Malware Blog 2026- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME | Info | CATEG. | WEB |
| 27.8.26 | Mobile Banking Fraud 2026: Malware is Actively Targeting Mobile Banking Apps in Europe, Middle East & Africa | Our most recent malware threat research from Zimperium’s zLabs research team revealed 34 malware families targeting 1,243 mobile banking and fintech apps across 90 countries globally. | Malware blog | ZIMPERIUM |
|
22.8.26 |
The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile | The zLabs team recently identified an updated variant of ToxicPanda, the Android banking Trojan known to have primarily targeted Europe, that introduces significant enhancements, including a comprehensive command set of 167 remote commands and substantially expands its targets globally. | Malware blog | ZIMPERIUM |
|
22.8.26 |
GoldDigger Malware Demonstrates Advanced Mobile Banking Threats | A recent analysis highlights GoldDigger, an Android malware family designed to steal financial information and facilitate fraudulent activity on compromised devices. The malware abuses accessibility services to monitor user activity, capture credentials, and interact with banking applications while operating with limited visibility to the victim. | Malware blog | ZIMPERIUM |
| 22.8.26 | Mobile Ad Fraud Scheme Uses Automation to Mimic Human Behavior | A recent investigation uncovered Papyrus, a mobile ad fraud operation designed to generate fraudulent engagement by imitating legitimate user behavior. The scheme uses Android apps to produce automated clicks, scrolling, and other interactions that appear human, allowing fraudulent activity to blend into normal mobile traffic. By manipulating engagement signals rather than relying on obvious malicious actions, these techniques can make detection more difficult. | Malware blog | ZIMPERIUM |
| 22.8.26 | FTP Banners: The New Dead Drop Resolver Delivering Novel RATs | FTP Banners: The New Dead Drop Resolver Delivering Novel RATs STRU found threat actors using FTP banners as Dead Drop Resolvers – legitimate services or protocols abused to host C2 addresses and comma... | Malware blog | SOCRADAR |
| 22.8.26 | 1 in 20 Stealer Log Victims are Threat Actors | When analysts examine stealer logs, the underlying assumption is that each infected device belongs to a victim. However, cybercriminals are not immune to the same operational mistakes as everyone else. | Malware blog | FLARE.IO |
| 22.8.26 | Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security | One of the biggest challenges for every threat hunter is navigating endless alerts, scattered indicators, behavioral evidence, and infrastructural context. Data collection is just the first step – but how do you turn it into findings that lead to proactive protection against malware and phishing? | Malware blog | ANYRUN BLOG |
| 22.8.26 | Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025 | In late July 2026, eSentire's Threat Response Unit (TRU) identified several ErrTraffic-generated ClickFix campaigns attempting to deliver Cruciferra - a malware loader marketed on underground forums that boasts EDR-killing capabilities. TRU found Cruciferra using a vulnerable driver to fulfill this behavior. | Malware blog | ESENTIRE |
|
22.8.26 |
C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 | In July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads. | Malware blog | Zscaler |
| 22.8.26 | A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace | We found a custom Windows backdoor on a single corporate workstation while hunting for unusual WMI persistence. The malware was small, had a limited command set and disguised itself as legitimate Realtek software. Its most unusual feature was its configuration: the address of its command-and-control server was not stored as readable text or encrypted data, but encoded in the number of spaces on each line of a Windows `desktop.ini` file. | Malware blog | GENDIGITAL |
|
22.8.26 |
WordlistLoader Delivering Amatera via ClearFake Campaigns | Over the past few months, Amatera Stealer (also often referred to as ACR Stealer) has been actively developed and has gradually become one of the most prevalent infostealer in our user base. Most recently, we've been observing Amatera being distributed via ClearFake campaigns leveraging FakeCaptchas. | Malware blog | GENDIGITAL |
|
15.8.26 |
ClickFix campaign abuses Deno runtime for infostealer delivery | Lures on compromised WordPress sites led to installation of Deno and a Python-based infostealer | Malware blog | SOPHOS |
|
15.8.26 |
A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace | A hand-written Windows backdoor stored its command-and-control domain as the number of trailing spaces in a fake desktop.ini, and we found it on exactly one machine. | Malware blog | GENDIGITAL |
|
15.8.26 |
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide | A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. | Malware blog | Microsoft blog |
|
15.8.26 |
ChainDrop supply chain compromise: Anatomy of a self-propagating worm | A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates | Malware blog | Microsoft blog |
|
15.8.26 |
A Deep-Dive into the Multi-Stage .NET Loader Chain Delivering LokiBot | Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers the LokiBot information stealer via a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, layered decryption, and process hollowing to evade detection before executing the final native LokiBot payload. | Malware blog | SonicWall |
|
15.8.26 |
Signed, sealed, injected: The mechanics of DCRat in 2026 | This DCRat campaign shows how attackers combine phishing lures, DLL sideloading, and process hollowing to attempt to slip past defenses and gain full remote access. | Malware blog | TRELLIX |
|
7.8.26 |
Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools | Infostealers are a rapidly evolving threat, enabling various adversaries, ranging from ransomware groups and hacktivists to nation-state actors, to exploit stolen credentials for unauthorized access to sensitive resources. In today’s threat landscape, identity is a primary target, with attackers seeking diverse credentials including usernames, passwords, tokens, and seed phrases. | Malware blog | SOCRADAR |
|
7.8.26 |
Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005) | AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and In March 2026, Hauri disclosed an attack case in which the malware was disguised as an integrated security program. | Malware blog | AHNLAB |
|
6.8.26 |
Malware signing: When trust becomes an attack surface | How cybercriminals use stolen, fraudulent, and commercialized code-signing certificates to make malware appear legitimate and bypass traditional trust controls. | Malware blog | BARRACUDA |
|
8.8.26 |
Wallet-depleting macOS malware wants your crypto | During a retrospective threat hunt in June 2026, a Huntress analyst found components of a Mac-specific stealer malware on a monitored system that had been infected three months earlier. | Malware blog | Huntress |
|
8.8.26 |
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages | Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAINDROP, a worm that uses stolen npm credentials to backdoor co-owned packages totaling over 1.3 billion monthly downloads. | Malware blog | ELASTIC |
|
8.8.26 |
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide | A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. | Malware blog | Microsoft blog |
|
8.8.26 |
ChainDrop supply chain compromise: Anatomy of a self-propagating worm | A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates. | Malware blog | Microsoft blog |
|
8.8.26 |
MythStealer: Browser and Discord Credential Theft with HTTPS Exfiltration to Operator-Notified C2 | The Sonicwall Threats research team have recently been tracking an information-stealer malware family known as Myth. The sample we analyzed is a 43.8 MB Windows executable combining browser credential theft, Discord session token extraction, Firefox cookie harvesting, and HTTPS exfiltration into a single binary. | Malware blog | SonicWall |
|
8.8.26 |
ChainDrop: Inside a Self-Propagating npm Worm | A self-propagating npm worm nicknamed ChainDrop infected over 400 packages that are collectively downloaded hundreds of millions of times each week. This includes malicious versions of widely used packages such as keyv and cacheable-request. Unit 42 has unique observations of this attack. | Malware blog | Palo Alto |
|
1.8.26 |
Not Every Fox is Silver: Inside an AtlasRAT loader chain | AtlasRAT is a Windows-based remote access malware. This report analyzes a four-stage in-memory loader chain—which begins with a Delphi executable that is disguised as AGE Flash Player—and its final RAT functionality. The final payload performs TLS-based ChaCha20-encrypted C2 communication, executes modular plugins, performs offline keylogging, and injects DLLs into WeChat processes. | Malware blog | AHNLAB |
|
1.8.26 |
Fake Claude Install Guide Leads to MacSync Stealer and RAT: What We Pulled From the Attacker’s Servers | Huntress recently investigated an incident where the victim searched Google for how to install Claude on a Mac, clicked a sponsored result, and landed on a weaponised claude.ai/share conversation dressed up as an Apple Support install guide. It told them to open Terminal and paste a single curl command. | Malware blog | Huntress |
|
1.8.26 |
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT | Between July 21 and July 22, 2026, Huntress' Security Operations Center (SOC) lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe. The attacks had one common denominator: victims had searched for the Claude desktop app and were taken to a malicious public Claude Artifact on the actual Claude AI domain, which appeared to be a legitimate download link for the desktop app. | Malware blog | Huntress |
|
1.8.26 |
Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called | While conducting routine open-source research, NetAskari identified a malicious Android APK impersonating a Chinese Provincial Public Security Bureau service app. Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰). Hunt.io researchers pivoted on TLS certificates and panel fingerprints to identify 170 servers running the framework, and uncovered a fractured criminal ecosystem built around its leaked codebase. | Malware blog | HUNT.IO |
|
1.8.26 |
Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection | Summary Arctic Wolf Labs has been tracking a cluster of campaigns built around CastleLoader, a multi-stage shellcode loader that has served as the backbone of | Malware blog | ARTICWOLF |
|
1.8.26 |
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor | Zscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging vishing techniques through Microsoft Teams and deploying a variety of tools including a Go-based backdoor that we named GoGRPC. | Malware blog | Zscaler |
|
1.8.26 |
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version | After months of dormancy, the attackers behind the XCSSET malware released version 40 (v40), targeting the macOS ecosystem. This version’s advanced architecture hides its core logic in memory space, reducing its digital footprint. | Malware blog | Palo Alto |
|
25.7.26 |
Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel | The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN. | Malware blog | CISCO TALOS |
|
18.7.26 |
Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain | Introduction Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase infection success rates. The threat actors impersonated legitimate government departments and distributed malicious emails disguised as official notifications related to taxation,... | Malware blog | Seqrite |
|
18.7.26 |
ACR Stealer: Two observed intrusion chains amid increased threat activity | From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. | Malware blog | Microsoft blog |
|
18.7.26 |
The PhantomGate Campaign — Obfuscation, Persistence, and Covert Surveillance | This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of PhantomGate malware. This family uses a series of obfuscated .LNK and .BAT files to download a malicious binary via PowerShell commands. Embedded payloads provide additional functionality for controlling webcams and capturing audio, using legitimate libraries to help bypass security. | Malware blog | SonicWall |
|
18.7.26 |
The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) | The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape. | Malware blog | Palo Alto |
|
18.7.26 |
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign | Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. | Malware blog | CISCO TALOS |
| 11.7.26 | RedHook Returns with a Dangerous Upgrade | Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack. | Malware blog | GROUP-IB |
| 11.7.26 | Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App | CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control. | Malware blog | Cyble |
| 11.7.26 | GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware | GigaWiper is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform. | Malware blog | Microsoft blog |
| 11.7.26 | Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation | In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. | Malware blog | Palo Alto |
| 11.7.26 | UAT-7810 continues building ORB networks using new malware | Talos’ latest findings on UAT-7810 indicate that the threat actor continues to develop their custom-made malware. | Malware blog | CISCO TALOS |
| 4.7.26 | Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App | CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control. | Malware blog | Cyble |
| 4.7.26 | Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud | In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analyzing server-side artifacts and victim-side data. | Malware blog | Trend Micro |
| 4.7.26 | Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware | Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. | Malware blog | Trend Micro |
| 4.7.26 | TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry | In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved. | Malware blog | Trend Micro |
| 4.7.26 | Android Arsink RAT Revisited Targeting User Credentials | The SonicWall Capture Labs threat research team identified an ongoing Android Remote Access Trojan (RAT) campaign that employs multiple techniques to harvest sensitive user information through phishing and data exfiltration activities by impersonating the actual app icons and using similar names. | Malware blog | SonicWall |
| 27.6.26 | Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. | Malware blog | GTI | |
| 27.6.26 | Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker | Stealthy new backdoor used in cybercrime intrusions since April 2026 may be associated with Woodgnat (aka KongTuke), an initial access broker whose ModeloRAT toolkit has fed Qilin and other ransomware operations. | Malware blog | SECURITY.COM |
| 27.6.26 | StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them | On June 24, 2026, Microsoft’s Digital Crimes Unit (DCU) facilitated the takedown, suspension, and blocking of domains that formed the backbone of the StealC and Amadey infrastructure. | Malware blog | Microsoft blog |
| 27.6.26 | ESET takes part in Operation Endgame to disrupt Amadey and Stealc | ESET researchers assisted in the global disruption of the Amadey botnet and Stealc infostealer, providing technical analysis, infrastructure tracking, and affiliate-level insights | Malware blog | Eset |
| 19.6.26 | FishMonger’s arsenal upgraded: SprySOCKS for Windows | Malware blog | Eset | |
| 13.6.26 | GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers | Gen Threat Labs has been tracking GoFlateLoader, a widespread Golang loader used to deliver multiple infostealers, including Amatera, Remus, Lumma, Vidar and StealC. | Malware blog | GENDIGITAL |
| 6.6.26 | New Malware Targeting Minecraft Infects 2K Daily, and Teens are Becoming Attackers | If you or your child plays Minecraft, here's what you need to know about a large-scale malware campaign McAfee Labs just uncovered, and what to do about... | Malware blog | MCAFEE |
| 6.6.26 | OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight | Cyble analyzes OverlayPhantom, an Android banking trojan targeting 180+ apps across 10 countries, stealing credentials via fake overlays and real-time screen streaming. | Malware blog | Cyble |
| 6.6.26 | Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell | We are tracking an increasingly widespread malvertising campaign targeting macOS. This campaign appears to be the next stage of a previous campaign known as JSCoreRunner, which was first identified in August 2025. | Malware blog | Palo Alto |
| 30.5.26 | OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight | Cyble analyzes OverlayPhantom, an Android banking trojan targeting 180+ apps across 10 countries, stealing credentials via fake overlays and real-time screen streaming. | Malware blog | Cyble |
| 30.5.26 | BTMOB: A stealthy RAT burrowing deep into Android devices | The malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise | Malware blog | Eset |
| 23.5.26 | JOMANGY: INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign | CRIL uncovers JOMANGY, a stealth PHP webshell by INJ3CTOR3 with 6 persistence layers and self-healing cron jobs built to survive host cleanup. | Malware blog | Cyble |
| 23.5.26 | Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware | Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. | Malware blog | Trend Micro |
| 23.5.26 | Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud | In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analyzing server-side artifacts and victim-side data. | Malware blog | Trend Micro |
| 23.5.26 | Next.js WebSocket Upgrade Handler SSRF | The SonicWall Capture Labs threat research team became aware of a Server-Side Request Forgery vulnerability in Next.js, assessed its impact and developed mitigation measures. Next.js enables organizations to create full-stack web applications by extending the latest React features and integrating powerful Rust-based JavaScript tooling for the fastest builds. | Malware blog | SonicWall |
| 23.5.26 | Tracking TamperedChef Clusters via Certificate and Code Reuse | This article documents novel activity clusters that have significant overlap with the publicly described threat known as TamperedChef (aka EvilAI). TamperedChef-style malware is trojanized productivity software, such as PDF editors or calendars, that deliver malicious payloads. | Malware blog | Palo Alto |
| 23.5.26 | The npm Threat Landscape: Attack Surface and Mitigations (Updated May 21) | The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape. | Malware blog | Palo Alto |
| 23.5.26 | Webworm: New burrowing techniques | ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal | Malware blog | Eset |
| 16.5.26 | Why AMOS matters: The macOS malware stealing data at scale | Sophos X-Ops looks at the Atomic macOS Stealer and its capabilities | Malware blog | SOPHOS |
| 16.5.26 | When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA | A closer look at how Bedep used foreign exchange data and advanced math to generate hard-to-predict domains, making its command-and-control infrastructure more difficult for defenders to block and disrupt | Malware blog | GENDIGITAL |
| 16.5.26 | Chasing an Angry Spark | A VM-obfuscated backdoor observed on a single machine in the UK, operated for one year, and vanished without a trace. | Malware blog | GENDIGITAL |
| 16.5.26 | Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files | This article examines new obfuscation techniques the Gremlin stealer malware uses to conceal malicious payloads within embedded resources. We analyze a variant protected by a sophisticated commercial packing utility that employs instruction virtualization, transforming the original code into a custom, non-standard bytecode executed by a private virtual machine. | Malware blog | Palo Alto |
| 9.5.26 | InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise | Targeting multiple industries worldwide, the InstallFix campaign uses fake Claude AI installer pages to trick users into running malware that collects system information, disables security features, achieves persistence, and connects to attacker-controlled C&C servers for additional payloads. | Malware blog | Trend Micro |
| 9.5.26 | Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities | TrendAI™ Research breaks down Quasar Linux (QLNX), a previously undocumented sophisticated Linux RAT with low detection rates. In this blog, we examine a full-featured Linux threat incorporating a rootkit, a PAM backdoor, credential harvesting, and more, revealing how this malware enables stealthy access, persistence, and potential supply-chain attacks. | Malware blog | Trend Micro |
| 9.5.26 | CloudZ RAT potentially steals OTP messages using Pheno plugin | Cisco Talos discovered an intrusion, active since at least January 2026, where an unknown attacker implanted a CloudZ remote access tool (RAT) and a previously undocumented plugin called “Pheno.” | Malware blog | CISCO TALOS |
| 25.4.26 | When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA | A closer look at how Bedep used foreign exchange data and advanced math to generate hard-to-predict domains, making its command-and-control infrastructure more difficult for defenders to block and disrupt | Malware blog | GENDIGITAL |
| 25.4.26 | GopherWhisper: A burrow full of malware | ESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions | Malware blog | Eset |
| 25.4.26 | PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing | PureRAT is an advanced Remote Access Trojan (RAT) characterized by its complex infection stages. The intrusion sequence is initiated by a malicious .LNK file that triggers a concealed PowerShell command to retrieve a heavily obfuscated VBS loader. | Malware blog | Trelix |
| 18.4.26 | MiningDropper – A Global Modular Android Malware Campaign Operating at Scale | CRIL analyzes a surge in an ongoing campaign to deliver MiningDropper — a modular Android malware framework - at scale. | Malware blog | Cyble |
| 18.4.26 | Chasing an Angry Spark | A VM-obfuscated backdoor observed on a single machine in the UK, operated for one year, and vanished without a trace. | Malware blog | GENDIGITAL |
| 18.4.26 | Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise | The Microsoft Defender Security Research Team uncovered a sophisticated macOS intrusion campaign attributed to the North Korean threat actor Sapphire Sleet that abuses user driven execution and social engineering to bypass macOS security protections and steal credentials, cryptocurrency assets, and sensitive data. | Malware blog | Microsoft blog |
| 18.4.26 | ACRStealer The Silent Golang Threat Behind Credential and Wallet Theft | This week the SonicWall Capture Labs Threat Research Team analyzed a sample of ACRStealer, a Golang Malware-as-a-Service used by ShieldIO. This uses a binary to sideload a malicious DLL and evade AV products, harvest credentials for browsers and FTP programs, and target a number of crypto-wallets. It is highly evasive and uses a variety of techniques to prevent analysis. | Malware blog | SonicWall |
| 18.4.26 | Cracks in the Bedrock: Agent God Mode | Our first article about the boundaries and resilience of Amazon Bedrock AgentCore focused on the Code Interpreter sandbox, and how it can be bypassed using DNS tunneling. In this second part, we delve into the identity and permissions model of AgentCore and the AgentCore starter toolkit. | Malware blog | Palo Alto |
| 18.4.26 | DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense | This blog explores how Trellix Network Detection and Response (NDR) moves beyond static signatures to detect these attempts by focusing on the underlying behavioral patterns of the attack technique itself. | Malware blog | Trelix |
| 11.4.26 | Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer | When the security industry talks about information stealers, Lumma Stealer, without a doubt, has become the notorious icon of this landscape. Not only could it count itself among the most sophisticated, technically advanced, and widespread stealers-as-a-service in the world, but it was also described in a variety of blog posts from basically everyone in the industry, including us. | Malware blog | GENDIGITAL |
| 11.4.26 | Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do | Threat actors leveraged Anthropic’s Claude Code npm release packaging error to distribute Vidar, GhostSocks, and PureLog Stealer. This blog details immediate steps organizations can take and best practices to prevent further risk. | Malware blog | Trend Micro |
| 11.4.26 | Unpacking the Nursultan Client PyInstaller Telegram Malware | The SonicWall Capture Labs threat research team identified a PyInstaller-packed Windows executable distributed as "NursultanClient" — a full-featured Telegram RAT targeting Windows systems. | Malware blog | SonicWall |
| 11.4.26 | New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations | Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.” | Malware blog | CISCO TALOS |
| 4.4.26 | Building on recent BRICKSTORM research from Google Threat Intelligence Group (GTIG), this post explores the evolving threats facing virtualized environments. These operations directly target the VMware vSphere ecosystem, specifically the vCenter Server Appliance (VCSA) and ESXi hypervisors. To help organizations stay ahead of these risks, we will focus on the essential hardening strategies and mitigating controls necessary to secure these critical assets. | Malware blog | GTI | |
| 28.3.26 | Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities | This blog discusses the steganography, cloud abuse, and email-based backdoors used against the Ukrainian defense supply chain in the latest Pawn Storm campaign that TrendAI™ Research observed and analyzed. | Malware blog | Trend Micro |
| 21.3.26 | Android devices ship with firmware-level malware | Keenadu malware gives an attacker control over a device but appears to be used primarily to facilitate ad fraud | Malware blog | SOPHOS |
| 21.3.26 | New Malware Highlights Increased Systematic Targeting of Network Infrastructure | New Malware Highlights Increased Systematic Targeting of Network Infrastructure | Malware blog | Eclypsium |
| 21.3.26 | Libyan Oil Refinery Among Targets in Long-running Likely Espionage Campaign | The modular backdoor AsyncRAT was deployed on targeted networks. | Malware blog | SECURITY.COM |
| 21.3.26 | New Malware Targets Users of Cobra DocGuard Software | Novel, parasitic threat cleverly uses Cobra DocGuard’s functionality and hunts for documents related to ballistic missiles. | Malware blog | SECURITY.COM |
| 21.3.26 | Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries | We look into a stealthy multi‑stage attack campaign that delivers PureLog Stealer entirely in memory using encrypted, fileless techniques. | Malware blog | Trend Micro |
| 21.3.26 | An In-Depth Look at Scarface Stealer | This week, the SonicWall Capture Labs Threat Research team analyzed a sample of ScarfaceStealer, a Go-compiled information stealer that utilizes sophisticated anti-analysis techniques including | Malware blog | SonicWall |
| 21.3.26 | Transparent COM instrumentation for malware analysis | In this article, Cisco Talos presents DispatchLogger, a new open-source tool that delivers high visibility into late-bound IDispatch COM object interactions via transparent proxy interception. | Malware blog | CISCO TALOS |
| 14.3.26 | Evil evolution: ClickFix and macOS infostealers | Across three recent campaigns, Sophos X-Ops notes shifts in both lures and malware capabilities, as threat actors leveraging ClickFix techniques increasingly target macOS users with infostealers | Malware blog | SOPHOS |
| 14.3.26 | The Future of Supply Chain Backdoor Detections | The XZ Utils backdoor (CVE-2024-3094) was discovered in March 2024 and is an example of a software supply chain attack that would have allowed hackers in possession of a specific private key to connect to the backdoored system and run their own commands as an administrator. | Malware blog | Eclypsium |
| 14.3.26 | Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites | Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique. | Malware blog | Trend Micro |
| 14.3.26 | Malware-As-A-Service Redefined: Why XWorm is outpacing every other RAT in the underground malware market | XWorm has surged to the #3 global threat, using stealthy memory-only execution and the WinRAR CVE-2025-8088 exploit to bypass traditional security stacks. | Malware blog | Trelix |
| 14.3.26 | Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution | This blog examines a Remcos campaign demonstrating the transition from phishing-based initial access to fully fileless execution. | Malware blog | Trelix |
| 7.3.26 | ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader | Cyble has identified a new Linux threat named ClipXDaemon that targets cryptocurrency users by intercepting and manipulating copied wallet addresses. | Malware blog | Cyble |
| 7.3.26 | New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages | The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. | Malware blog | Trend Micro |
| 7.3.26 | PDF-Borne Living-off-the-Land Attacks with RMM Abuse | PDF files have long been abused by attackers to evade security detections and to deliver malware payloads. This time SonicWall Capture Labs threat research team has observed four distinct campaigns where PDF-based social engineering techniques being used to deliver remote monitoring and management (RMM) software for unauthorized system access. These tools, while legitimate in managed IT environments, become powerful weapons when deployed without user consent. | Malware blog | SonicWall |
| 7.3.26 | Inside a New VioletRAT Campaign: Multi Staged Delivery and Stealthy Payload Execution | Recently, the SonicWall Capture Labs threat research team observed a new campaign spreading Violet RAT using a multistage Python-based APC injection technique. The campaign employs a multi-stage delivery chain that involves archives, batch scripts, and a Python loader to deploy the final payload via shellcode injection. The complete infection chain can be visualized in the following figure 1. | Malware blog | SonicWall |
| 28.2.26 | SURXRAT: From ArsinkRAT roots to LLM Module Downloads Signaling Capability Expansion | Cyble uncovers SURXRAT’s evolution across versions, built on ArsinkRAT code, and now downloading large LLM modules signaling an expansion of its operational capabilities. | Malware blog | Cyble |
| 28.2.26 | Inside a New VioletRAT Campaign: Multi Staged Delivery and Stealthy Payload Execution | Recently, the SonicWall Capture Labs threat research team observed a new campaign spreading Violet RAT using a multistage Python-based APC injection technique. The campaign employs a multi-stage delivery chain that involves archives, batch scripts, and a Python loader to deploy the final payload via shellcode injection. The complete infection chain can be visualized in the following figure 1. | Malware blog | SonicWall |
| 28.2.26 | New Dohdoor malware campaign targets education and health care | Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.” | Malware blog | CISCO TALOS |
| 21.2.26 | Uncovering a Recent Pulsar RAT Sample in the Wild | This week, the SonicWall Capture Labs Threat Research Team analyzed an obfuscated .NET trojan frequently used in malicious campaigns. Pulsar RAT, is an open-sourced remote access tool that was derived from another open-sourced RAT named Quasar. Pulsar adds updated capabilities such as hooking clipboard changes, capturing webcam images, UAC bypass, and sending results back to attackers. | Malware blog | SonicWall |
| 21.2.26 | PromptSpy ushers in the era of Android threats using GenAI | ESET researchers discover PromptSpy, the first known Android malware to abuse generative AI in its execution flow | Malware blog | Eset |
| 14.2.26 | New threat actor, UAT-9921, leverages VoidLink framework in campaigns | Cisco Talos recently discovered a new threat actor, UAT-9221, leveraging VoidLink in campaigns. Their activities may go as far back as 2019, even without VoidLink. | Malware blog | CISCO TALOS |
| 7.2.2026 | Malicious use of virtual machine infrastructure | Bulletproof hosting providers are abusing the legitimate ISPsystem infrastructure to supply virtual machines to cybercriminals | Malware blog | SOPHOS |
| 7.2.2026 | Inside a Multi-Stage Android Malware Campaign Leveraging RTO-Themed Social Engineering | In recent years, Android malware campaigns in India have increasingly abused the trust associated with government services and official digital platforms. By imitating well-known portals and leveraging social engineering through messaging applications, threat actors exploit user urgency and lack... | Malware blog | Seqrite |
| 7.2.2026 | Fake Installer: Ultimately, ValleyRAT infection | In this Threat Analysis Report, Cybereason explores the fake installer, ValleyRAT | Malware blog | Cybereason |
| 1.2.26 | ShadowHS: A Fileless Linux Post‑Exploitation Framework Built on a Weaponized hackshell | Cyble uncovers ShadowHS, a stealthy fileless Linux framework running entirely in memory for covert, adaptive post‑exploitation control. | Malware blog | Cyble |
| 1.2.26 | PureRAT: Attacker Now Using AI to Build Toolset | Vietnam-based cybercrime actor appears to now be using AI to write scripts used in phishing campaigns | Malware blog | SECURITY.COM |
| 1.2.26 | njRAT: A Persistent Commodity Threat in the Modern Landscape | The SonicWall Capture Labs threat research team continues to monitor the activity of the infamous njRAT (also known as Bladabindi), a prolific Remote Access Trojan (RAT) that remains a staple in the toolkit of various threat actors. | Malware blog | SonicWall |
| 1.2.26 | KONNI Adopts AI to Generate PowerShell Backdoors | Check Point Research (CPR) identified an ongoing phishing campaign that we associate with KONNI, a North Korean–linked threat actor active since at least 2014. KONNI is best known for targeting organizations and individuals in South Korea, with a focus on diplomatic channels, international relations, NGOs, academia, and government. | Malware blog | |
| 1.2.26 | DynoWiper update: Technical analysis and attribution | ESET researchers present technical details on a recent data destruction incident affecting a company in Poland’s energy sector | Malware blog | Eset |
| 1.2.26 | Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan | ESET researchers discover an Android spyware campaign targeting users in Pakistan via romance scam tactics, revealing links to a broader spy operation | Malware blog | Eset |
| 1.2.26 | ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 | Malware blog | Eset | |
| 24.1.26 | TamperedChef serves bad ads, with infostealers as the main course | Sophos X-Ops explores a malvertising campaign that leverages Google Ads to distribute an infostealer | Malware blog | SOPHOS |
| 24.1.26 | Inside a Multi-Stage Windows Malware Campaign | FortiGuard Labs analysis of a multi-stage Windows malware campaign that abuses trusted platforms to disable defenses, deploy RATs, and deliver ransomware. | Malware blog | FORTINET |
| 24.1.26 | Check Point Research is tracking an active phishing campaign involving KONNI, a North Korea-affiliated threat ... | Malware blog | ||
| 24.1.26 | Check Point Research has identified VoidLink, one of the first known examples of advanced malware ... | Malware blog | ||
| 24.1.26 | Weaponized WinRAR Exploitation and Stealth Deployment of Fileless .NET RAT | EXECUTIVE SUMMARY At CYFIRMA, we continuously monitor emerging threat techniques that abuse trusted software and routine user behavior to achieve stealthy system compromise. | Malware blog | Cyfirma |
| 24.1.26 | VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun | Check Point Research (CPR) believes a new era of AI-generated malware has begun. VoidLink stands as the first evidently documented case of this era, as a truly advanced malware framework authored almost entirely by artificial intelligence, likely under the direction of a single individual. | Malware blog | |
| 17.1.26 | New Remcos Campaign Distributed Through Fake Shipping Document | FortiGuard Labs analyzes a phishing campaign delivering a fileless Remcos RAT via malicious Word templates, CVE-2017-11882 exploitation, and in-memory execution. | Malware blog | FORTINET |
| 17.1.26 | Uncovering Hidden Forensic Evidence in Windows: The Mystery of AutoLogger-Diagtrack-Listener.etl | FortiGuard IR uncovers forensic insights in Windows AutoLogger-Diagtrack-Listener.etl, a telemetry artefact with untapped investigative value. | Malware blog | FORTINET |
| 17.1.26 | deVixor: An Evolving Android Banking RAT with Ransomware Capabilities Targeting Iran | Cyble analyzed deVixor, an advanced Android banking RAT with ransomware features actively targeting Iranian users. | Malware blog | |
| 17.1.26 | SOLYXIMMORTAL : PYTHON MALWARE ANALYSIS | EXECUTIVE SUMMARY SolyxImmortal is a Python-based Windows information-stealing malware that combines credential theft, document harvesting, keystroke logging, screen surveillance, | Malware blog | |
| 17.1.26 | Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response | Threat actors exploited Cloudflare's free-tier infrastructure and legitimate Python environments to deploy the AsyncRAT remote access trojan, demonstrating advanced evasion techniques that abuse trusted cloud services for malicious operations. | Malware blog | |
| 17.1.26 | Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework | VoidLink is an advanced malware framework made up of custom loaders, implants, rootkits, and modular plugins designed to maintain long-term access to Linux systems. The framework includes multiple cloud-focused capabilities and modules, and is engineered to operate reliably in cloud and container environments over extended periods. | Malware blog | |
| 10.1.26 | Unpacking the packer ‘pkr_mtsi’ | This RL Researcher’s Notebook highlights the packer’s evolution — and offers a YARA rule to detect all versions. | Malware blog | REVERSINGLABS |
| 10.1.26 | Ladvix: Inside a Self-Propagating ELF Malware with IoT Botnet Traits | This week, the SonicWall Capture Labs Threat Research team analyzed a sample of a malicious ELF file infector that shares characteristics of IoT botnet malware. The sample demonstrates self-propagation capabilities, file system scanning, and selective infection mechanisms targeting other ELF binaries. | Malware blog | SonicWall |
| 10.1.26 | VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion | This article details our technical analysis of VVS stealer, also styled VVS $tealer, including its distributors’ use of obfuscation and detection evasion. | Malware blog | Palo Alto |