Malware campaigns, trojans, botnets, and the threat actors deploying malicious code.
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
The Hacker News reports that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a le…
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Cybersecurity researchers at Forescout Research - Vedere Labs have identified a new malware delivery platform named ROMULUS that uses ClickFix-style a…
Researchers Infiltrate Microsoft Tech Support Scam Operation
Researchers have exposed a major scam operation that impersonates Microsoft by abusing thousands of Cloudflare links and leveraging a malicious traffi…
Watering Hole Attacks Push ScanBox Keylogger
Researchers have identified a watering hole attack distributing ScanBox, a JavaScript-based reconnaissance tool, in what appears to be a campaign by A…
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Researchers discovered a malicious npm package called "imgdecode" that conceals a shellcode loader within a Windows native addon. The package was uplo…
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
Cybersecurity researchers have disclosed a new variant of the DarkSword iOS exploit kit designated P7 DarkSword. The variant reduces its on-device foo…
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Cybersecurity researchers discovered an active credential-theft campaign targeting open-source repositories through compromised maintainer accounts. T…
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Attackers are weaponizing legitimate remote management tools in a multi-stage infection chain that chains MSP360 and ScreenConnect to establish persis…
Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure
Threat actors have weaponized custom GPTs, the application layer built on OpenAI's ChatGPT platform, to distribute remote access trojans (RATs) to uns…
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Threat actors are weaponizing OpenAI's Custom GPTs feature to launch Remote Access Trojan (RAT) attacks against unsuspecting users. Security researche…
101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
OX Security researchers uncovered 101 malicious npm packages designed to hijack developer WhatsApp accounts and enroll them in unauthorized group chat…
'NeedyMantis' Provides Long-Term Access to Compromised Networks
Microsoft researchers identified a previously unknown malware framework deployed by a China-based threat actor tracked as NeedyMantis in targeted camp…
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Microsoft researchers identified a custom malware family called NeedyMantis deployed by attackers to establish persistent access within networks alrea…
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
RatHat operators leverage Google's Gemini AI to prioritise high-value victims among infected Android devices, according to research published by Cleaf…
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
A newly discovered botnet named Carbonato exploits Docker containers to deploy an AI agent that receives commands through Telegram and extracts API cr…
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet exploits misconfigured Docker environments to inject Hermes AI agents that execute commands received via Telegram, according to secur…
Chrome Store Hosts 'Poper Blocker' Spyware Downloaded by Millions
# Chrome Store Hosts 'Poper Blocker' Spyware Downloaded by Millions A malicious extension called "Poper Blocker" has infiltrated the Chrome Web Store…
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
A malware-as-a-service platform named Lunex is actively distributing the Psychedelic Stealer malware through a sophisticated attack chain targeting Uk…
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
A malicious npm package called "indexed-btree" employed runtime code injection to evade detection mechanisms, hiding its malicious behavior directly w…
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
GitHub repositories tied to the actions-cool organization resumed distributing Mini Shai-Hulud malware after coming back online, prompting a second ro…
PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
A newly discovered variant of PamStealer malware adds live command-and-control (C2) payload decryption, making detection and analysis harder for secur…
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
# AI Tools, Poisoned Search Results, and Trusted Paths Under Attack in Latest Threat Wave Attackers are exploiting trusted systems and AI-driven tool…
SectopRAT Returns, Hiding Inside a Legitimate Application
# SectopRAT Returns, Hiding Inside a Legitimate Application A remote access Trojan called SectopRAT has resurfaced in ongoing campaigns, embedding it…
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
# Placeholder Domain Weaponized: ClickFix Malware Targets Developers Through 1,700+ Code Repositories A long-dormant documentation placeholder domain…
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
Threat actors have actively compromised legitimate Ukrainian business websites to distribute a previously unknown information stealer called Psychedel…
Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
A new Android spyware variant named Corp MDM targets logistics companies through fraudulent distribution channels mimicking legitimate enterprise soft…
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
A cybersecurity research firm has exposed the mechanics behind ClickFix, a technique that has evolved from an experimental attack method into a fully-…
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
Threat actors have weaponized the HashiCorp Terraform Registry for the first time, distributing Go-based malware through malicious Terraform providers…
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
Cisco Talos researchers discovered a Windows malware variant named CLOSEDQUORUM that delegates command decisions to an ensemble of artificial intellig…
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Unknown threat actors have successfully compromised legitimate MemTensor packages across both npm and PyPI, injecting a multi-platform credential stea…
Attackers Manipulate AI Chatbots in Mass Disinformation, Phishing Campaign
Threat actors have launched a coordinated campaign targeting AI chatbots and search engines by poisoning web content with malicious links and disinfor…
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
A malicious npm package called "tw-pkgprobe-7731" circulated through the official npm registry, impersonating a legitimate security testing tool and s…
Microsoft Disrupts EvilTokens Device Code Phishing Service
Microsoft executed a broad takedown of EvilTokens, a phishing-as-a-service operation that sold device code phishing kits to criminal operators targeti…
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A malicious installer masquerading as the LastPass Authenticator application hijacks Microsoft-signed kernel drivers to disable endpoint protection be…
Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
North Korean threat actors orchestrated a sprawling social engineering campaign that compromised 30,000 devices across more than 100 countries and dra…
Cybercriminals Are Hiding New Malware in Torrents for Popular Films
Cybercriminals are distributing malware through torrents of popular films, targeting users across Africa with particular focus on Kenya and Uganda. Se…
TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
A new PowerShell backdoor called TASK#STOMP actively harvests documents, Wi-Fi credentials, and clipboard data from compromised systems, according to …
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Threat actors are deploying a previously undocumented remote access trojan (RAT) called ChainScript through ClickFix-style social engineering attacks.…
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
North Korean threat actor Jade Sleet has compromised an India-based IT services provider, deploying previously undisclosed backdoors called FLATROOF a…
U.S. Seizes NightmareStresser Domains Linked to Hundreds of Thousands of DDoS Attacks
The U.S. Department of Justice seized two domains operating NightmareStresser, a DDoS-for-hire service responsible for hundreds of thousands of distri…
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
# LLM-Generated Malware Now Targeting npm Ecosystem A financially motivated threat actor distributed an information stealer called PhantomRaven throu…
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
A new Android malware variant named RatHat exploits the Android Debug Bridge (ADB) protocol to maintain persistent shell access on compromised devices…
Malware context
Malware campaigns, trojans, botnets, and the threat actors deploying malicious code.