Virus

Virus List - 2026 2025 2024 2023 2021 2020 2019 2018 2017

H AI APT Attack BigBrothers BotNet Congress Cryptocurrency Cyber CyberCrime Exploit Hack ICS Incindent IoT Mobil OS Phishing Ransom Safety Security Social Spam Virus Vulnerebility | 2026 2025 2024 2023

DATE	NAME	Info	CATEG.	WEB
19.10.26	Targeted ads installed Candiru spyware in zero-click attacks	Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device.	Virus	BleepingComputer
18.10.26	Fake Arch Linux packages push malware with root privileges	A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.	Virus	BleepingComputer
18.10.26	Hirudo Android malware replaces banking apps to evade security checks	A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.	Virus	BleepingComputer
17.10.26	Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption	A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities.	Virus	BleepingComputer
17.10.26	Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor	Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at	Virus	The Hacker News
16.10.26	Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads	Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that	Virus	The Hacker News
14.10.26	Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks	Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking	Virus	The Hacker News
13.10.26	Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies	Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly	Virus	The Hacker News
11.10.26	PoeLLM malware infects exposed AI servers in cryptomining attacks	A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads.	Virus	BleepingComputer
8.10.26	UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML	The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan	Virus	The Hacker News
8.10.26	Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm	The npm package known as " tensorlake ," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud	Virus	The Hacker News
8.10.26	Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer	Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and	Virus	The Hacker News
7.10.26	Alleged dev of Ploutus ATM malware appears in US court after arrest	The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States.	Virus	BleepingComputer
7.10.26	100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer	The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected	Virus	The Hacker News
7.10.26	Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan	Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and	Virus	The Hacker News
2.10.26	WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory	Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure	Virus	The Hacker News
29.9.26	Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks	Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of	Virus	The Hacker News
29.9.26	RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims	RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security	Virus	The Hacker News
28.9.26	JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources	The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using	Virus	The Hacker News
27.9.26	MacSync malware uses public iCloud calendars to deliver new payloads	A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads.	Virus	BleepingComputer
27.9.26	New RemControl Android banking malware targets users in Europe and Canada	A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application.	Virus	BleepingComputer
27.9.26	Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials	The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a	Virus	The Hacker News
27.9.26	New ClosedQuorum Windows malware uses AI for attack decisions	A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack.	Virus	BleepingComputer
25.9.26	PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence	Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side	Virus	The Hacker News
25.9.26	Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer	An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages	Virus	The Hacker News
25.9.26	Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls	The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM .	Virus	The Hacker News
24.9.26	MacSync under the microscope: new delivery methods and a new payload	We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.	Virus	SECURELIST
24.9.26	Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry	Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time	Virus	The Hacker News
23.9.26	Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials	Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool	Virus	The Hacker News
22.9.26	Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal	A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in	Virus	The Hacker News
22.9.26	SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing	The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their	Virus	The Hacker News
22.9.26	Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR	A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software	Virus	The Hacker News
22.9.26	TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data	Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers a PowerShell backdoor designed to	Virus	The Hacker News
21.9.26	New RatHat Android malware uses AI to automate device control	A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.	Virus	BleepingComputer
21.9.26	ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure	Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript . "ChainScript has appeared under multiple build names, including	Virus	The Hacker News
21.9.26	Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors	The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the	Virus	The Hacker News
20.9.26	Iranian hackers use CHOSEN BRICK Windows malware to spy on targets	Government agencies are warning that Iranian state-linked hackers are using a Windows malware strain named CHOSEN BRICK to target dissidents, activists, and journalists worldwide.	Virus	BleepingComputer
20.9.26	Malware bypasses browser checks to force install Chrome, Edge extensions	A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.	Virus	BleepingComputer
19.9.26	BambooToken malware controls Windows and Linux systems via MQTT	A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.	Virus	BleepingComputer
18.9.26	WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage	Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit . The new malware family, per	Virus	The Hacker News
18.9.26	RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall	Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and	Virus	The Hacker News
16.9.26	KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens	Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN	Virus	The Hacker News
15.9.26	BambooToken Malware Uses MQTT to Control Windows and Linux Systems	Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport ( MQTT )	Virus	The Hacker News
15.9.26	3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials	An attacker was operating inside the network of 3BB , one of Thailand's largest broadband providers, and maintained remote control of internal	Virus	The Hacker News
13.9.26	Artifactory flaws chained in attacks deploying backdoor malware	Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers.	Virus	BleepingComputer
13.9.26	New Android malware encrypts files, steals data, and harasses victims	A new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims.	Virus	BleepingComputer
12.9.26	Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit	A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk.	Virus	BleepingComputer
10.9.26	Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks	The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking	Virus	The Hacker News
10.9.26	Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA	Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to	Virus	The Hacker News
9.9.26	F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans	Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk,	Virus	The Hacker News
8.9.26	WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls	Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones.	Virus	The Hacker News
8.9.26	BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams	Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for	Virus	The Hacker News
8.9.26	PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution	Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a	Virus	The Hacker News
7.9.26	Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts	Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic	Virus	The Hacker News
7.9.26	JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies	Cybersecurity researchers have unpacked JSCeal , a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities.	Virus	The Hacker News
6.9.26	Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner	Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows	Virus	The Hacker News
6.9.26	Your Employee’s Password Appeared in an Infostealer Log. Now What?	Infostealers can expose far more than passwords, including authenticated sessions that may let attackers bypass MFA. Flare explains how defenders can prioritize compromised identities, determine whether stolen access is still usable, and respond before it leads to account takeover.	Virus	BleepingComputer
4.9.26	New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic	A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean	Virus	The Hacker News
3.9.26	BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory	Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts.	Virus	The Hacker News
3.9.26	Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks	Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According	Virus	The Hacker News
3.9.26	Fake Software Installers Disable Windows Update and Weaken Microsoft Defender	An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and	Virus	The Hacker News
2.9.26	Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control	Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking	Virus	The Hacker News
2.9.26	Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads	The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as	Virus	The Hacker News
1.9.26	Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests	The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued	Virus	The Hacker News
1.9.26	Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set	Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.	Virus	SECURELIST
31.8.26	ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions	The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add	Virus	The Hacker News
31.8.26	ValleyRAT masquerading as adware	Threat actors are distributing the ValleyRAT backdoor disguised as adware. We analyze the infection chain, from the malicious installer to the final payload.	Virus	SECURELIST
30.8.26	TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor	Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix , that aims to trick users into running a malicious command in	Virus	The Hacker News
28.8.26	Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools	Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT . "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims.	Virus	The Hacker News
28.8.26	GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address	Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware	Virus	The Hacker News
27.8.26	ToxicPanda Android malware uses VPN permissions to block Google Play	The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands.	Virus	BleepingComputer
27.8.26	Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler	Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore , an	Virus	The Hacker News
26.8.26	Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode	An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER , that stays inert in	Virus	The Hacker News
25.8.26	E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands	Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers ( DDRs ) to deliver two	Virus	The Hacker News
25.8.26	Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning	Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by	Virus	The Hacker News
24.8.26	WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords	Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from	Virus	The Hacker News
23.8.26	Hackers infect Android car head units with proxy botnet malware	A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud.	Virus	BleepingComputer
23.8.26	New SynkLoader malware pushed in Microsoft Teams phishing campaign	A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen.	Virus	BleepingComputer
23.8.26	Hackers abuse FTP server banners to deliver new Windows malware	Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE.	Virus	BleepingComputer
23.8.26	Hackers poison arrayref Rust crate to push infostealer malware	Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers' systems during compilation.	Virus	BleepingComputer
23.8.26	New Manic Android malware can exfiltrate data through nearby devices	A new Android malware named Manic targeting users in multiple European countries has a fallback data exfiltration mechanism that uses nearby infected devices.	Virus	BleepingComputer
21.8.26	Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet	Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware	Virus	The Hacker News
21.8.26	The invisible passenger in your car	Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It’s delivered through legitimate software for DoFun head units.	Virus	SECURELIST
21.8.26	Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads	The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published	Virus	The Hacker News
20.8.26	Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices	A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and	Virus	The Hacker News
20.8.26	ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud	Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements,"	Virus	The Hacker News
20.8.26	Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea	The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases in which attackers targeted web servers in Korea to install SoftEther VPN. Attack cases involving the installation of SoftEther VPN, an open-source VPN, were previously discussed in the 2024 ASEC blog post titled “Analysis of Attack Cases Targeting ERP Servers in Korea to Install SoftEther VPN”.	Virus	AHNLAB
20.8.26	Beware of phishing emails disguised as requests to review quotes (PhantomStealer)	The AhnLab SEcurity intelligence Center (ASEC) recently identified a phishing email campaign that disguised itself as a request to review a quote. The threat actor impersonated a sales team member at a specific overseas company and, by claiming that a previous quote needed to be revised and product versions verified, tricked recipients into opening the Attachment.	Virus	AHNLAB
19.8.26	StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data	Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to	Virus	The Hacker News
19.8.26	Hunting MacSync Stealer infrastructure through behavioral pivots	MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure.	Virus	Microsoft blog
19.8.26	StubMaker RubyGems Campaign Delivers a Windows Infostealer	On August 15, 2026, we discovered newly-published RubyGems packages that installs a multi-stage Windows infostealer malware. This new malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data.	Virus	OPENSOURCE MALWARE
19.8.26	Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains	Microsoft tracked over 30 MacSync Stealer domains by focusing on behavioral patterns, revealing a campaign targeting passwords, keys, wallets and other data.	Virus	SECURITYAFFAIRS
19.8.26	Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure	Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating	Virus	The Hacker News
17.8.26	New AmnesiaStealer macOS malware hijacks browser sessions via remote control	A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser.	Virus	BleepingComputer
16.8.26	Android malware combo takes out loans and relays victims' credit cards	A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to attackers in real time.	Virus	BleepingComputer
14.8.26	New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure	Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that	Virus	The Hacker News
14.8.26	AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS	Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that's	Virus	The Hacker News
13.8.26	WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud	A previously unseen Android near field communication ( NFC ) relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan (RAT) called SpyNote as part of a contactless	Virus	The Hacker News
13.8.26	Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme	A new NFC relay malware designated as WindRelay, paired with SpyNote RAT enables live-call fraud, combining social engineering with dual digital and physical cash-out.	Virus	GROUP-IB
12.8.26	New Intelligence Links TeamPCP to ShadowRay 2.0 and Traces Activity back to 2020	OLIGO Security has identified evidence that TeamPCP was responsible for the first known attack in which AI infrastructure was hijacked into a self-propagating botnet during the ShadowRay 2.0 campaign. Our findings also link the group to activity previously attributed to TA-NATALSTATUS dating back to 2020.	Virus	OLIGO
12.8.26	Shai-Hulud Outbreak Debrief: The Worm Evolves into MCP	5 days after 440+ npm packages were compromised, 5 malicious repositories remain live in the wild—and the threat is still active	Virus	OX SECURITY
12.8.26	Tracking Shai-Hulud: Inside the ChainDrop NPM Worm	On August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a single blockchain transaction and rendering domain-based blocklists ineffective.	Virus	Zscaler
12.8.26	Abyssos: Technical Analysis of a New Modular RAT	In late June 2026, Zscaler ThreatLabz identified a new malware family that we track as Abyssos. Abyssos is a new modular remote administration tool (RAT) written in C++ that supports a variety of features including credential theft, file exfiltration, and remote access via VNC.	Virus	Zscaler
10.8.26	Hackers breach TrueConf to trojanize client installers with backdoors	The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions that deliver backdoors.	Virus	BleepingComputer
9.8.26	ClickFix attack pushes macOS infostealer for crypto theft attacks	A Go-based malware delivered in ClickFix attacks targeting macOS users is stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials.	Virus	BleepingComputer
8.8.26	Google Blogger locks hundreds of blogs in malware false positive	Google has locked hundreds of Blogger websites after a false positive claimed they violated its "Malware and Similar Malicious Content" policy, with some sites deleted from the platform.	Virus	BleepingComputer
8.8.26	New XCSSET variant targets macOS devs via compromised Xcode projects	A new version of the XCSSET malware is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories.	Virus	BleepingComputer
8.8.26	77 Open VSX extensions found harvesting developer info	77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environments where they were installed.	Virus	BleepingComputer
8.8.26	Massive ChainDrop npm supply-chain attack infects hundreds of packages	Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry.	Virus	BleepingComputer
8.8.26	Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer	A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform	Virus	The Hacker News
7.8.26	Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools	Infostealers are a rapidly evolving threat, enabling various adversaries, ranging from ransomware groups and hacktivists to nation-state actors, to exploit stolen credentials for unauthorized access to sensitive resources. In today’s threat landscape, identity is a primary target, with attackers seeking diverse credentials including usernames, passwords, tokens, and seed phrases.	Virus	SOCRADAR
7.8.26	Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access	Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables.	Virus	The Hacker News
6.8.26	Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells	Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years.	Virus	The Hacker News
6.8.26	Malware signing: When trust becomes an attack surface	How cybercriminals use stolen, fraudulent, and commercialized code-signing certificates to make malware appear legitimate and bypass traditional trust controls.	Virus	BARRACUDA
6.8.26	Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages	Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAINDROP, a worm that uses stolen npm credentials to backdoor co-owned packages totaling over 1.3 billion monthly downloads.	Virus	ELASTIC
6.8.26	The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2	An exposed open directory at 193.233.202[.]17 caught an operator tied to The Gentlemen ransomware mid-intrusion, setting up a Windows domain for persistent access, credential theft, and lateral movement. The files left behind trace the full operation, from privileged account creation and LSASS dumping to security-product tampering and reverse tunnels.	Virus	HUNT.IO
6.8.26	Targeted Attack on Government Entities in the Middle East \| Part 2	This is Part 2 of our two-part technical analysis on new tools used by an East Asia-linked threat actor targeting government entities in the Middle East. After ThreatLabz published Part 1 on the TELESHIM backdoor and MIXEDKEY loader, Kaspersky highlighted a related campaign in recent reporting.	Virus	Zscaler
6.8.26	Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures	A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had	Virus	The Hacker News
5.8.26	Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain	Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control (C2) technique that conceals the	Virus	The Hacker News
5.8.26	A Massive Shai-Hulud Campaign Hits npm: +440 Packages Compromised, Over 2B Monthly Downloads	A massive Shai-Hulud campaign hit npm, affecting over 2 billion monthly downloads of packages, the code contains the classic infostealer logic, and self propagating code.	Virus	OX SECURITY
5.8.26	Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data	A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were	Virus	The Hacker News
5.8.26	New DOUBLECUP ClickFix service hides malware in browser cache images	A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.	Virus	BleepingComputer
5.8.26	Fake Roblox Xeno script launcher pushes infostealer, RAT malware	Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information.	Virus	BleepingComputer
5.8.26	Inside the Underground Business of the Android BTMOB RAT malware	Flare researchers analyzed thousands of underground posts to examine how the BTMOB Android malware operation evolved into a fragmented ecosystem of resellers, source-code vendors, custom versions, and competing sales channels.	Virus	BleepingComputer
5.8.26	QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer	Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users.	Virus	The Hacker News
4.8.26	Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks	A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026. SafeDep verified 353	Virus	The Hacker News
4.8.26	DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT	A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in	Virus	The Hacker News
4.8.26	18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users	Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments.	Virus	The Hacker News
2.8.26	Arch Linux disables AUR package adoption to stop malware flood	Arch Linux disables AUR package adoption to stop malware flood	Virus	BleepingComputer
1.8.26	Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware	A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake , a remote access trojan (RAT) that can capture webcam	Virus	The Hacker News
1.8.26	HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm	Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based	Virus	The Hacker News
29.7.26	Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates	Source code for the Flying Eagle Android remote access trojan (RAT) framework is circulating through criminal Telegram channels. Hunt.io and	Virus	The Hacker News
29.7.26	Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js	Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT)	Virus	The Hacker News
28.7.26	AutoIT Payload Injector	For a long time, AutoIT has been pretty common in the malware ecosystem. Threat actors still use it because it’s easy to write and powerful. Indeed, it can perform all the required actions to inject a payload into a remote process as you’ll see below.	Virus	SANS
26.7.26	Malicious sites use JavaScript to build malware in browser memory	A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.	Virus	BleepingComputer
26.7.26	New Dolphin X malware uses AI to rank high-value targets	A new Dolphin X remote access trojan claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims should be targeted first.	Virus	BleepingComputer
26.7.26	Fake Claude app promoted by Bing ads pushes SectopRAT malware	A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware.	Virus	BleepingComputer
26.7.26	Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable	A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun	Virus	The Hacker News
25.7.26	New msaRAT malware uses Chrome, Edge browsers to route C2 traffic	The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.	Virus	BleepingComputer
23.7.26	FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware	A large-scale operation dubbed 'FakeGit' is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads.	Virus	BleepingComputer
22.7.26	Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library	Cybersecurity researchers have discovered a NuGet typosquat that's unlike the typical information-stealing malware distributed via package registries:	Virus	The Hacker News
21.7.26	New HollowGraph malware uses Microsoft Graph for stealthy C2 comms	A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data.	Virus	BleepingComputer
21.7.26	FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware	Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence	Virus	The Hacker News
20.7.26	HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050	A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator	Virus	The Hacker News
19.7.26	Microsoft warns of surge in ACR Stealer attacks on customers	Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers.	Virus	BleepingComputer
19.7.26	New ClickLock macOS malware traps users into revealing login password	A new macOS information-stealing malware dubbed ClickLock terminates all visible processes to force users into entering their system login password.	Virus	BleepingComputer
18.7.26	AsyncAPI npm packages infected with credential-stealing malware	Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities.	Virus	BleepingComputer
18.7.26	Nearly 300 GitHub repos pose as legit software to push malware	A threat actor has published hundreds of fake GitHub repositories impersonating legitimate software and security projects to distribute infostealer malware.	Virus	BleepingComputer
18.7.26	Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT	Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a	Virus	The Hacker News
17.7.26	ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files	ACR Stealer , an infostealer in circulation since 2024, is walking out of enterprise networks with saved browser passwords, live session tokens,	Virus	The Hacker News
17.7.26	New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage	Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent that has been put to use in cyber attacks	Virus	The Hacker News
17.7.26	Hackers backdoor Jscrambler npm package with infostealer malware	The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times.	Virus	BleepingComputer
17.7.26	New CrashStealer malware poses as Apple crash reporting tool	A new macOS information-stealing malware called CrashStealer pretends to be Apple's crash-reporting tool to steal credentials, keychain data, and crypto wallets.	Virus	BleepingComputer
17.7.26	RedHook Android malware now uses Wireless ADB for shell access	A new version of the RedHook Android malware abuses the Android Wireless Debugging (Wireless ADB) mechanism in a novel way to gain shell-level privileges without requiring a computer connection.	Virus	BleepingComputer
16.7.26	New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands	Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured,	Virus	The Hacker News
16.7.26	New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password	ClickLock Stealer , a new macOS infostealer, answers a victim's refusal by killing their apps on a loop until they hand over the login password. It	Virus	The Hacker News
16.7.26	Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor	An advanced malware previously attributed to a China-linked threat actor has resurfaced after more than four years within a Taiwan manufacturing	Virus	The Hacker News
16.7.26	OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps	A malware framework called OkoBot has been running on Windows machines since April 2025, and one of its modules is built to con	Virus	The Hacker News
16.7.26	Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware	Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to	Virus	The Hacker News
14.7.26	LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts	Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that	Virus	The Hacker News
13.7.26	CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks	Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from	Virus	The Hacker News
12.7.26	Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install	The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer on your machine. Published on July 11, 2026, the malicious version carries a preinstall hook that drops and executes a native binary, one build each for Windows, macOS, and Linux.	Virus	The Hacker News
11.7.26	Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials	Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications.	Virus	BleepingComputer
10.7.26	New MODBEACON RAT Uses gRPC Streaming for Encrypted C2 Traffic	The China-linked cybercrime group known as Silver Fox has been attributed to a new Rust-based remote access trojan (RAR) called	Virus	The Hacker News
10.7.26	New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware	Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper . What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator	Virus	The Hacker News
9.7.26	Chinese hackers develop LONGLEASH malware to expand ORB network	Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers.	Virus	BleepingComputer
9.7.26	Hidden backdoor in Tenda router firmware grants admin access	A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device's web management panel.	Virus	BleepingComputer
9.7.26	Fake IT support calls on Microsoft Teams push EtherRAT malware	Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support staff to trick employees into installing the EtherRAT malware, giving attackers initial access to corporate networks.	Virus	BleepingComputer
8.7.26	SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users	A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using	Virus	The Hacker News
8.7.26	RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service	A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill	Virus	The Hacker News
6.7.26	Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT	A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance	Virus	The Hacker News
6.7.26	New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions	Researchers at Shandong University have shown a fast new way to pull data off computers that are cut off from every network. The technique,	Virus	The Hacker News
6.7.26	New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS	Cybersecurity researchers have flagged a novel Java-based remote access trojan (RAT) called QuimaRAT that's capable of targeting Windows, Linux, and macOS environments. According to LevelBlue, the cross-platform malware is advertised under a malware-as-a-service (MaaS) model, costing anywhere between $150 for one month to $1,200 for lifetime access.	Virus	The Hacker News
6.7.26	SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing	Scanners meant to catch malicious add-on "skills" for AI coding agents can be fooled by a few simple changes that leave the malware working, according to a new study from researchers at the Hong Kong University of Science and Technology.	Virus	The Hacker News
5.7.26	NetNut proxy network disrupted, 2 million infected devices cut off	A joint operation involving Google has disrupted NetNut, a residential proxy network that gave access to millions of compromised Android devices, including smart TVs and streaming boxes.	Virus	BleepingComputer
5.7.26	New ChocoPoC malware targets researchers via trojanized PoC exploits	New ChocoPoC malware targets researchers via trojanized PoC exploits	Virus	BleepingComputer
3.7.26	Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer	A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the	Virus	The Hacker News
3.7.26	PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords	Cybersecurity researchers have flagged a new macOS information stealer called PamStealer that employs a series of clever tricks to infect systems	Virus	The Hacker News
2.7.26	New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos	Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC ,	Virus	The Hacker News
2.7.26	SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT	Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT . Kaspersky said the	Virus	The Hacker News
2.7.26	VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer	Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to	Virus	The Hacker News
1.7.26	Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures	A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified	Virus	The Hacker News
29.6.26	Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer	Update 25/06/2026 - Following our report, Nextron Research identified an additional 16 Go packages containing the same malware. Most appear to be legitimate packages whose latest released version included the malware alongside the original package contents, using the same structure and fake font file. The full list is available in the Go packages identified containing the same malicious payload section below.	Virus	JFROG
28.6.26	New macOS malware embeds fake errors to confuse AI analysis tools	A newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable.	Virus	BleepingComputer
27.6.26	Amadey, StealC malware operations disrupted in Operation Endgame action	Microsoft, Europol, and international partners have disrupted infrastructure used by the Amadey and StealC malware operations as part of Operation Endgame, which targets cybercriminal services and ransomware gangs.	Virus	BleepingComputer
27.6.26	Stealthy Mistic backdoor linked to ransomware access broker KongTuke	A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors.	Virus	BleepingComputer
27.6.26	New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks	A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks	Virus	The Hacker News
26.6.26	Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack	Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades	Virus	The Hacker News
25.6.26	New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis	A previously undocumented Rust-based macOS implant and information stealer has been found to embed a prompt injection payload designed to trick a malware analyst's artificial intelligence (AI) tools and trick it into aborting or refusing an analysis of the artifact. The malware has been codenamed Gaslight owing to this deceptive behavior.	Virus	The Hacker News
25.6.26	New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns	A new, stealthy backdoor named Mistic has been deployed as part of suspected financially motivated attacks aimed at multiple organizations	Virus	The Hacker News
25.6.26	Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered	A coordinated law enforcement operation, in partnership with private sector companies, including Bitdefender, Bitsight, ESET, and Microsoft,	Virus	The Hacker News
23.6.26	Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT	Cybersecurity researchers have discovered a set of malicious npm packages that are designed to deliver a Windows-based remote access	Virus	The Hacker News
22.6.26	ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack	Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors managed to tamper with	Virus	The Hacker News
22.6.26	New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer	Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware	Virus	The Hacker News
21.6.26	Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk	Since late 2025, malware has been spreading rapidly through the Steam Workshop, the gaming platform’s built-in service for players to create and share custom content. The attackers are primarily targeting gamers in China and Russia.	Virus	SECURELIST
21.6.26	From a VHDX File to a Remcos RAT	Yesterday, a reader reported to us a malicious ZIP archive (SHA256: a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094	Virus	SANS
21.6.26	Malicious JetBrains Marketplace plugins steal AI API keys from developers	At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers.	Virus	BleepingComputer
21.6.26	New Rokarolla Android malware targets 217 banking, crypto apps	A new Android banking trojan named Rokarolla is targeting 217 banking and cryptocurrency applications using an extensive set of 137 commands.	Virus	BleepingComputer
21.6.26	Steam Workshop abused to spread malware via Wallpaper Engine app	Threat actors are abusing Steam Workshop, Valve's community hub for downloading game-related content, to push various malware hidden in wallpaper packages.	Virus	BleepingComputer
20.6.26	Windows version of SprySOCKS Linux malware used to attack govt orgs	Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries.	Virus	BleepingComputer
18.6.26	Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2	Microsoft has disclosed details of a Windows-based cryptocurrency clipper campaign that has targeted users since February 2026. "The	Virus	The Hacker News
18.6.26	DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic	Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called	Virus	The Hacker News
16.6.26	New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds	Security researchers at Zimperium's zLabs have documented a new Android banking trojan, Rokarolla , that targets 217 banking and cryptocurrency apps and packs 137 remote commands.	Virus	The Hacker News
16.6.26	China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth	Cybersecurity researchers have flagged two previously undocumented Windows variants of what was believed to be a Linux-only backdoor called SprySOCKS . "The Windows variants discovered are internally marked as WIN_DRV and WIN_PLUS," ESET said in a report shared with The Hacker News.	Virus	The Hacker News
16.6.26	Fake Microsoft Alerts Used to Deploy North Korean NarwhalRAT Malware	The North Korean state-sponsored hacking group known as ScarCruft (aka APT37) has been observed using spear-phishing messages	Virus	The Hacker News
15.6.26	Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites	An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage , OptinMonster , and TrustPulse , turning those files into a way to break into the sites. When a site administrator was	Virus	The Hacker News
14.6.26	Over 400 Arch Linux packages compromised to push rootkit, infostealer	More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens.	Virus	BleepingComputer
14.6.26	The ‘Miasma’ worm source code briefly leaked on GitHub	The Miasma credential-stealing attack framework, which has recently targeted open-source ecosystems through supply-chain attacks, was briefly open-sourced on GitHub.	Virus	BleepingComputer
13.6.26	GitHub disables Microsoft repos pushing password-stealing malware	Microsoft removed 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub, disrupting continuous integration pipelines	Virus	BleepingComputer
13.6.26	NFCShare Android malware spreads via fake banking app updates on GitHub	New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub.	Virus	BleepingComputer
9.6.26	Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models	University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight	Virus	The Hacker News
9.6.26	Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer	The Miasma supply chain campaign has sparked a fresh attack wave called Hades , this time involving 37 malicious wheel artifacts across 19	Virus	The Hacker News
7.6.26	New IronWorm malware hits 36 packages in npm supply-chain attack	A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm.	Virus	BleepingComputer
7.6.26	Chinese hackers use new Atlas RAT malware in European cyberattacks	A Chinese-speaking cybercrime group has expanded its targeting to the European space, deploying previously undocumented malware and the Atlas backdoor.	Virus	BleepingComputer
6.6.26	Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack	Microsoft's GitHub repositories have become the latest to fall victim to the ongoing Miasma self-replicating supply chain attack campaign. The	Virus	The Hacker News
6.6.26	IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks	Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50	Virus	The Hacker News
5.6.26	Argamal: Malware hidden in hentai games	In April 2026, we discovered a new malware campaign targeting players of “hentai” games. Once launched, the infected games install a previously unknown malicious implant on the user’s machine.	Virus	SECURELIST
5.6.26	Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps	Arabic-speaking users have emerged as the target of a new Android spyware codenamed Asin , according to findings from ESET. The	Virus	The Hacker News
4.6.26	FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads	Cybersecurity researchers have shed light on a macOS malvertising campaign codenamed Operation FlutterBridge that spreads a new	Virus	The Hacker News
4.6.26	Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS	Cybersecurity researchers have flagged a large-scale operation that impersonates open-source and freeware projects to funnel unsuspecting	Virus	The Hacker News
4.6.26	Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT	Cybersecurity researchers have flagged a new malspam campaign that makes use of Google's DoubleClick domain as a way to evade detection	Virus	The Hacker News
3.6.26	FSB’s matryoshka #1/3 – Gamaredon’s gifts that keeps unpacking – GammaPhish and GammaWorm	Gamaredon is a cyberespionage group specialized in long-term and persistent intrusion operations targeting Ukraine. Officially operated by Russia’s FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of this publication.	Virus	SEKOIA BLOG
3.6.26	FSB’s matryoshka #2/3 – Gamaredon’s gifts that keeps unpacking – GammaLoad	Gamaredon is a cyberespionage group specialized in long-term and persistent intrusion operations targeting Ukraine. Officially operated by Russia’s FSB, the group is focusing government, military, and critical infrastructure networks, and is still actively operating at the time of this publication.	Virus	SEKOIA BLOG
3.6.26	Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content	Cybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control of victims' systems. The Minecraft-focused malware-as-a-service	Virus	The Hacker News
1.6.26	Unidentified RAT pushes NetSupport RAT	This diary provides indicators from an unidentified RAT infection on Wednesday 2026-05-27 that was followed by a malicious NetSupport Manager RAT package.	Virus	SANS
31.5.26	BTMOB Android malware service generates custom phishing payloads	An Android remote access trojan named BTMOB is offered to cybercriminals with a builder interface for generating malware payloads tailored to phishing lures.	Virus	BleepingComputer
30.5.26	GPU mining malware spreads via SEO poisoning, AI chatbots	Threat actors are targeting systems with high-performance computers in an ongoing cryptojacking campaign spread through a coordinated SEO poisoning operation that also manipulated AI chatbot recommendations.	Virus	BleepingComputer
30.5.26	Glassworm botnet disrupted after resilient C2 infrastructure takedown	The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network.	Virus	BleepingComputer
29.5.26	Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets	Cybersecurity researchers have discovered a malicious NuGet package that masquerades as a C# software development kit for Sicoob, one of Brazil's largest cooperative financial systems, to siphon client IDs and PFX certificates.	Virus	The Hacker News
27.5.26	Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users	Latin America and Europe become the target of two banking trojan campaigns that are designed to infect Windows and Android devices with	Virus	The Hacker News
27.5.26	Possible ACR Stealer From Page Impersonating Claude	In recent weeks, I've searched for pages impersonating Claude that distribute malware. In recent weeks, I've reliably found these sites through malicious ads in Google searches that lead to these pages, often concealed in URLs fo	Virus	SANS
27.5.26	GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure	CrowdStrike, in partnership with Google and the Shadowserver Foundation, has announced the simultaneous disruption of all command-	Virus	The Hacker News
25.5.26	TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO	A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-	Virus	The Hacker News
24.5.26	Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware	A new "coordinated" supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux	Virus	The Hacker News
23.5.26	Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer	Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to	Virus	The Hacker News
23.5.26	New Shai-Hulud malware wave compromises 600 npm packages	Threat actors earlier today published more than 600 malicious packages to the Node Package Manager (npm) index as part of a new Shai-Hulud supply-chain campaign.	Virus	BleepingComputer
23.5.26	SHub macOS infostealer variant spoofs Apple security updates	A new variant of the 'SHub' macOS infostealer uses AppleScript to show a fake security update message and installs a backdoor.	Virus	BleepingComputer
22.5.26	Cross-Platform NPM Stealer	I found a Node.js stealer that looked pretty well obfuscated. The file was not running out-of-the-box because it was uploaded on VT as “extracted-decoded.js” (and reformated).	Virus	SANS
22.5.26	Leaked Shai-Hulud malware fuels new npm infostealer campaign	The Shai-Hulud malware leaked last week is now used in new attacks on the Node Package Manager (npm) index, as infected packages emerged over the weekend.	Virus	BleepingComputer
21.5.26	Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor	Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a	Virus	The Hacker News
21.5.26	GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension	GitHub on Wednesday officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device	Virus	The Hacker News
20.5.26	Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API	Cybersecurity researchers have flagged fresh activity from a China-aligned threat actor known as Webworm in 2025, deploying custom	Virus	The Hacker News
19.5.26	Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account	Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages	Virus	The Hacker News
18.5.26	Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware	Cybersecurity researchers have discovered four new npm packages containing information-stealing malware, one of which is a clone of the	Virus	The Hacker News
18.5.26	Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations	A new analysis of the Lua-based fast16 malware has confirmed that it was a cyber sabotage tool designed to tamper with nuclear weapons	Virus	The Hacker News
17.5.26	Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution	Stolen browser sessions and authentication tokens are becoming more valuable than stolen passwords. Flare explains how the REMUS infostealer evolved around session theft and operational scalability.	Virus	BleepingComputer
16.5.26	Shai Hulud attack ships signed malicious TanStack, Mistral npm packages	Hundreds of packages across npm and PyPI have been compromised in a new Shai-Hulud supply-chain campaign delivering credential-stealing malware targeting developers.	Virus	BleepingComputer
15.5.26	Stealer Backdoor Found in 3 Node-IPC Versions Targeting Developer Secrets	Cybersecurity researchers are sounding the alarm about what has been described as "malicious activity" in newly published versions of node-ipc.	Virus	The Hacker News
14.5.26	Official CheckMarx Jenkins package compromised with infostealer	Checkmarx warned over the weekend that a rogue version of its Jenkins Application Security Testing (AST) plugin had been published on the Jenkins Marketplace.	Virus	BleepingComputer
14.5.26	New GhostLock tool abuses Windows API to block file access	A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares.	Virus	BleepingComputer
14.5.26	TrickMo Android banker adopts TON blockchain for covert comms	A new variant of the TrickMo Android banking malware, delivered in campaigns targeting users across Europe, introduces new commands and uses The Open Network (TON) for stealthy command-and-control communications.	Virus	BleepingComputer
14.5.26	Hackers abuse Google ads, Claude.ai chats to push Mac malware	Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac.	Virus	BleepingComputer
13.5.26	RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded	RubyGems , the standard package manager for the Ruby programming language, has temporarily paused account sign ups following what has been described as a "major malicious attack."	Virus	The Hacker News
10.5.26	JDownloader site hacked to replace installers with Python RAT malware	The website for the popular JDownloader download manager was compromised earlier this week to distribute malicious Windows and Linux installers, with the Windows payload found deploying a Python-based remote access trojan.	Virus	BleepingComputer
10.5.26	New TCLBanker malware self-spreads over WhatsApp and Outlook	A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI installer for Logitech AI Prompt Builder to infect systems.	Virus	BleepingComputer
10.5.26	New PCPJack worm steals credentials, cleans TeamPCP infections	A new malware framework called PCPJack is stealing credentials from exposed cloud infrastructure while actively removing TeamPCP's access to the systems.	Virus	BleepingComputer
10.5.26	Australia warns of ClickFix attacks pushing Vidar Stealer malware	The Australian Cyber Security Center (ACSC) is warning organizations of an ongoing malware campaign using the ClickFix social engineering technique to distribute the Vidar Stealer info-stealing malware.	Virus	BleepingComputer
10.5.26	New stealthy Quasar Linux malware targets software developers	A previously undocumented Linux implant named Quasar Linux (QLNX) is targeting developers' systems with a mix of rootkit, backdoor, and credential-stealing capabilities.	Virus	BleepingComputer
10.5.26	DAEMON Tools trojanized in supply-chain attack to deploy backdoor	Hackers trojanized installers for the DAEMON Tools software and since April 8, delivered a backdoor to thousands of systems that downloaded the product from the official website.	Virus	BleepingComputer
9.5.26	TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms	Threat hunters have flagged a previously undocumented Brazilian banking trojan dubbed TCLBANKER that's capable of targeting 59	Virus	The Hacker News
9.5.26	CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs	A new version of the CloudZ remote access tool (RAT) is deploying a previously unseen malicious plugin called Pheno that hijacks the Microsoft Phone Link connection to steal sensitive codes from mobile devices.	Virus	BleepingComputer
9.5.26	Backdoored PyTorch Lightning package drops credential stealer	A malicious version of the PyTorch Lightning package published on the Python Package Index (PyPI) delivers a credential-stealing payload targeting browsers, environment files, and cloud services.	Virus	BleepingComputer
9.5.26	Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha	Microsoft Defender is detecting legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, resulting in widespread false-positive alerts, and in some cases, removing certificates from Windows	Virus	BleepingComputer
8.5.26	Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise	A previously undocumented Linux implant codenamed Quasar Linux RAT (QLNX) is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and network tunneling.	Virus	The Hacker News
8.5.26	New Linux PamDOORa Backdoor Uses PAM Modules to Steal SSH Credentials	Cybersecurity researchers have disclosed details of a new Linux backdoor named PamDOORa that's being advertised on the Rehub	Virus	The Hacker News
7.5.26	PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux	Cybersecurity researchers have discovered three packages on the Python Package Index (PyPI) repository that are designed to stealthily deliver a	Virus	The Hacker News
6.5.26	Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs	Cybersecurity researchers have disclosed details of an intrusion that involved the use of a CloudZ remote access tool (RAT) and a previous undocumented plugin dubbed Pheno with the aim of facilitating credential theft.	Virus	The Hacker News
5.5.26	ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows	The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCall to likely target ethnic Koreans residing in China.	Virus	The Hacker News
3.5.26	Malicious Ad for Homebrew Leads to MacSync Stealer	As macbooks and mac minis become more popular, we're seeing more campaigns targeting these macOS hosts. Malicious ads have popped up in search results that can lead potential victims to pages that present themselves as legitimate	Virus	SANS
2.5.26	GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions	A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 "sleeper" extensions that turn malicious after an update.	Virus	BleepingComputer
2.5.26	PyPI package with 1.1M monthly downloads hacked to push infostealer	An attacker pushed a malicious version of the popular elementary-data package Python Package Index (PyPI) to steal sensitive developer data and cryptocurrency wallets.	Virus	BleepingComputer
2.5.26	Threat actor uses Microsoft Teams to deploy new “Snow” malware	A threat group tracked as UNC6692 uses social engineering to deploy a new, custom malware suite named 'Snow' which includes a browser extension, a tunneler, and a backdoor.	Virus	BleepingComputer
2.5.26	Firestarter malware survives Cisco firewall updates, security patches	Cybersecurity agencies in the U.S. and U.K. are warning about a custom malware called Firestarter persisting on Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software.	Virus	BleepingComputer
30.4.26	New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials	Cybersecurity researchers have disclosed details of a stealthy Python-based backdoor framework called DEEP#DOOR that comes with capabilities to	Virus	The Hacker News
30.4.26	EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades	Intro A sophisticated, high-resilience malicious campaign was identified by Atos Threat Research Center (TRC) in March 2026. This operation specifically	Virus	The Hacker News
27.4.26	Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware	Cybersecurity researchers have flagged dozens of Microsoft Visual Studio Code (VS Code) extensions on the Open VSX repository that are linked to a	Virus	The Hacker News
26.4.26	Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software	Cybersecurity researchers have discovered a new Lua-based malware created years before the notorious Stuxnet worm that aimed to sabotage Iran's nuclear	Virus	The Hacker News
26.4.26	New GoGra malware for Linux uses Microsoft Graph API for comms	A Linux variant of the GoGra backdoor uses legitimate Microsoft infrastructure, relying on an Outlook inbox for stealthy payload delivery.	Virus	BleepingComputer
25.4.26	New Lotus data wiper used against Venezuelan energy, utility firms	A previously undocumented data-wiping malware dubbed Lotus was used last year in targeted attacks against energy and utilities organizations in Venezuela.	Virus	BleepingComputer
25.4.26	NGate Android malware uses HandyPay NFC app to steal card data	A new variant of the NGate malware that steals NFC payment data is targeting Android users by hiding in a trojanized version of HandyPay, a legitimate mobile payments processing tool.	Virus	BleepingComputer
25.4.26	FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has revealed that an unnamed federal civilian agency's Cisco Firepower device running	Virus	The Hacker News
24.4.26	Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2	Chinese-speaking individuals are the target of a new campaign that uses a trojanized version of SumatraPDF reader to deploy the AdaptixC2 Beacon post-	Virus	The Hacker News
23.4.26	Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens	Cybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads	Virus	The Hacker News
23.4.26	Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API	The threat actor known as Harvester has been attributed to a new Linux version of its GoGra backdoor deployed as part of attacks likely targeting	Virus	The Hacker News
22.4.26	A .WAV With A Payload	There have been reports of threat actors using a .wav file as a vector for malware. It's a proper .wav file, but they didn't use staganography. The .wav file will play, but you'll just hear noise:	Virus	SANS
22.4.26	Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack	Cybersecurity researchers have discovered a previously undocumented data wiper that has been used in attacks targeting Venezuela at the end of last year	Virus	The Hacker News
21.4.26	NGate Campaign Targets Brazil, Trojanizes HandyPay to Steal NFC Data and PINs	Cybersecurity researchers have discovered a new iteration of an Android malware family called NGate that has been found to abuse a legitimate	Virus	The Hacker News
20.4.26	Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems	Cybersecurity researchers have flagged a new malware called ZionSiphon that appears to be specifically designed to target Israeli water treatment and	Virus	The Hacker News
19.4.26	ZionSiphon malware designed to sabotage water treatment systems	A new malware called ZionSiphon, specifically designed for operational technology, is targeting water treatment and desalination environments to sabotage their operations.	Virus	BleepingComputer
19.4.26	Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face	Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces.	Virus	BleepingComputer
19.4.26	New AgingFly malware used in attacks on Ukraine govt, hospitals	A new malware family named 'AgingFly' has been identified in attacks against local governments and hospitals that steal authentication data from Chromium-based browsers and WhatsApp messenger.	Virus	BleepingComputer
19.4.26	WordPress plugin suite hacked to push malware to thousands of sites	More than 30 WordPress plugins in the EssentialPlugin package have been compromised with malicious code that allows unauthorized access to websites running them.	Virus	BleepingComputer
18.4.26	Lumma Stealer infection with Sectop RAT (ArechClient2)	This diary provides indicators from a Lumma Stealer infection that was followed by Sectop RAT (ArechClient2). I searched for cracked versions of popular copyright-protected software, and I downloaded the initial malware after	Virus	SANS
18.4.26	The silent “Storm”: New infostealer hijacks sessions, decrypts server-side	New "Storm" infostealer skips local decryption, sending browser data to attacker servers. Varonis shows how server-side decryption enables session hijacking, bypassing passwords and MFA.	Virus	BleepingComputer
16.4.26	Obsidian Plugin Abuse Delivers PHANTOMPULSE RAT in Targeted Finance, Crypto Attacks	A "novel" social engineering campaign has been observed abusing Obsidian, a cross-platform note-taking application, as an initial access vector to distribute	Virus	The Hacker News
14.4.26	Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads	A nascent Android remote access trojan called Mirax has been observed actively targeting Spanish-speaking countries, with campaigns reaching more	Virus	The Hacker News
14.4.26	108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users	Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with the	Virus	The Hacker News
14.4.26	JanelaRAT Malware Targets Latin American Banks with 14,739 Attacks in Brazil in 2025	Banks and financial institutions in Latin American countries like Brazil and Mexico have continued to be the target of a malware family called JanelaRAT .	Virus	The Hacker News
13.4.26	CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads	Unknown threat actors compromised CPUID ("cpuid[.]com"), a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor	Virus	The Hacker News
12.4.26	New ‘LucidRook’ malware used in targeted attacks on NGOs, universities	A new Lua-based malware, called LucidRook, is being used in spear-phishing campaigns targeting non-governmental organizations and universities in Taiwan.	Virus	BleepingComputer
12.4.26	Google Chrome adds infostealer protection against session cookie theft	Google has rolled out Device Bound Session Credentials (DBSC) protection in Chrome 146 for Windows, designed to block info-stealing malware from harvesting session cookies.	Virus	BleepingComputer
12.4.26	New macOS stealer campaign uses Script Editor in ClickFix attack	A new campaign delivering the Atomic Stealer malware to macOS users abuses the Script Editor in a variation of the ClickFix attack that tricked users into executing commands in Terminal.	Virus	BleepingComputer
11.4.26	GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs	Cybersecurity researchers have flagged yet another evolution of the ongoing GlassWorm campaign, which employs a new Zig dropper that's designed to	Virus	The Hacker News
11.4.26	Why Simple Breach Monitoring is No Longer Enough	Infostealers are harvesting credentials and session cookies at scale, bypassing traditional defenses. Lunar explains why simple breach monitoring alone can't keep up with modern credential-based attacks.	Virus	BleepingComputer
10.4.26	Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers	Unknown threat actors have hijacked the update system for the Smart Slider 3 Pro plugin for WordPress and Joomla to push a poisoned version containing a backdoor.	Virus	The Hacker News
10.4.26	New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy	Cybersecurity researchers have flagged a new variant ofmalware called Chaos that'scapable of hitting misconfigured cloud deployments, marking an	Virus	The Hacker News
5.4.26	New CrystalRAT malware adds RAT, stealer and prankware features	A new malware-as-a-service called CrystalRAT is being promoted on Telegram, offering remote access, data theft, keylogging, and clipboard hijacking capabilities.	Virus	BleepingComputer
5.4.26	New EvilTokens service fuels Microsoft device code phishing attacks	A new malicious kit called EvilTokens integrates device code phishing capabilities, allowing attackers to hijack Microsoft accounts and provide advanced features for business email compromise attacks	Virus	BleepingComputer
5.4.26	'NoVoice' Android malware on Google Play infected 2.3 million devices	A new Android malware dubbed NoVoice exploited known vulnerabilities to gain root access and has been distributed through more than 50 apps on Google Play Store, with at least 2.3 million downloads.	Virus	BleepingComputer
4.4.26	Hackers compromise Axios npm package to drop cross-platform malware	Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver remote access trojans to Linux, Windows, and macOS systems.	Virus	BleepingComputer
2.4.26	Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners	A financially motivated operation codenamed REF1695 has been observed leveraging fake installers to deploy remote access trojans (RATs) and	Virus	The Hacker News
1.4.26	New Infinity Stealer malware grabs macOS data via ClickFix lures	A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka compiler.	Virus	BleepingComputer
1.4.26	Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass	Microsoft is calling attention to a new campaign that has leveraged WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. The activity,	Virus	The Hacker News
31.3.26	Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains	Chinese-speaking users are the target of an active campaign that uses typosquatted domains impersonating trusted software brands to deliver a	Virus	The Hacker News
31.3.26	Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account	The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious	Virus	The Hacker News
31.3.26	DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials	A new campaign has leveraged the ClickFix social engineering tactic as a way to distribute a previously undocumented malware loader referred to as	Virus	The Hacker News
29.3.26	Backdoored Telnyx PyPI package pushes malware hidden in WAV audio	TeamPCP hackers compromised the Telnyx package on the Python Package Index today, uploading malicious versions that deliver credential-stealing malware hidden inside a WAV file.	Virus	BleepingComputer
29.3.26	Fake VS Code alerts on GitHub spread malware to developers	A large-scale campaign is targeting developers on GitHub with fake Visual Studio Code (VS Code) security alerts posted in the Discussions section of various projects, to trick users into downloading malware.	Virus	BleepingComputer
29.3.26	Suspected RedLine infostealer malware admin extradited to US	An Armenian suspect was extradited to the United States to face criminal charges for allegedly helping manage RedLine, one of the most prolific infostealer malware operations in recent years	Virus	BleepingComputer
29.3.26	New Torg Grabber infostealer malware targets 728 crypto wallets	A new info-stealing malware called Torg Grabber is stealing sensitive data from 850 browser extensions, more than 700 of them for cryptocurrency wallets.	Virus	BleepingComputer
26.3.26	VoidStealer malware steals Chrome master key via debugger trick	An information stealer called VoidStealer uses a new approach to bypass Chrome's Application-Bound Encryption (ABE) and extract the master key for decrypting sensitive data stored in the browser.	Virus	BleepingComputer
25.3.26	GlassWorm Malware Uses Solana Dead Drops to Deliver RAT and Steal Browser, Crypto Data	Cybersecurity researchers have flagged a new evolution of the GlassWorm campaign that delivers a multi-stage framework capable of comprehensive data theft and installing a remote access trojan (RAT), which deploys an	Virus	The Hacker News
25.3.26	TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise	TeamPCP , the threat actor behind the recent compromises of Trivy and KICS, has now compromised a popular Python package named litellm , pushing two	Virus	The Hacker News
24.3.26	TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials	Two more GitHub Actions workflows have become the latest to be compromised by credential-stealing malware by a threat actor known as	Virus	The Hacker News
24.3.26	North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware	The North Korean threat actors behind the Contagious Interview campaign, also tracked as WaterPlum, have been attributed to a malware family tracked	Virus	The Hacker News
24.3.26	Trivy Hack Spreads Infostealer via Docker, Triggers Worm and Kubernetes Wiper	Cybersecurity researchers have uncovered malicious artifacts distributed via Docker Hub following the Trivy supply chain attack , highlighting the widening	Virus	The Hacker News
21.3.26	New ‘Perseus’ Android malware checks user notes for secrets	A new Android malware called Perseus is checking user-curated notes to steal sensitive information, like passwords, recovery phrases, or financial data.	Virus	BleepingComputer
21.3.26	GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX	The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions.	Virus	BleepingComputer
20.3.26	Stryker attack wiped tens of thousands of devices, no malware needed	Last week's cyberattack on medical technology giant Stryker was limited to its internal Microsoft environment and remotely wiped tens of thousands of employee devices.	Virus	BleepingComputer
20.3.26	Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers	Cybersecurity researchers have flagged a new malware dubbed Speagle that hijacks the functionality and infrastructure of a legitimate program called	Virus	The Hacker News
20.3.26	New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data	Cybersecurity researchers have disclosed a new Android malware family called Perseus that's being actively distributed in the wild with an aim to	Virus	The Hacker News
17.3.26	Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware	North Korean threat actors have been observed sending phishing to compromise targets and obtain access to a victim's KakaoTalk desktop	Virus	The Hacker News
17.3.26	GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos	The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of	Virus	The Hacker News
16.3.26	DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage	Ukrainian entities have emerged as the target of a new campaign likely orchestrated by threat actors linked to Russia, according to a report from S2	Virus	The Hacker News
15.3.26	GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers	Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a "significant escalation" in how it	Virus	The Hacker News
15.3.26	FBI seeks victims of Steam games used to spread malware	The FBI is asking gamers who installed Steam titles containing malware to provide information as part of an ongoing investigation into eight malicious games uploaded to the gaming platform.	Virus	BleepingComputer
15.3.26	Medtech giant Stryker offline after Iran-linked wiper malware attack	Leading medical technology company Stryker has been hit by a wiper malware attack claimed by Handala, an Iranian-linked and pro-Palestinian hacktivist group.	Virus	BleepingComputer
14.3.26	New BeatBanker Android malware poses as Starlink app to hijack devices	A new Android malware named BeatBanker can hijack devices and tricks users into installing it by posing as a Starlink app on websites masquerading as the official Google Play Store.	Virus	BleepingComputer
14.3.26	New 'Zombie ZIP' technique lets malware slip past security tools	A new technique dubbed "Zombie ZIP" helps conceal payloads in compressed files specially created to avoid detection from security solutions such as antivirus and endpoint detection and response (EDR) products.	Virus	BleepingComputer
14.3.26	The New Turing Test: How Threats Use Geometry to Prove 'Humanness'	Malware is evolving to evade sandboxes by pretending to be a real human behind the keyboard. The Picus Red Report 2026 shows 80% of top attacker techniques now focus on evasion and persistence, including geometry-based cursor tests and CPU timing checks.	Virus	BleepingComputer
14.3.26	Dutch govt warns of Signal, WhatsApp account hijacking attacks	Russian state-sponsored hackers have been linked to an ongoing Signal and WhatsApp phishing campaign targeting government officials, military personnel, and journalists to gain access to sensitive messages.	Virus	BleepingComputer
13.3.26	Rust-Based VENON Malware Targets 33 Brazilian Banks with Credential-Stealing Overlays	Cybersecurity researchers have disclosed details of a new banking malware targeting Brazilian users that's written in Rust, marking a significant departure	Virus	The Hacker News
10.3.26	KadNap Malware Infects 14,000+ Edge Devices to Power Stealth Proxy Botnet	Cybersecurity researchers have discovered a new malware called KadNap that's primarily targeting Asus routers to enlist them into a botnet for proxying	Virus	The Hacker News
10.3.26	Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credentials	Cybersecurity researchers have discovered a malicious npm package that masquerades as an OpenClaw installer to deploy a remote access trojan (RAT)	Virus	The Hacker News
8.3.26	Chinese state hackers target telcos with new malware toolkit	Chinese state hackers target telcos with new malware toolkit	Virus	BleepingComputer
8.3.26	Wikipedia hit by self-propagating JavaScript worm that vandalized pages	The Wikimedia Foundation suffered a security incident today after a self-propagating JavaScript worm began vandalizing pages and modifying user scripts across multiple wikis.	Virus	BleepingComputer
7.3.26	Spyware-grade Coruna iOS exploit kit now used in crypto theft attacks	A previously undocumented set of 23 iOS exploits named "Coruna" has been deployed by multiple threat actors in targeted espionage campaigns and financially motivated attacks.	Virus	BleepingComputer
7.3.26	Multi-Stage VOID#GEIST Malware Delivering XWorm, AsyncRAT, and Xeno RAT	Cybersecurity researchers have disclosed details of a multi-stage malware campaign that uses batch scripts as a pathway to deliver various encrypted	Virus	The Hacker News
6.3.26	Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer	Microsoft on Thursday disclosed details of a new widespread ClickFix social engineering campaign that has leveraged the Windows Terminal app as a way	Virus	The Hacker News
6.3.26	Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware	A suspected Iran-nexus threat actor has been attributed to a campaign targeting government officials in Iraq by impersonating the country's Ministry	Virus	The Hacker News
5.3.26	Microsoft: Hackers abuse OAuth error flows to spread malware	Hackers are abusing the legitimate OAuth redirection mechanism to bypass phishing protections in email and browsers to take users to malicious pages.	Virus	BleepingComputer
4.3.26	Fake Laravel Packages on Packagist Deploy RAT on Windows, macOS, and Linux	Cybersecurity researchers have flagged malicious Packagist PHP packages masquerading as Laravel utilities that act as a conduit for a cross-platform	Virus	The Hacker News
3.3.26	Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets	Microsoft on Monday warned of phishing campaigns that employ phishing emails and OAuth URL redirection mechanisms to bypass conventional	Virus	The Hacker News
1.3.26	CISA warns that RESURGE malware can be dormant on Ivanti devices	The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released new details about RESURGE, a malicious implant used in zero-day attacks exploiting CVE-2025-0282 to breach Ivanti Connect Secure devices.	Virus	BleepingComputer
28.2.26	1Campaign platform helps malicious Google ads evade detection	A newly identified cybercrime service known as 1Campaign is enabling threat actors to run malicious Google Ads that remain online for extended periods while evading scrutiny from security researchers.	Virus	BleepingComputer
27.2.26	Malicious Go Crypto Module Steals Passwords, Deploys Rekoobe Backdoor	Cybersecurity researchers have disclosed details of a malicious Go module that's designed to harvest passwords, create persistent access via SSH, and	Virus	The Hacker News
27.2.26	ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks	The North Korean threat actor known as ScarCruft has been attributed to a fresh set of tools, including a backdoor that uses Zoho WorkDrive for	Virus	The Hacker News
27.2.26	Trojanized Gaming Tools Spread Java-Based RAT via Browser and Chat Platforms	Threat actors are luring unsuspecting users into running trojanized gaming utilities that are distributed via browsers and chat platforms to distribute a	Virus	The Hacker News
26.2.26	Microsoft Warns Developers of Fake Next.js Job Repos Delivering In-Memory Malware	A "coordinated developer-targeting campaign" is using malicious repositories disguised as legitimate Next.js projects and technical assessments to trick	Virus	The Hacker News
26.2.26	Malicious NuGet Packages Stole ASP.NET Data; npm Package Dropped Malware	Cybersecurity researchers have discovered four malicious NuGet packages that are designed to target ASP.NET web application developers to steal	Virus	The Hacker News
24.2.26	Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb	Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke	Virus	The Hacker News
23.2.26	Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens	Cybersecurity researchers have disclosed what they say is an active "Shai-Hulud-like" supply chain worm campaign that has leveraged a cluster of at	Virus	The Hacker News
22.2.26	Predator spyware hooks iOS SpringBoard to hide mic, camera activity	Intellexa's Predator spyware can hide iOS recording indicators while secretly streaming camera and microphone feeds to its operators.	Virus	BleepingComputer
22.2.26	Google blocked over 1.75 million Play Store app submissions in 2025	Google says that through 2025, it blocked more than 255,000 Android apps from obtaining excessive access to sensitive user data and rejected over 1.75 million apps from being published on Google Play due to policy violations.	Virus	BleepingComputer
22.2.26	How infostealers turn stolen credentials into real identities	Infostealer dumps increasingly tie stolen credentials to real identities, linking usernames, cookies, and behavior across personal and enterprise accounts. Specops explains how analyzing 90,000 dumps shows reuse fuels enterprise risk and how continuous AD scanning disrupts that cycle.	Virus	BleepingComputer
22.2.26	New 'Massiv' Android banking malware poses as an IPTV app	A newly identified Android banking trojan named Massiv has been under active distribution across south Europe, disguised as an IPTV app.	Virus	BleepingComputer
20.2.26	ClickFix Campaign Abuses Compromised Sites to Deploy MIMICRAT Malware	Cybersecurity researchers have disclosed details of a new ClickFix campaign that abuses compromised legitimate sites to deliver a previously	Virus	The Hacker News
19.2.26	Fake IPTV Apps Spread Massiv Android Malware Targeting Mobile Banking Users	Cybersecurity researchers have disclosed details of a new Android trojan called Massiv that's designed to facilitate device takeover ( DTO ) attacks for	Virus	The Hacker News
19.2.26	CRESCENTHARVEST Campaign Targets Iran Protest Supporters With RAT Malware	Cybersecurity researchers have disclosed details of a new campaign dubbed CRESCENTHARVEST , likely targeting supporters of Iran's ongoing protests to	Virus	The Hacker News
19.2.26	Infostealer malware found stealing OpenClaw secrets for first time	With the massive adoption of the OpenClaw agentic AI assistant, information-stealing malware has been spotted stealing files associated with the framework that contain API keys, authentication tokens, and other secrets.	Virus	BleepingComputer
19.2.26	CTM360: Lumma Stealer and Ninja Browser malware campaign abusing Google Groups	CTM360 reports 4,000+ malicious Google Groups and 3,500+ Google-hosted URLs used to spread the Lumma Stealer infostealing malware and a trojanized "Ninja Browser." The report details how attackers abuse trusted Google services to steal credentials and maintain persistence across Windows and Linux systems.	Virus	BleepingComputer
18.2.26	Notepad++ Fixes Hijacked Update Mechanism Used to Deliver Targeted Malware	Notepad++ has released a security fix to plug gaps that were exploited by an advanced threat actor from China to hijack the software update mechanism to	Virus	The Hacker News
18.2.26	Researchers Show Copilot and Grok Can Be Abused as Malware C2 Proxies	Cybersecurity researchers have disclosed that artificial intelligence (AI) assistants that support web browsing or URL fetching capabilities can be	Virus	The Hacker News
18.2.26	Keenadu Firmware Backdoor Infects Android Tablets via Signed OTA Updates	A new Android backdoor that's embedded deep into the device firmware can silently harvest data and remotely control its behavior, according to new	Virus	The Hacker News
17.2.26	SmartLoader Attack Uses Trojanized Oura MCP Server to Deploy StealC Infostealer	Cybersecurity researchers have disclosed details of a new SmartLoader campaign that involves distributing a trojanized version of a Model Context	Virus	The Hacker News
17.2.26	Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens	Cybersecurity researchers disclosed they have detected a case of an information stealer infection successfully exfiltrating a victim's OpenClaw	Virus	The Hacker News
16.2.26	New ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Theft	Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to	Virus	The Hacker News
15.2.26	AMOS infostealer targets macOS through a popular AI app	AMOS infostealer is targeting macOS users by abusing popular AI apps and extension marketplaces to harvest credentials. Flare examines how AMOS operates, spreads through AI-driven lures, and feeds the broader stealer-log cybercrime economy.	Virus	BleepingComputer
14.2.26	Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs	A previously undocumented threat actor has been attributed to attacks targeting Ukrainian organizations with malware known as CANFAIL . Google	Virus	The Hacker News
13.2.26	LummaStealer infections surge after CastleLoader malware campaigns	A surge in LummaStealer infections has been observed, driven by social engineering campaigns leveraging the ClickFix technique to deliver the CastleLoader malwar	Virus	BleepingComputer
13.2.26	UAT-9921 Deploys VoidLink Malware to Target Technology and Financial Sectors	A previously unknown threat actor tracked as UAT-9921 has been observed leveraging a new modular framework called VoidLink in its campaigns	Virus	The Hacker News
13.2.26	Malicious Chrome Extensions Caught Stealing Business Data, Emails, and Browsing History	Cybersecurity researchers have discovered a malicious Google Chrome extension that's designed to steal data associated with Meta Business Suite	Virus	The Hacker News
12.2.26	ZeroDayRAT malware grants full access to Android, iOS devices	A new commercial mobile spyware platform dubbed ZeroDayRAT is being advertised to cybercriminals on Telegram as a tool that provides full remote control over compromised Android and iOS devices.	Virus	BleepingComputer
8.2.26	DKnife Linux toolkit hijacks router traffic to spy, deliver malware	A newly discovered toolkit called DKnife has been used since 2019 to hijack traffic at the edge-device level and deliver malware in espionage campaigns.	Virus	BleepingComputer
7.2.26	New GlassWorm attack targets macOS via compromised OpenVSX extensions	A new GlassWorm malware attack through compromised OpenVSX extensions focuses on stealing passwords, crypto-wallet data, and developer credentials and configurations from macOS systems.	Virus	BleepingComputer
6.2.26	Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware	Cybersecurity researchers have discovered a new supply chain attack in which legitimate packages on npm and the Python Package Index (PyPI) repository	Virus	The Hacker News
5.2.26	Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign	Cybersecurity researchers have disclosed details of an active web traffic hijacking campaign that has targeted NGINX installations and management	Virus	The Hacker News
5.2.26	Microsoft Develops Scanner to Detect Backdoors in Open-Weight Large Language Models	Microsoft on Wednesday said it built a lightweight scanner that it said can detect backdoors in open-weight large language models (LLMs) and improve	Virus	The Hacker News
5.2.26	DEAD#VAX Malware Campaign Deploys AsyncRAT via IPFS-Hosted VHD Phishing Files	Threat hunters have disclosed details of a new, stealthy malware campaign dubbed DEAD#VAX that employs a mix of "disciplined tradecraft and clever	Virus	The Hacker News
4.2.26	Microsoft Warns Python Infostealers Target macOS via Fake Ads and Installers	Microsoft has warned that information-stealing attacks are "rapidly expanding" beyond Windows to target Apple macOS environments by leveraging cross-	Virus	The Hacker News
3.2.26	Hugging Face abused to spread thousands of Android malware variants	A new Android malware campaign is using the Hugging Face platform as a repository for thousands of variations of an APK payload that collects credentials for popular financial and payment services.	Virus	BleepingComputer
3.2.26	Google disrupts IPIDEA residential proxy networks fueled by malware	IPIDEA, one of the largest residential proxy networks used by threat actors, was disrupted earlier this week by Google Threat Intelligence Group (GTIG) in collaboration with industry partners.	Virus	BleepingComputer
3.2.26	Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor	The Chinese espionage threat group Mustang Panda has updated its CoolClient backdoor to a new variant that can steal login data from browsers and monitor the clipboard.	Virus	BleepingComputer
3.2.26	US charges 31 more suspects linked to ATM malware attacks	A Nebraska federal grand jury charged 31 additional defendants for their involvement in an ATM jackpotting operation allegedly orchestrated by members of the Venezuelan gang Tren de Aragua.	Virus	BleepingComputer
3.2.26	New malware service guarantees phishing extensions on Chrome web store	A new malware-as-a-service (MaaS) called 'Stanley' promises malicious Chrome extensions that can clear Google's review process and publish them to the Chrome Web Store.	Virus	BleepingComputer
3.2.26	New ClickFix attacks abuse Windows App-V scripts to push malware	A new malicious campaign mixes the ClickFix method with fake CAPTCHA and a signed Microsoft Application Virtualization (App-V) script to ultimately deliver the Amatera infostealing malware.	Virus	BleepingComputer
3.2.26	Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users	A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security,	Virus	The Hacker News
2.2.26	eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware	The update infrastructure for eScan antivirus, a security solution developed by Indian cybersecurity company MicroWorld Technologies, has been	Virus	The Hacker News
2.2.26	Open VSX Supply Chain Attack Used Compromised Dev Account to Spread GlassWorm	Cybersecurity researchers have disclosed details of a supply chain attack targeting the Open VSX Registry in which unidentified threat actors	Virus	The Hacker News
28.1.26	Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks	Threat actors with ties to China have been observed using an updated version of a backdoor called COOLCLIENT in cyber espionage attacks in 2025 to	Virus	The Hacker News
28.1.26	Fake Python Spellchecker Packages on PyPI Delivered Hidden Remote Access Trojan	Cybersecurity researchers have discovered two malicious packages in the Python Package Index (PyPI) repository that masquerade as spellcheckers but	Virus	The Hacker News
25.1.26	US to deport Venezuelans who emptied bank ATMs using malware	South Carolina federal prosecutors announced that two Venezuelan nationals convicted of stealing hundreds of thousands of dollars from U.S. banks in an ATM jackpotting scheme will be deported after serving their sentences.	Virus	BleepingComputer
25.1.26	New Android malware uses AI to click on hidden browser ads	A new family of Android click-fraud trojans leverages TensorFlow machine learning models to automatically detect and interact with specific advertisement elements.	Virus	BleepingComputer
25.1.26	VoidLink cloud malware shows clear signs of being AI-generated	The recently discovered cloud-focused VoidLink malware framework is believed to have been developed by a single person with the help of an artificial intelligence model.	Virus	BleepingComputer
25.1.26	New PDFSider Windows malware deployed on Fortune 100 firm's network	Ransomware attackers targeting a Fortune 100 company in the finance sector used a new malware strain, dubbed PDFSider, to deliver malicious payloads on Windows systems.	Virus	BleepingComputer
25.1.26	Multi-Stage Phishing Campaign Targets Russia with Amnesia RAT and Ransomware	A new multi-stage phishing campaign has been observed targeting users in Russia with ransomware and a remote access trojan called Amnesia RAT. "The	Virus	The Hacker News
22.1.26	Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts	A new malicious package discovered in the Python Package Index (PyPI) has been found to impersonate a popular library for symbolic mathematics to	Virus	The Hacker News
22.1.26	VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code	The recently discovered sophisticated Linux malware framework known as VoidLink is assessed to have been developed by a single person with	Virus	The Hacker News
20.1.26	Evelyn Stealer Malware Abuses VS Code Extensions to Steal Developer Credentials and Crypto	Cybersecurity researchers have disclosed details of a malware campaign that's targeting software developers with a new information stealer called	Virus	The Hacker News
19.1.26	CrashFix Chrome Extension Delivers ModeloRAT Using ClickFix-Style Browser Crash Lures	Cybersecurity researchers have disclosed details of an ongoing campaign dubbed KongTuke that used a malicious Google Chrome extension	Virus	The Hacker News
19.1.26	Security Bug in StealC Malware Panel Let Researchers Spy on Threat Actor Operations	Cybersecurity researchers have disclosed a cross-site scripting (XSS) vulnerability in the web-based control panel used by operators of the StealC	Virus	The Hacker News
18.1.26	StealC hackers hacked as researchers hijack malware control panels	A cross-site scripting (XSS) flaw in the web-based control panel used by operators of the StealC info-stealing malware allowed researchers to observe active sessions and gather intelligence on the attackers' hardware.	Virus	BleepingComputer
18.1.26	Gootloader now uses 1,000-part ZIP archives for stealthy delivery	The Gootloader malware, typically used for initial access, is now using a malformed ZIP archive designed to evade detection by concatenating up to 1,000 archives.	Virus	BleepingComputer
18.1.26	New VoidLink malware framework targets Linux cloud servers	A newly discovered advanced cloud-native Linux malware framework named VoidLink focuses on cloud environments, providing attackers with custom loaders, implants, rootkits, and plugins designed for modern infrastructures.	Virus	BleepingComputer
17.1.26	GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection	The JavaScript (aka JScript) malware loader called GootLoader has been observed using a malformed ZIP archive that's designed to sidestep detection efforts by concatenating anywhere from 500 to 1,000 archives.	Virus	The Hacker News
17.1.26	LOTUSLITE Backdoor Targets U.S. Policy Entities Using Venezuela-Themed Spear Phishing	Security experts have disclosed details of a new campaign that has targeted U.S. government and policy entities using politically themed lures to deliver a backdoor known as	Virus	The Hacker News
14.1.26	PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces	The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between	Virus	The Hacker News
14.1.26	Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool	Cybersecurity researchers have disclosed details of a malicious Google Chrome extension that's capable of stealing API keys associated with MEXC, a centralized cryptocurrency exchange (CEX) available in over 170 countries , while masquerading as a tool to automate trading on the platform.	Virus	The Hacker News
14.1.26	New Advanced Linux VoidLink Malware Targets Cloud and container Environments	Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that's specifically designed for long-term,	Virus	The Hacker News
14.1.26	New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack	Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOW#REACTOR that employs an evasive multi-stage attack chain to deliver a	Virus	The Hacker News
8.1.26	Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages	Cybersecurity researchers have discovered three malicious npm packages that are designed to deliver a previously undocumented malware called NodeCordRAT . The names of the	Virus	The Hacker News
7.1.26	Black Cat Behind SEO Poisoning Malware Campaign Targeting Popular Software Searches	A cybercrime gang known as Black Cat has been attributed to a search engine optimization (SEO) poisoning campaign that employs fraudulent sites advertising popular software to trick	Virus	The Hacker News
7.1.26	Fake Booking Emails Redirect Hotel Staff to Fake BSoD Pages Delivering DCRat	Source: Securonix Cybersecurity researchers have disclosed details of a new campaign dubbed PHALT#BLYX that has leveraged ClickFix -style lures to display fixes for fake blue	Virus	The Hacker News
5.1.26	New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code	Cybersecurity researchers have disclosed details of a new Python-based information stealer called VVS Stealer (also styled as VVS $tealer) that's capable of harvesting Discord	Virus	The Hacker News
3.1.26	New GlassWorm malware wave targets Macs with trojanized crypto wallets	A fourth wave of the "GlassWorm" campaign is targeting macOS developers with malicious VSCode/OpenVSX extensions that deliver trojanized versions of crypto wallet applications.	Virus	BleepingComputer
3.1.26	Chinese state hackers use rootkit to hide ToneShell malware activity	A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations.	Virus	BleepingComputer
3.1.26	Zoom Stealer browser extensions harvest corporate meeting intelligence	A newly discovered campaign, which researchers call Zoom Stealer, is affecting 2.2 million Chrome, Firefox, and Microsoft Edge users through 18 extensions that collect online meeting-related data like URLs, IDs, topics, descriptions, and embedded passwords.	Virus	BleepingComputer
3.1.26	Chinese state hackers use rootkit to hide ToneShell malware activity	A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations.	Virus	BleepingComputer
3.1.26	Hacker arrested for KMSAuto malware campaign with 2.8 million downloads	A Lithuanian national has been arrested for his alleged involvement in infecting 2.8 million systems with clipboard-stealing malware disguised as the KMSAuto tool for illegally activating Windows and Office software.	Virus	BleepingComputer
3.1.26	Fake MAS Windows activation domain used to spread PowerShell malware	A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was used to distribute malicious PowerShell scripts that infect Windows systems with the 'Cosmali Loader'	Virus	BleepingComputer
2.1.26	Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia	The threat actor known as Transparent Tribe has been attributed to a fresh set of attacks targeting Indian governmental, academic, and strategic entities with a remote access trojan	Virus	The Hacker News