliver malware and steal files. A joint advisory urges organizations to hunt for lingering access. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/fbi-seizes-domains-used-in-flax-typhoon-attacks-a-33049
-
FBI Seizes Domains Used in Flax Typhoon Attacks
US Authorities Say Infrastructure Supported Scanning, Phishing and Data Theft. The FBI seized seven domains allegedly used by China-linked hackers to scan critical infrastructure, deliver malware and steal files. A joint advisory urges organizations to hunt for lingering access. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/fbi-seizes-domains-used-in-flax-typhoon-attacks-a-33049
-
FBI Seizes Domains Used in Flax Typhoon Attacks
US Authorities Say Infrastructure Supported Scanning, Phishing and Data Theft. The FBI seized seven domains allegedly used by China-linked hackers to scan critical infrastructure, deliver malware and steal files. A joint advisory urges organizations to hunt for lingering access. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/fbi-seizes-domains-used-in-flax-typhoon-attacks-a-33049
-
Low-cost Android phones ship with residential proxy malware
A malware campaign dubbed ‘Midnight Mimosa’ has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/low-cost-android-phones-ship-with-residential-proxy-malware/
-
Venezuelan Cartel’s Malware Honcho Nabbed for ATM Jackpotting
The first cybercriminal to ever make the FBI’s 10 Most Wanted Fugitives list allegedly infused Tren de Aragua’s violent criminal operations with cash. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/venezuelan-cartel-malware-honcho-nabbed-atm-jackpotting
-
Russian Spies Give ‘MatchBoil’ Malware a Stealthy Facelift
Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/russian-spies-matchboil-malware-facelift
-
FakeGit malware campaign returns with 17,610 malicious GitHub repos
More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/
-
Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones
Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on. First seen on hackread.com Jump to article: hackread.com/midnight-mimosa-malware-preinstalled-android-phones/
-
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN.According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company is tracking the cluster under the name Earth Sirrush (previously SHADOW-EARTH-065).ASHVEIN, First seen on…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
Thousands of cheap Android phones shipped with ad-fraud malware
“It’s on the phone before the owner switches it on for the first time, and it can’t be uninstalled,” researchers at Bitdefender said about ad fraud malware found on thousands of cheap Android devices. First seen on therecord.media Jump to article: therecord.media/cheap-androids-shipped-with-ad-fraud-malware
-
Thousands of cheap Android phones shipped with ad-fraud malware
“It’s on the phone before the owner switches it on for the first time, and it can’t be uninstalled,” researchers at Bitdefender said about ad fraud malware found on thousands of cheap Android devices. First seen on therecord.media Jump to article: therecord.media/cheap-androids-shipped-with-ad-fraud-malware
-
Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
Russian-aligned hackers have targeted Ukrainian transportation, manufacturing and energy companies with a constantly evolving malware strain designed to harvest system data, according to new research. First seen on therecord.media Jump to article: therecord.media/russia-ukraine-malware-transportation
-
Angebliche Premium-Smartphones entpuppen sich als Malware-infizierte Niedrigpreisangebote
Mit kostengünstigen Smartphones laufen Nutzer Gefahr, sich vorinstallierte Malware einzukaufen. Davor warnen die Experten der Bitdefender Labs in einer aktuellen Studie. Im Rahmen der Kampagne ‘Midnight Mimosa” vertreiben Hacker Schadsoftware auf günstigen Android-Smartphones. Die Malware ist dabei Teil der Firmware, läuft mit Privilegien auf Systemebene und lässt sich mit herkömmlichen Methoden nicht entfernen. In der…
-
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
Russia-aligned UAC-0099 has steadily upgraded its MATCHBOIL downloader since 2024 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/russia-aligned-uac-0099-evolves/
-
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/ignore-all-instructions-and-read-this-blog-the-state-of-ai-analysis-evasion-in-malware/
-
Sandworm-Linked Group Sharpens Matchboil Downloader
Malware Has Hit Ukrainian Transport, Energy and Manufacturing Firms. Eset says Russia-aligned UAC-0099 has spent since at least 2024 refining Matchboil, a downloader used against Ukrainian organizations that now supports recurring command-and-control traffic, stronger evasion and delivery of the Matchwok backdoor. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/sandworm-linked-group-sharpens-matchboil-downloader-a-33037
-
Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/
-
Hackers Target Hotels With Fake Guest Complaints to Deploy Blockchain-Based RAT Malware
Hackers are targeting hotels with fabricated guest complaints and negative reviews to distribute EtherRAT and TONResolver, two malware families that abuse public blockchains to locate their command-and-control infrastructure. The activity appears to extend earlier Booking. com-themed phishing operations, although Cofense assesses that connection with moderate confidence. Similar email templates and accommodation-sector targeting link the campaigns.…
-
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/matchboil-malware-uac-0099/
-
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as “tensorlake,” a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.The malicious version 0.5.144 “contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code,” Socket said First seen on thehackernews.com…
-
PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion
Tags: ai, botnet, control, crypto, cyber, data-breach, exploit, infrastructure, Internet, malware, vulnerabilityA cryptocurrency mining campaign dubbed PoeLLM has compromised more than 3,400 servers by targeting exposed AI infrastructure and other internet-facing applications. Active since April 2026, the operation combines vulnerability exploitation, cryptocurrency miners and an unusual command-and-control mechanism that derives server addresses from a poem hosted on GitHub. Victims predominantly run LiteLLM, Ollama, Gotenberg and Gitea,…
-
Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
MALFEX, a persistent npm supply-chain campaign distributing Windows malware through eight malicious packages. Linked to an apparent single operator active since August 2023, the campaign delivers Overlord RAT, the movinlike information stealer, and a separate downloader concealed inside an ASCII-art utility. The largest contributor, function-flag, accounted for 37,419 downloads and has contained malicious code since…