Malware Blog- 2026 2025 2024 2023 2021 2020 2019 2018
AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
DATE | NAME | Info | CATEG. | WEB |
|
13.10.26 |
Inside ICMacOS: From an Infostealer to a Persistent RAT | Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly one in three software developers works on macOS. | Malware blog | SOCRADAR |
|
10.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Malicious Crypto Shell Packages Target RubyGems | A threat actor calling themselves "Ghost Dev" published 42 malicious typo squat packages to the RubyGems registry targeting crypto and web3 packages | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
How to Investigate a GitHub Repo's Real History | Learn to reconstruct what actually happened to a compromised repo using timestamps and logs that the person doing the manipulation doesn't control. | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Novinarya: An Android stealer that hides its live C2 in a shop bio | Scan this sample for a command server and you find nothing: no URL, no IP, nothing to block. That is the whole idea. Behind a fake “Smart System Security” app, this Iranian banking and crypto stealer keeps its server out of the binary and reads it at run time from the bio of a seller’s profile on a legitimate marketplace, rotating it with a single edit no new sample needed. | Malware blog | STAR Labs |
|
10.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The LevelBlue Operational Cyber Threat Intelligence (OpsCTI) Team recently observed a ClickFix campaign delivering Remus Stealer through compromised websites. | Malware blog | LEVELBLUE |
|
10.10.26 |
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack | Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware. | Malware blog | Socket |
|
10.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Malware blog | TrendAI (US) |
|
10.10.26 |
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It | tensorlake@0.5.144 on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes your home directory. | Malware blog | StepSecurity |
|
10.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
10.10.26 |
Trojanized Terraform Provider Campaign | In July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), an advanced persistent threat actor backed by the North Korean government that has targeted the cryptocurrency industry for years. | Malware blog | ThreatLabz |
|
10.10.26 |
MATCHBOIL: New tricks, same old evil intentions | ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026 | Malware blog | Eset |
|
7.10.26 |
Q3 2026 Open Source Malware Index: When Compromise Compounds | In the third quarter of 2026, Sonatype identified 149,329 malicious open source packages across ecosystems, bringing the total logged since tracking began in 2017 to 1,960,846. | Malware blog | SONETYPE |
|
7.10.26 |
SMTP is the key: BPFDoor and AVERAT hitting the network edge | Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese appliances. | Malware blog | RAPID7 |
|
7.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | On 31 August 2026 Group-IB described BraZetsu, a Python framework for Windows compiled with Nuitka, and attributed it with high confidence to the Brazilian actor Exilware. The same paper ties the binary to the Infected Marketplace (Banco de Infects), a shop that inventories compromised Windows hosts and sells the access after a deposit of about $5.80 (BRL 30), settled through NowPayments. | Malware blog | HUNT.IO |
|
7.10.26 |
CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery | ClickFix campaigns have become one of the most effective ways to turn a browser session into code execution. The technique is simple: show the victim a fake verification page, place a command on the clipboard, and convince them to paste it into the Windows Run dialog. | Malware blog | Flare |
|
6.10.26 |
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure | How ClingSTUN combines vulnerability exploitation, persistence, and STUN-assisted connectivity on Linux devices | Malware blog | FortiGuard Labs |
|
3.10.26 |
PolinRider is A/B Testing its Way Past Your Detections | We've seen fa-solid-400.woff2 become 500 and 900, change from .woff2 to .llf files, move folders, and drop its whitespace padding. | Malware blog | OpenSource Malware Blog |
|
3.10.26 |
DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm - Real-time Open Source Software Supply Chain Security | Nine npm packages hide a self-spreading Linux worm. The npm account dirtyblanket published all nine on September 29, 2026, in 33 minutes. Eight of them copy the popular Express framework. One copies React. | Malware blog | SAFEDEP.IO |
|
3.10.26 |
Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes | Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise. | Malware blog | StepSecurity |
|
3.10.26 |
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino | Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace clandestino único, mejorado con IA, para comercializar objetivos comprometidos en Iberoamérica y Latinoamérica. | Malware blog | GROUP-IB |
|
3.10.26 |
SmokeLoader Malware: A Modular Threat with Advanced Evasion and Persistence | This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of SmokeLoader malware. This is a modular program used by a variety of criminal and APT groups to gain a foothold on a system. It has vigorous anti-VM, anti-AV, and anti-analysis checks and capabilities. SmokeLoader can be used with RATs, ransomware, backdoors or botnets and uses both file and fileless methods of persistence. | Malware blog | SonicWall |
|
3.10.26 |
VioletRAT v6.5: From .NET Loader to In-Memory RAT — A Deep Dive into the Infection Chain | Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers VioletRAT v6.5 through a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, an obfuscated batch script, in-memory assembly loading, and process injection into Msbuild.exe before executing the final VioletRAT payload. | Malware blog | SonicWall |
|
30.9.26 |
TOPHIT Part 2: Renting the Attack Surface | CloudSEK found an attacker's control panel targeting vast.ai, a GPU rental marketplace. It rents containers beside victims to scan their networks. It reached one unprotected notebook and planted no miners. The panel exposed its own source code. | Malware blog | CloudSEK |
|
30.9.26 |
TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2 | CloudSEK found 85 malicious npm packages, published in three minutes, likely named to surface in search when developers mistype popular libraries. They give attackers remote command access. The same server hosts a GPU-hijacking panel. No victims confirmed. | Malware blog | CloudSEK |
|
30.9.26 |
MALFEX - A malicious npm postinstall no advisory has caught for fourteen months | CloudSEK uncovered MALFEX, a long-running npm supply-chain campaign linked to a single operator, using malicious packages to deploy RATs and credential stealers. Two packages remain installable, including one malicious postinstall that evaded advisories for 14 months. | Malware blog | CloudSEK |
|
29.9.26 |
PhantomSub: Malicious npm Campaign Hits WhatsApp Users | 490K downloads, quiet follower inflation, and a mysterious Dan from Indonesia. OX Research is tracking a malicious npm campaign making spam accounts look legitimate. The attackers use Baileys to silently make developers follow spam channels on WhatsApp. | Malware blog | OX SECURITY |
|
27.9.26 |
A stalker in the box: infrastructure linking PandorahVNC and Mesh Central | Hidden Virtual Network Computing (HVNC) is a sophisticated form of remote access designed for stealthy control over an infected system. Unlike traditional VNC tools, HVNC operates covertly, ensuring that the infected user’s desktop environment remains unchanged and unsuspecting while the attacker manipulates a hidden desktop session. | Malware blog | INTRINSEC |
|
27.9.26 |
Inside Corp MDM, the Android spyware targeting logistics companies | A malware campaign targeting the logistics sector used fake Google Play pages branded as CEVA and TKW Logistics to distribute an Android Package Kit (APK) file disguised as a system service. The delivered app, package com.corp.mdm, is a compact surveillance implant designed to exfiltrate newly received SMS content, divert calls, and maintain a hidden foreground service. | Malware blog | Have I Been Squatted |
|
26.9.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | DARKATLAS.IO |
|
26.9.26 |
Redundant by Design: Dissecting a Multi-RAT Phishing Campaign Targeting Canadian Businesses | Blackpoint’s Adversary Pursuit Group (APG) identified a phishing campaign targeting Canadian organizations that used a single delivery framework to deploy DCRat, Violet RAT, PureRAT, and AnyDesk. | Malware blog | Blackpoint Cyber |
|
26.9.26 |
SLEEPWALKER: A Passive Backdoor With Its Own Command Language | Losing access to VirusTotal Intelligence at the start of the year was surprisingly productive. Unable to hunt for interesting new malware, I stopped adding to my “TODO” pile and finally worked through my backlog from last year. That led to a detailed examination of BeheMOF as well as the discovery of this malware. | Malware blog | LUMEN |
|
26.9.26 |
Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes | Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise. | Malware blog | StepSecurity |
|
26.9.26 |
GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign | CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. | Malware blog | CloudSEK |
|
26.9.26 |
SleepyDuck Returns: 2 fake Solidity Open VSX extensions hide a backdoor in an MP | In November 2025, we analyzed a small backdoor loose on Open VSX. SleepyDuck was unremarkable in every way but one: its header was an ASCII-art duck, and its C2 was a Solana smart contract the loader polled for tasking. It was a JavaScript file, a few kilobytes, executing fetched code in memory — a toy with a mascot. | Malware blog | Yeeth Security |
|
26.9.26 |
Meet AvisLoader: A Windows Loader Built to Outlast a Takedown | Varonis Threat Labs discovered AvisLoader, a new Windows malware loader built to keep its command-and-control (C2) channel beyond the reach of traditional domain takedowns. | Malware blog | VARONIS |
|
26.9.26 |
The Psychedelic Stealer: When a CAPTCHA Becomes an Installer | Arctic Wolf Labs is tracking a fake Cloudflare CAPTCHA campaign delivering Psychedelic Stealer, malware which steals browser passwords, account tokens, and wallet data. | Malware blog | Arctic Wolf |
|
24.9.26 |
RemControl: AI Built the Overlays. Victims Lose their PINs | Group-IB uncovers RemControl, a new Android banking trojan targeting European, Middle Eastern and Canadian banks, whose criminal infrastructure was unknowingly built by AI. | Malware blog | GROUP-IB |
|
24.9.26 |
sckit: A New Go Implant Framework for Supply Chain Worms - Real-time Open Source Software Supply Chain Security | sckit, also known as the “supplychain.local worm”, is a Go implant framework that we found in two MemTensor packages on September 23, 2026. It runs on Linux, macOS, and Windows. It collects credentials from developer machines and from CI jobs. It receives signed tasks from a command and control (C2) server. | Malware blog | SAFEDEP.IO |
|
23.9.26 |
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer | Huntress spotted the DarkMe malware in two separate incidents affecting different organizations on August 31, 2026. | Malware blog | Huntress |
|
22.9.26 |
August 2026 Infostealer Trend Report - ASEC | This report summarizes the distribution channels, number of Infostealers, number of detections, and companies disguised as targets by new Infostealers collected during the month of August 2026. | Malware blog | Zscaler |
|
18.9.26 |
LabubaRAT Threat Snapshot | LabubaRAT is a custom, unsigned 64-bit Rust-based remote access trojan (RAT) identified by the Blackpoint Adversary Pursuit Group (APG), designed to masquerade as legitimate NVIDIA software while providing a full remote access feature set including command execution, file operations, screen capture, and SOCKS5 proxying. | Malware blog | Blackpoint Cyber |
|
18.9.26 |
Brevo supply chain attack hits 100k+ sites with Wordpress backdoors and Clickfix malware | The recent Brevo security incident is much larger than reported. Sansec found that attackers piggy-backed on embedded Brevo widgets to install Wordpress malware on Brevo customer sites and launch Clickfix attacks against their visitors. | Malware blog | Sansec |
|
18.9.26 |
When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts | A modern storefront can look perfectly healthy while malicious JavaScript works underneath: siphoning affiliate revenue, hijacking searches and clicks, tampering with analytics, or asking a remote server what to execute next. Pages load, products appear, and checkout works — yet the browser may be quietly doing something the site owner never authorized. | Malware blog | Cloudflare Blog |
|
18.9.26 |
One link was enough to backdoor a Chinese typing app | A single click on a link was all it took. Researchers at Gen Threat Labs found that a crafted web address could reach inside Sogou Input Method, one of the most widely used Chinese-language typing tools for Windows, and run an attacker's code on the machine behind it. The software has hundreds of millions of installations. | Malware blog | IntelFusions |
|
18.9.26 |
PolinRider Spreads Through Compromised GitHub Accounts and Packagist | Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads. | Malware blog | Socket |
|
18.9.26 |
The banana stand: brokering and managing infections across Asia using MQTT | Black Lotus Labs®, the threat research division at Lumen, uncovered BambooToken, an emerging malware family using the Message Queueing and Telemetry Transport (MQTT) to quietly control infected Windows and Linux systems. | Malware blog | LUMEN |
|
18.9.26 |
App Cloning Campaign Expands Mobile Banking Fraud | A recent investigation uncovered a mobile fraud campaign using cloned versions of Vietnam’s vWork application to distribute Gigabud, an Android banking malware linked to the GoldFactory threat group. Attackers impersonate legitimate services and use social engineering to convince victims to install malicious apps outside official stores. | Malware blog | ZIMPERIUM |
|
18.9.26 |
India Just Raised the Bar on Mobile App Security | India processes more than 10 billion UPI transactions every month. That scale made one thing inevitable: attackers would follow the money to mobile. | Malware blog | ZIMPERIUM |
|
18.9.26 |
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia | Disclosure note: ahead of publishing this research on September 9, 2026, we notified the affected organizations and the relevant national CERTs, sharing a TLP:AMBER advance copy and holding publication to allow review. | Malware blog | HUNT.IO |
|
18.9.26 |
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware | Many Black Hat and DEFCON attendees come home to an inbox full of DMs. While catching up on the expected post-conference networking last month, a Huntress researcher realized they were being targeted in an X exchange with someone posing as a crypto marketing executive. The threat actor sent a link to a real Google Doc with a custom sidebar designed to trick the recipient into downloading malware: an AMOS infostealer on macOS, or PowerShell loader chain on Windows. | Malware blog | Huntress |
|
18.9.26 |
HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack | Group-IB Blog | Group-IB Threat Intelligence analyzes HEAVYGRAM, a Telegram-based Windows backdoor attributed with moderate confidence to the Iran-linked threat actor Handala Hack. Active since Fall 2023, it has been used to surveil Iranian dissidents, journalists and government opponents, enabling remote command execution, data exfiltration, and persistence over Telegram command-and-control. | Malware blog | GROUP-IB |
|
18.9.26 |
TeleClip: A native 64-bit Telegram RAT with Multi-Coin Crypto Clipboard hijack and Keylogger | SonicWall Capture Labs threat researchers have been tracking a Telegram bot malware capable of silently stealing cryptocurrency. The malware is a cryptocurrency clipboard hijacker and keylogger written in C (GCC/MinGW, native 64-bit PE). It replaces wallet addresses copied to the clipboard with attacker-controlled addresses across 23 coin types, logs keystrokes, and exfiltrates everything exclusively via the Telegram bot API — no custom C2 domain required. | Malware blog | SonicWall |
|
18.9.26 |
Atomic macOS (AMOS) Stealer Activity | This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment. While several sources have published articles analyzing AMOS stealer, the associated indicators constantly change. This article presents a snapshot of indicators seen in early August 2026 and is designed to help readers better understand AMOS stealer. | Malware blog | Palo Alto |
|
18.9.26 |
Beware the SparroWock: The backdoor that bites, the commands that catch | ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group | Malware blog | Eset |
|
18.9.26 |
SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment | SideCopy APT now targets academia using evasive mshta-driven RAT attacks. Discover their kill chain and secure your network from latest attacks. | Malware blog | TRELLIX |
|
16.9.26 |
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions | Elastic Security Labs tracked this malicious browser extension across seven campaigns and 15 months, through Brazilian bank lures and the Ethereum smart contracts that hold its C2 configuration. | Malware blog | ELASTIC |
|
15.9.26 |
VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch | SOCRadar’s Threat Research Unit (STRU) has documented VectraRAT, a Malware-as-a-Service platform built entirely from scratch rather than forked from leaked RAT code. Renting from $250 a month, it gives operators hidden-desktop control, keylogging, clipboard hijacking, browser credential theft, and a UAC bypass that elevates with no prompt. | Malware blog | SOCRADAR |
|
12.9.26 |
I just trusted the security certificate prompt… Beware of the LegionLoader malware being distributed via the ClickFix method | The AhnLab SEcurity intelligence Center (ASEC) recently identified the LegionLoader malware, which is currently being distributed via the ClickFix method. There are two main distribution methods identified so far; both involve tricking users into visiting a malicious URL and then prompting them to directly execute malicious PowerShell commands through a fake Cloudflare CAPTCHA screen. | Malware blog | Zscaler |
|
12.9.26 |
Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers | In August 2026, FortiGuard Labs observed a Casbaneiro attack campaign targeting users in Latin America, using phishing emails and PDF files themed around fake invoices and legal notices as the initial stage. | Malware blog | FORTNITE |
|
12.9.26 |
ANY.RUN Secures Leader Status in G2’s Malware Analysis Rankings | In G2’s Fall 2026 awards, we earned both Momentum Leader and Grid Leader recognition, highlighting our continued growth and strong position in the market. Most importantly, these achievements reflect the trust security professionals place in ANY.RUN every day to support their threat investigations. | Malware blog | ANYRUN BLOG |
|
12.9.26 |
Grand Theft Auto VI Hype Leads to Malware | Threat actors are taking advantage of overeager gamers searching for a leaked version of the upcoming Grand Theft Auto VI (GTA6), using fake game downloads as an initial access lure. | Malware blog | Huntress |
|
12.9.26 |
SloppyRAT: A New Tool For Ransomware Attacks | In June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain. | Malware blog | Zscaler |
|
12.9.26 |
Dissecting a PHP web server rootkit | Sophos X-Ops takes a deep dive into an insidious piece of malware | Malware blog | SOPHOS |
|
12.9.26 |
MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures | Executive Summary MacSync Stealer is a family of macOS information stealers and remote-access stagers designed to evade detection and sold commercially under a malware-as-a-service (MaaS) model. In the attack chain, MacSync binaries are native stagers and multi-part exfiltration engines.... | Malware blog | SEQRITE |
|
12.9.26 |
From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline | Infostealer malware turns a single infection into a marketplace listing. A technical look at harvesting, stealer logs, enrichment, and resale. | Malware blog | Cyble |
|
12.9.26 |
Gray Rabbits and the Tale of a One-Click Backdoor | One click. Three critical failures. One backdoor. | Malware blog | GENDIGITAL |
|
12.9.26 |
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager | We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload. | Malware blog | CISCO TALOS |
|
9.9.26 |
Vwork: Weaponized Open-source Software as an Addon for Gigabud | How the Gigabud Android banking trojan abuses Shelter, an open-source app cloner, and what that means for banks, users, and defenders. | Malware blog | GROUP-IB |
|
8.9.26 |
HVNC Backdoor Targets LATAM Organizations with Fake Tax Lures | Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser data, monitor keystrokes, and survive system reboots. | Malware blog | ANYRUN BLOG |
|
8.9.26 |
Detection and Removal of the Syslogk Rootkit in a Linux Environment | The AhnLab SEcurity intelligence Center (ASEC) continuously monitors various threats targeting Linux environments. Techniques that modify the Linux kernel to conceal malware and signs of compromise have been used for a long time, and Syslogk is one such rootkit that operates in this manner. | Malware blog | Zscaler |
|
7.9.26 |
Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet | NPS is an open-source tunneling tool, popular with the Chinese-speaking security community. | Malware blog | Censys |
|
5.9.26 |
How Turbopack chunks your JavaScript | Open the network tab of this page and you’ll see a list of JavaScript files with seemingly random names: | Malware blog | NEXT.JS |
|
5.9.26 |
Varonis Achieves Snowflake Premier Partner Tier and Is Now Available on Snowflake Marketplace | Building a closer partnership to make it easier to secure the data and AI that customers build, run, and analyze with Snowflake. | Malware blog | VARONIS |
|
5.9.26 |
PEEP: A Browser RAT Posing as a Chrome Extension | The Threat Research Unit (STRU) at SOCRadar’s Extended Threat Intelligence (XTI) platform identified and analyzed PEEP, a Chromium-based emerging post-exploitation toolkit disguised as “Smart Bookmarks.” Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences integrity values. | Malware blog | SOCRADAR |
|
5.9.26 |
H1 2026 Malware Vulnerability Trends | H1 2026 activity showed a continued adversary preference for abusing legitimate tools, trusted platforms, and routine workflows already present in enterprise and consumer environments. Threat actors used exposed software, developer tools, remote access utilities, payment workflows, and third-party services to gain access, steal credentials, move laterally, and monetize intrusions while blending into expected activity. | Malware blog | Recorded Futures |
|
3.9.26 |
REVSTEALER ramps up: analysis of up-and-coming infostealer | REVSTEALER's credential harvesting reaches 225 browser extensions and 51 crypto wallets, its gaming session theft needs no password, and its backup C2 address sits on the Polygon blockchain waiting for the primary server to fail. | Malware blog | ELASTIC |
|
3.9.26 |
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity | Huntress | Huntress is observing the same anomalous pattern across unrelated endpoints in various organizations: rogue ScreenConnect clients repeatedly spawning wscript.exe to execute 1.vbs, 2.vbs, 3.vbs, and 4.vbs. | Malware blog | Huntress |
|
3.9.26 |
“Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing | People who initially seem fine but tend to subtly avoid others as the relationship deepens or when conflicts arise—and who disappear when pressured—are commonly referred to as “avoidant types.” By repeatedly pulling away only to reappear, they drain the other person’s emotions and energy, ultimately undermining the relationship. | Malware blog | AHNLAB |
|
2.9.26 |
Uncovering StreamRat: From Meta Ads to Full Device Takeover | ThreatFabric researchers have uncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaign reaching approximately 570,000 potential victims. | Malware blog | THREATFABRIC |
|
31.8.26 |
Anthropic Links Claude Session Theft to Infostealer Malware | An affected Claude user has shared a warning from Anthropic stating that infostealer malware can steal active Claude login sessions from infected computers. Attackers can reuse these sessions to access accounts and consume available usage without completing the normal sign-in process again. | Malware blog | |
|
31.8.26 |
Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem | Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets. | Malware blog | GROUP-IB |
|
30.8.26 |
TerminalFix campaign deploys a reverse tunnel through multistage intrusion | Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake Cloudflare CAPTCHA verification overlay that tricks users into copying and executing a malicious PowerShell command. | Malware blog | Microsoft blog |
|
29.8.26 |
Mobile Fraud in 2026: Malware is Actively Targeting Mobile Banking Apps in LATAM |
Our most recent malware threat research from Zimperium’s zLabs research team revealed 34 malware families targeting 1,243 mobile banking and fintech apps across 90 countries globally. |
||
|
29.8.26 |
WindRelay Combines NFC Relay Malware and Remote Access for Mobile Fraud |
A recent analysis reveals WindRelay, a new Android NFC relay malware deployed alongside the SpyNote remote access trojan to enable sophisticated mobile fraud. Attackers use live social engineering calls to convince victims to install a personalized RAT, then remotely deploy WindRelay without additional user interaction. |
||
| 29.8.26 | Gryxa: The AI-Built Toolkit That Watches How You Remove It | ReliaQuest has identified a new toolkit, dubbed “Gryxa,” used by a financially motivated threat actor across 324 listed hosts. We assess that substantial portions were almost certainly built with a commercial AI coding agent, which appears as co-author on most commits in the actor's public repository. This marks the first time ReliaQuest has observed a threat actor use AI to help build and execute an entire operation to this extent. | Malware blog | RELIAQUEST |
| 29.8.26 | Efimer Brings Its Own Tools to the Job | This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of Efimer malware. This is a Python-based executable compiled with PyInstaller and protected with PyArmor to obfuscate the many libraries and payloads that are packed within. | Malware blog | SonicWall |
| 27.8.26 | Mobile Banking Fraud 2026: Malware is Actively Targeting Mobile Banking Apps in Europe, Middle East & Africa | Our most recent malware threat research from Zimperium’s zLabs research team revealed 34 malware families targeting 1,243 mobile banking and fintech apps across 90 countries globally. | Malware blog | ZIMPERIUM |
|
22.8.26 |
The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile | The zLabs team recently identified an updated variant of ToxicPanda, the Android banking Trojan known to have primarily targeted Europe, that introduces significant enhancements, including a comprehensive command set of 167 remote commands and substantially expands its targets globally. | Malware blog | ZIMPERIUM |
|
22.8.26 |
GoldDigger Malware Demonstrates Advanced Mobile Banking Threats | A recent analysis highlights GoldDigger, an Android malware family designed to steal financial information and facilitate fraudulent activity on compromised devices. The malware abuses accessibility services to monitor user activity, capture credentials, and interact with banking applications while operating with limited visibility to the victim. | Malware blog | ZIMPERIUM |
| 22.8.26 | Mobile Ad Fraud Scheme Uses Automation to Mimic Human Behavior | A recent investigation uncovered Papyrus, a mobile ad fraud operation designed to generate fraudulent engagement by imitating legitimate user behavior. The scheme uses Android apps to produce automated clicks, scrolling, and other interactions that appear human, allowing fraudulent activity to blend into normal mobile traffic. By manipulating engagement signals rather than relying on obvious malicious actions, these techniques can make detection more difficult. | Malware blog | ZIMPERIUM |
| 22.8.26 | FTP Banners: The New Dead Drop Resolver Delivering Novel RATs | FTP Banners: The New Dead Drop Resolver Delivering Novel RATs STRU found threat actors using FTP banners as Dead Drop Resolvers – legitimate services or protocols abused to host C2 addresses and comma... | Malware blog | SOCRADAR |
| 22.8.26 | 1 in 20 Stealer Log Victims are Threat Actors | When analysts examine stealer logs, the underlying assumption is that each infected device belongs to a victim. However, cybercriminals are not immune to the same operational mistakes as everyone else. | Malware blog | FLARE.IO |
| 22.8.26 | Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security | One of the biggest challenges for every threat hunter is navigating endless alerts, scattered indicators, behavioral evidence, and infrastructural context. Data collection is just the first step – but how do you turn it into findings that lead to proactive protection against malware and phishing? | Malware blog | ANYRUN BLOG |
| 22.8.26 | Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025 | In late July 2026, eSentire's Threat Response Unit (TRU) identified several ErrTraffic-generated ClickFix campaigns attempting to deliver Cruciferra - a malware loader marketed on underground forums that boasts EDR-killing capabilities. TRU found Cruciferra using a vulnerable driver to fulfill this behavior. | Malware blog | ESENTIRE |
|
22.8.26 |
C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 | In July 2026, Zscaler ThreatLabz identified a new Rust-based malware family that we track as C2Looper, which is likely leveraged by a ransomware-related threat actor. Furthermore, ThreatLabz assesses with low to medium confidence that C2Looper has been delivered to victims through a multi-stage ClickFix infection chain. C2Looper supports backdoor commands including executing arbitrary commands, performing reconnaissance, and deploying second-stage payloads. | Malware blog | Zscaler |
| 22.8.26 | A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace | We found a custom Windows backdoor on a single corporate workstation while hunting for unusual WMI persistence. The malware was small, had a limited command set and disguised itself as legitimate Realtek software. Its most unusual feature was its configuration: the address of its command-and-control server was not stored as readable text or encrypted data, but encoded in the number of spaces on each line of a Windows `desktop.ini` file. | Malware blog | GENDIGITAL |
|
22.8.26 |
WordlistLoader Delivering Amatera via ClearFake Campaigns | Over the past few months, Amatera Stealer (also often referred to as ACR Stealer) has been actively developed and has gradually become one of the most prevalent infostealer in our user base. Most recently, we've been observing Amatera being distributed via ClearFake campaigns leveraging FakeCaptchas. | Malware blog | GENDIGITAL |
|
15.8.26 |
ClickFix campaign abuses Deno runtime for infostealer delivery | Lures on compromised WordPress sites led to installation of Deno and a Python-based infostealer | Malware blog | SOPHOS |
|
15.8.26 |
A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace | A hand-written Windows backdoor stored its command-and-control domain as the number of trailing spaces in a fake desktop.ini, and we found it on exactly one machine. | Malware blog | GENDIGITAL |
|
15.8.26 |
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide | A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. | Malware blog | Microsoft blog |
|
15.8.26 |
ChainDrop supply chain compromise: Anatomy of a self-propagating worm | A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates | Malware blog | Microsoft blog |
|
15.8.26 |
A Deep-Dive into the Multi-Stage .NET Loader Chain Delivering LokiBot | Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers the LokiBot information stealer via a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, layered decryption, and process hollowing to evade detection before executing the final native LokiBot payload. | Malware blog | SonicWall |
|
15.8.26 |
Signed, sealed, injected: The mechanics of DCRat in 2026 | This DCRat campaign shows how attackers combine phishing lures, DLL sideloading, and process hollowing to attempt to slip past defenses and gain full remote access. | Malware blog | TRELLIX |
|
7.8.26 |
Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools | Infostealers are a rapidly evolving threat, enabling various adversaries, ranging from ransomware groups and hacktivists to nation-state actors, to exploit stolen credentials for unauthorized access to sensitive resources. In today’s threat landscape, identity is a primary target, with attackers seeking diverse credentials including usernames, passwords, tokens, and seed phrases. | Malware blog | SOCRADAR |
|
7.8.26 |
Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005) | AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and In March 2026, Hauri disclosed an attack case in which the malware was disguised as an integrated security program. | Malware blog | AHNLAB |
|
6.8.26 |
Malware signing: When trust becomes an attack surface | How cybercriminals use stolen, fraudulent, and commercialized code-signing certificates to make malware appear legitimate and bypass traditional trust controls. | Malware blog | BARRACUDA |
|
8.8.26 |
Wallet-depleting macOS malware wants your crypto | During a retrospective threat hunt in June 2026, a Huntress analyst found components of a Mac-specific stealer malware on a monitored system that had been infected three months earlier. | Malware blog | Huntress |
|
8.8.26 |
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages | Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAINDROP, a worm that uses stolen npm credentials to backdoor co-owned packages totaling over 1.3 billion monthly downloads. | Malware blog | ELASTIC |
|
8.8.26 |
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide | A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate. | Malware blog | Microsoft blog |
|
8.8.26 |
ChainDrop supply chain compromise: Anatomy of a self-propagating worm | A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates. | Malware blog | Microsoft blog |
|
8.8.26 |
MythStealer: Browser and Discord Credential Theft with HTTPS Exfiltration to Operator-Notified C2 | The Sonicwall Threats research team have recently been tracking an information-stealer malware family known as Myth. The sample we analyzed is a 43.8 MB Windows executable combining browser credential theft, Discord session token extraction, Firefox cookie harvesting, and HTTPS exfiltration into a single binary. | Malware blog | SonicWall |
|
8.8.26 |
ChainDrop: Inside a Self-Propagating npm Worm | A self-propagating npm worm nicknamed ChainDrop infected over 400 packages that are collectively downloaded hundreds of millions of times each week. This includes malicious versions of widely used packages such as keyv and cacheable-request. Unit 42 has unique observations of this attack. | Malware blog | Palo Alto |
|
1.8.26 |
Not Every Fox is Silver: Inside an AtlasRAT loader chain | AtlasRAT is a Windows-based remote access malware. This report analyzes a four-stage in-memory loader chain—which begins with a Delphi executable that is disguised as AGE Flash Player—and its final RAT functionality. The final payload performs TLS-based ChaCha20-encrypted C2 communication, executes modular plugins, performs offline keylogging, and injects DLLs into WeChat processes. | Malware blog | AHNLAB |
|
1.8.26 |
Fake Claude Install Guide Leads to MacSync Stealer and RAT: What We Pulled From the Attacker’s Servers | Huntress recently investigated an incident where the victim searched Google for how to install Claude on a Mac, clicked a sponsored result, and landed on a weaponised claude.ai/share conversation dressed up as an Apple Support install guide. It told them to open Terminal and paste a single curl command. | Malware blog | Huntress |
|
1.8.26 |
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT | Between July 21 and July 22, 2026, Huntress' Security Operations Center (SOC) lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe. The attacks had one common denominator: victims had searched for the Claude desktop app and were taken to a malicious public Claude Artifact on the actual Claude AI domain, which appeared to be a legitimate download link for the desktop app. | Malware blog | Huntress |
|
1.8.26 |
Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called | While conducting routine open-source research, NetAskari identified a malicious Android APK impersonating a Chinese Provincial Public Security Bureau service app. Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰). Hunt.io researchers pivoted on TLS certificates and panel fingerprints to identify 170 servers running the framework, and uncovered a fractured criminal ecosystem built around its leaked codebase. | Malware blog | HUNT.IO |
|
1.8.26 |
Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection | Summary Arctic Wolf Labs has been tracking a cluster of campaigns built around CastleLoader, a multi-stage shellcode loader that has served as the backbone of | Malware blog | ARTICWOLF |
|
1.8.26 |
Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor | Zscaler ThreatLabz has been tracking attacks from a threat actor that is likely an initial access broker for ransomware attacks since January 2026. The threat actor targets organizations by leveraging vishing techniques through Microsoft Teams and deploying a variety of tools including a Go-based backdoor that we named GoGRPC. | Malware blog | Zscaler |
|
1.8.26 |
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version | After months of dormancy, the attackers behind the XCSSET malware released version 40 (v40), targeting the macOS ecosystem. This version’s advanced architecture hides its core logic in memory space, reducing its digital footprint. | Malware blog | Palo Alto |
|
25.7.26 |
Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel | The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN. | Malware blog | CISCO TALOS |
|
18.7.26 |
Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain | Introduction Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase infection success rates. The threat actors impersonated legitimate government departments and distributed malicious emails disguised as official notifications related to taxation,... | Malware blog | Seqrite |
|
18.7.26 |
ACR Stealer: Two observed intrusion chains amid increased threat activity | From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. | Malware blog | Microsoft blog |
|
18.7.26 |
The PhantomGate Campaign — Obfuscation, Persistence, and Covert Surveillance | This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of PhantomGate malware. This family uses a series of obfuscated .LNK and .BAT files to download a malicious binary via PowerShell commands. Embedded payloads provide additional functionality for controlling webcams and capturing audio, using legitimate libraries to help bypass security. | Malware blog | SonicWall |
|
18.7.26 |
The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) | The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape. | Malware blog | Palo Alto |
|
18.7.26 |
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign | Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025. | Malware blog | CISCO TALOS |
| 11.7.26 | RedHook Returns with a Dangerous Upgrade | Group-IB analysts examine this resurfaced Android Remote Access Trojan, demonstrating new, sophisticated and malicious functionalities including autonomous privilege abuse, expanded command-and-control capabilities, and a robust persistence stack. | Malware blog | GROUP-IB |
| 11.7.26 | Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App | CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control. | Malware blog | Cyble |
| 11.7.26 | GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware | GigaWiper is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform. | Malware blog | Microsoft blog |
| 11.7.26 | Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation | In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. | Malware blog | Palo Alto |
| 11.7.26 | UAT-7810 continues building ORB networks using new malware | Talos’ latest findings on UAT-7810 indicate that the threat actor continues to develop their custom-made malware. | Malware blog | CISCO TALOS |
| 4.7.26 | Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App | CRIL analyzes Glitch SPY, an Android RAT with 70+ commands, crypto-clipping, and a silent remote browser, giving attackers full device control. | Malware blog | Cyble |
| 4.7.26 | Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud | In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analyzing server-side artifacts and victim-side data. | Malware blog | Trend Micro |
| 4.7.26 | Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware | Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. | Malware blog | Trend Micro |
| 4.7.26 | TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry | In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved. | Malware blog | Trend Micro |
| 4.7.26 | Android Arsink RAT Revisited Targeting User Credentials | The SonicWall Capture Labs threat research team identified an ongoing Android Remote Access Trojan (RAT) campaign that employs multiple techniques to harvest sensitive user information through phishing and data exfiltration activities by impersonating the actual app icons and using similar names. | Malware blog | SonicWall |
| 27.6.26 | Google Threat Intelligence Group (GTIG) has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022. | Malware blog | GTI | |
| 27.6.26 | Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker | Stealthy new backdoor used in cybercrime intrusions since April 2026 may be associated with Woodgnat (aka KongTuke), an initial access broker whose ModeloRAT toolkit has fed Qilin and other ransomware operations. | Malware blog | SECURITY.COM |
| 27.6.26 | StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them | On June 24, 2026, Microsoft’s Digital Crimes Unit (DCU) facilitated the takedown, suspension, and blocking of domains that formed the backbone of the StealC and Amadey infrastructure. | Malware blog | Microsoft blog |
| 27.6.26 | ESET takes part in Operation Endgame to disrupt Amadey and Stealc | ESET researchers assisted in the global disruption of the Amadey botnet and Stealc infostealer, providing technical analysis, infrastructure tracking, and affiliate-level insights | Malware blog | Eset |
| 19.6.26 | FishMonger’s arsenal upgraded: SprySOCKS for Windows | Malware blog | Eset | |
| 13.6.26 | GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers | Gen Threat Labs has been tracking GoFlateLoader, a widespread Golang loader used to deliver multiple infostealers, including Amatera, Remus, Lumma, Vidar and StealC. | Malware blog | GENDIGITAL |
| 6.6.26 | New Malware Targeting Minecraft Infects 2K Daily, and Teens are Becoming Attackers | If you or your child plays Minecraft, here's what you need to know about a large-scale malware campaign McAfee Labs just uncovered, and what to do about... | Malware blog | MCAFEE |
| 6.6.26 | OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight | Cyble analyzes OverlayPhantom, an Android banking trojan targeting 180+ apps across 10 countries, stealing credentials via fake overlays and real-time screen streaming. | Malware blog | Cyble |
| 6.6.26 | Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell | We are tracking an increasingly widespread malvertising campaign targeting macOS. This campaign appears to be the next stage of a previous campaign known as JSCoreRunner, which was first identified in August 2025. | Malware blog | Palo Alto |
| 30.5.26 | OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight | Cyble analyzes OverlayPhantom, an Android banking trojan targeting 180+ apps across 10 countries, stealing credentials via fake overlays and real-time screen streaming. | Malware blog | Cyble |
| 30.5.26 | BTMOB: A stealthy RAT burrowing deep into Android devices | The malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise | Malware blog | Eset |
| 23.5.26 | JOMANGY: INJ3CTOR3’s Self-Healing FreePBX Toll Fraud Campaign | CRIL uncovers JOMANGY, a stealth PHP webshell by INJ3CTOR3 with 6 persistence layers and self-healing cron jobs built to survive host cleanup. | Malware blog | Cyble |
| 23.5.26 | Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware | Void Dokkaebi, a North Korea-aligned intrusion set, has updated its information-stealing malware, InvisibleFerret, shifting its delivery format to evade script-based detections. | Malware blog | Trend Micro |
| 23.5.26 | Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud | In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analyzing server-side artifacts and victim-side data. | Malware blog | Trend Micro |
| 23.5.26 | Next.js WebSocket Upgrade Handler SSRF | The SonicWall Capture Labs threat research team became aware of a Server-Side Request Forgery vulnerability in Next.js, assessed its impact and developed mitigation measures. Next.js enables organizations to create full-stack web applications by extending the latest React features and integrating powerful Rust-based JavaScript tooling for the fastest builds. | Malware blog | SonicWall |
| 23.5.26 | Tracking TamperedChef Clusters via Certificate and Code Reuse | This article documents novel activity clusters that have significant overlap with the publicly described threat known as TamperedChef (aka EvilAI). TamperedChef-style malware is trojanized productivity software, such as PDF editors or calendars, that deliver malicious payloads. | Malware blog | Palo Alto |
| 23.5.26 | The npm Threat Landscape: Attack Surface and Mitigations (Updated May 21) | The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era of npm attacks and the beginning of a high-consequence threat landscape. | Malware blog | Palo Alto |
| 23.5.26 | Webworm: New burrowing techniques | ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal | Malware blog | Eset |
| 16.5.26 | Why AMOS matters: The macOS malware stealing data at scale | Sophos X-Ops looks at the Atomic macOS Stealer and its capabilities | Malware blog | SOPHOS |
| 16.5.26 | When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA | A closer look at how Bedep used foreign exchange data and advanced math to generate hard-to-predict domains, making its command-and-control infrastructure more difficult for defenders to block and disrupt | Malware blog | GENDIGITAL |
| 16.5.26 | Chasing an Angry Spark | A VM-obfuscated backdoor observed on a single machine in the UK, operated for one year, and vanished without a trace. | Malware blog | GENDIGITAL |
| 16.5.26 | Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files | This article examines new obfuscation techniques the Gremlin stealer malware uses to conceal malicious payloads within embedded resources. We analyze a variant protected by a sophisticated commercial packing utility that employs instruction virtualization, transforming the original code into a custom, non-standard bytecode executed by a private virtual machine. | Malware blog | Palo Alto |
| 9.5.26 | InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise | Targeting multiple industries worldwide, the InstallFix campaign uses fake Claude AI installer pages to trick users into running malware that collects system information, disables security features, achieves persistence, and connects to attacker-controlled C&C servers for additional payloads. | Malware blog | Trend Micro |
| 9.5.26 | Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities | TrendAI™ Research breaks down Quasar Linux (QLNX), a previously undocumented sophisticated Linux RAT with low detection rates. In this blog, we examine a full-featured Linux threat incorporating a rootkit, a PAM backdoor, credential harvesting, and more, revealing how this malware enables stealthy access, persistence, and potential supply-chain attacks. | Malware blog | Trend Micro |
| 9.5.26 | CloudZ RAT potentially steals OTP messages using Pheno plugin | Cisco Talos discovered an intrusion, active since at least January 2026, where an unknown attacker implanted a CloudZ remote access tool (RAT) and a previously undocumented plugin called “Pheno.” | Malware blog | CISCO TALOS |
| 25.4.26 | When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA | A closer look at how Bedep used foreign exchange data and advanced math to generate hard-to-predict domains, making its command-and-control infrastructure more difficult for defenders to block and disrupt | Malware blog | GENDIGITAL |
| 25.4.26 | GopherWhisper: A burrow full of malware | ESET Research has discovered a new China-aligned APT group that we’ve named GopherWhisper, which targets Mongolian governmental institutions | Malware blog | Eset |
| 25.4.26 | PureRAT: A Multi-Stage, Fileless RAT Utilizing Image Steganography and Process Hollowing | PureRAT is an advanced Remote Access Trojan (RAT) characterized by its complex infection stages. The intrusion sequence is initiated by a malicious .LNK file that triggers a concealed PowerShell command to retrieve a heavily obfuscated VBS loader. | Malware blog | Trelix |
| 18.4.26 | MiningDropper – A Global Modular Android Malware Campaign Operating at Scale | CRIL analyzes a surge in an ongoing campaign to deliver MiningDropper — a modular Android malware framework - at scale. | Malware blog | Cyble |
| 18.4.26 | Chasing an Angry Spark | A VM-obfuscated backdoor observed on a single machine in the UK, operated for one year, and vanished without a trace. | Malware blog | GENDIGITAL |
| 18.4.26 | Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise | The Microsoft Defender Security Research Team uncovered a sophisticated macOS intrusion campaign attributed to the North Korean threat actor Sapphire Sleet that abuses user driven execution and social engineering to bypass macOS security protections and steal credentials, cryptocurrency assets, and sensitive data. | Malware blog | Microsoft blog |
| 18.4.26 | ACRStealer The Silent Golang Threat Behind Credential and Wallet Theft | This week the SonicWall Capture Labs Threat Research Team analyzed a sample of ACRStealer, a Golang Malware-as-a-Service used by ShieldIO. This uses a binary to sideload a malicious DLL and evade AV products, harvest credentials for browsers and FTP programs, and target a number of crypto-wallets. It is highly evasive and uses a variety of techniques to prevent analysis. | Malware blog | SonicWall |
| 18.4.26 | Cracks in the Bedrock: Agent God Mode | Our first article about the boundaries and resilience of Amazon Bedrock AgentCore focused on the Code Interpreter sandbox, and how it can be bypassed using DNS tunneling. In this second part, we delve into the identity and permissions model of AgentCore and the AgentCore starter toolkit. | Malware blog | Palo Alto |
| 18.4.26 | DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense | This blog explores how Trellix Network Detection and Response (NDR) moves beyond static signatures to detect these attempts by focusing on the underlying behavioral patterns of the attack technique itself. | Malware blog | Trelix |
| 11.4.26 | Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer | When the security industry talks about information stealers, Lumma Stealer, without a doubt, has become the notorious icon of this landscape. Not only could it count itself among the most sophisticated, technically advanced, and widespread stealers-as-a-service in the world, but it was also described in a variety of blog posts from basically everyone in the industry, including us. | Malware blog | GENDIGITAL |
| 11.4.26 | Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do | Threat actors leveraged Anthropic’s Claude Code npm release packaging error to distribute Vidar, GhostSocks, and PureLog Stealer. This blog details immediate steps organizations can take and best practices to prevent further risk. | Malware blog | Trend Micro |
| 11.4.26 | Unpacking the Nursultan Client PyInstaller Telegram Malware | The SonicWall Capture Labs threat research team identified a PyInstaller-packed Windows executable distributed as "NursultanClient" — a full-featured Telegram RAT targeting Windows systems. | Malware blog | SonicWall |
| 11.4.26 | New Lua-based malware “LucidRook” observed in targeted attacks against Taiwanese organizations | Cisco Talos uncovered a cluster of activity we track as UAT-10362 conducting spear-phishing campaigns against Taiwanese non-governmental organizations (NGOs) and suspected universities to deliver a newly identified malware family, “LucidRook.” | Malware blog | CISCO TALOS |
| 4.4.26 | Building on recent BRICKSTORM research from Google Threat Intelligence Group (GTIG), this post explores the evolving threats facing virtualized environments. These operations directly target the VMware vSphere ecosystem, specifically the vCenter Server Appliance (VCSA) and ESXi hypervisors. To help organizations stay ahead of these risks, we will focus on the essential hardening strategies and mitigating controls necessary to secure these critical assets. | Malware blog | GTI | |
| 28.3.26 | Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities | This blog discusses the steganography, cloud abuse, and email-based backdoors used against the Ukrainian defense supply chain in the latest Pawn Storm campaign that TrendAI™ Research observed and analyzed. | Malware blog | Trend Micro |
| 21.3.26 | Android devices ship with firmware-level malware | Keenadu malware gives an attacker control over a device but appears to be used primarily to facilitate ad fraud | Malware blog | SOPHOS |
| 21.3.26 | New Malware Highlights Increased Systematic Targeting of Network Infrastructure | New Malware Highlights Increased Systematic Targeting of Network Infrastructure | Malware blog | Eclypsium |
| 21.3.26 | Libyan Oil Refinery Among Targets in Long-running Likely Espionage Campaign | The modular backdoor AsyncRAT was deployed on targeted networks. | Malware blog | SECURITY.COM |
| 21.3.26 | New Malware Targets Users of Cobra DocGuard Software | Novel, parasitic threat cleverly uses Cobra DocGuard’s functionality and hunts for documents related to ballistic missiles. | Malware blog | SECURITY.COM |
| 21.3.26 | Copyright Lures Mask a Multi‑Stage PureLog Stealer Attack on Key Industries | We look into a stealthy multi‑stage attack campaign that delivers PureLog Stealer entirely in memory using encrypted, fileless techniques. | Malware blog | Trend Micro |
| 21.3.26 | An In-Depth Look at Scarface Stealer | This week, the SonicWall Capture Labs Threat Research team analyzed a sample of ScarfaceStealer, a Go-compiled information stealer that utilizes sophisticated anti-analysis techniques including | Malware blog | SonicWall |
| 21.3.26 | Transparent COM instrumentation for malware analysis | In this article, Cisco Talos presents DispatchLogger, a new open-source tool that delivers high visibility into late-bound IDispatch COM object interactions via transparent proxy interception. | Malware blog | CISCO TALOS |
| 14.3.26 | Evil evolution: ClickFix and macOS infostealers | Across three recent campaigns, Sophos X-Ops notes shifts in both lures and malware capabilities, as threat actors leveraging ClickFix techniques increasingly target macOS users with infostealers | Malware blog | SOPHOS |
| 14.3.26 | The Future of Supply Chain Backdoor Detections | The XZ Utils backdoor (CVE-2024-3094) was discovered in March 2024 and is an example of a software supply chain attack that would have allowed hackers in possession of a specific private key to connect to the backdoored system and run their own commands as an administrator. | Malware blog | Eclypsium |
| 14.3.26 | Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites | Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique. | Malware blog | Trend Micro |
| 14.3.26 | Malware-As-A-Service Redefined: Why XWorm is outpacing every other RAT in the underground malware market | XWorm has surged to the #3 global threat, using stealthy memory-only execution and the WinRAR CVE-2025-8088 exploit to bypass traditional security stacks. | Malware blog | Trelix |
| 14.3.26 | Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution | This blog examines a Remcos campaign demonstrating the transition from phishing-based initial access to fully fileless execution. | Malware blog | Trelix |
| 7.3.26 | ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader | Cyble has identified a new Linux threat named ClipXDaemon that targets cryptocurrency users by intercepting and manipulating copied wallet addresses. | Malware blog | Cyble |
| 7.3.26 | New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages | The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. | Malware blog | Trend Micro |
| 7.3.26 | PDF-Borne Living-off-the-Land Attacks with RMM Abuse | PDF files have long been abused by attackers to evade security detections and to deliver malware payloads. This time SonicWall Capture Labs threat research team has observed four distinct campaigns where PDF-based social engineering techniques being used to deliver remote monitoring and management (RMM) software for unauthorized system access. These tools, while legitimate in managed IT environments, become powerful weapons when deployed without user consent. | Malware blog | SonicWall |
| 7.3.26 | Inside a New VioletRAT Campaign: Multi Staged Delivery and Stealthy Payload Execution | Recently, the SonicWall Capture Labs threat research team observed a new campaign spreading Violet RAT using a multistage Python-based APC injection technique. The campaign employs a multi-stage delivery chain that involves archives, batch scripts, and a Python loader to deploy the final payload via shellcode injection. The complete infection chain can be visualized in the following figure 1. | Malware blog | SonicWall |
| 28.2.26 | SURXRAT: From ArsinkRAT roots to LLM Module Downloads Signaling Capability Expansion | Cyble uncovers SURXRAT’s evolution across versions, built on ArsinkRAT code, and now downloading large LLM modules signaling an expansion of its operational capabilities. | Malware blog | Cyble |
| 28.2.26 | Inside a New VioletRAT Campaign: Multi Staged Delivery and Stealthy Payload Execution | Recently, the SonicWall Capture Labs threat research team observed a new campaign spreading Violet RAT using a multistage Python-based APC injection technique. The campaign employs a multi-stage delivery chain that involves archives, batch scripts, and a Python loader to deploy the final payload via shellcode injection. The complete infection chain can be visualized in the following figure 1. | Malware blog | SonicWall |
| 28.2.26 | New Dohdoor malware campaign targets education and health care | Cisco Talos discovered an ongoing malicious campaign since at least as early as December 2025 by a threat actor we track as “UAT-10027,” delivering a previously undisclosed backdoor dubbed “Dohdoor.” | Malware blog | CISCO TALOS |
| 21.2.26 | Uncovering a Recent Pulsar RAT Sample in the Wild | This week, the SonicWall Capture Labs Threat Research Team analyzed an obfuscated .NET trojan frequently used in malicious campaigns. Pulsar RAT, is an open-sourced remote access tool that was derived from another open-sourced RAT named Quasar. Pulsar adds updated capabilities such as hooking clipboard changes, capturing webcam images, UAC bypass, and sending results back to attackers. | Malware blog | SonicWall |
| 21.2.26 | PromptSpy ushers in the era of Android threats using GenAI | ESET researchers discover PromptSpy, the first known Android malware to abuse generative AI in its execution flow | Malware blog | Eset |
| 14.2.26 | New threat actor, UAT-9921, leverages VoidLink framework in campaigns | Cisco Talos recently discovered a new threat actor, UAT-9221, leveraging VoidLink in campaigns. Their activities may go as far back as 2019, even without VoidLink. | Malware blog | CISCO TALOS |
| 7.2.2026 | Malicious use of virtual machine infrastructure | Bulletproof hosting providers are abusing the legitimate ISPsystem infrastructure to supply virtual machines to cybercriminals | Malware blog | SOPHOS |
| 7.2.2026 | Inside a Multi-Stage Android Malware Campaign Leveraging RTO-Themed Social Engineering | In recent years, Android malware campaigns in India have increasingly abused the trust associated with government services and official digital platforms. By imitating well-known portals and leveraging social engineering through messaging applications, threat actors exploit user urgency and lack... | Malware blog | Seqrite |
| 7.2.2026 | Fake Installer: Ultimately, ValleyRAT infection | In this Threat Analysis Report, Cybereason explores the fake installer, ValleyRAT | Malware blog | Cybereason |
| 1.2.26 | ShadowHS: A Fileless Linux Post‑Exploitation Framework Built on a Weaponized hackshell | Cyble uncovers ShadowHS, a stealthy fileless Linux framework running entirely in memory for covert, adaptive post‑exploitation control. | Malware blog | Cyble |
| 1.2.26 | PureRAT: Attacker Now Using AI to Build Toolset | Vietnam-based cybercrime actor appears to now be using AI to write scripts used in phishing campaigns | Malware blog | SECURITY.COM |
| 1.2.26 | njRAT: A Persistent Commodity Threat in the Modern Landscape | The SonicWall Capture Labs threat research team continues to monitor the activity of the infamous njRAT (also known as Bladabindi), a prolific Remote Access Trojan (RAT) that remains a staple in the toolkit of various threat actors. | Malware blog | SonicWall |
| 1.2.26 | KONNI Adopts AI to Generate PowerShell Backdoors | Check Point Research (CPR) identified an ongoing phishing campaign that we associate with KONNI, a North Korean–linked threat actor active since at least 2014. KONNI is best known for targeting organizations and individuals in South Korea, with a focus on diplomatic channels, international relations, NGOs, academia, and government. | Malware blog | |
| 1.2.26 | DynoWiper update: Technical analysis and attribution | ESET researchers present technical details on a recent data destruction incident affecting a company in Poland’s energy sector | Malware blog | Eset |
| 1.2.26 | Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan | ESET researchers discover an Android spyware campaign targeting users in Pakistan via romance scam tactics, revealing links to a broader spy operation | Malware blog | Eset |
| 1.2.26 | ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 | Malware blog | Eset | |
| 24.1.26 | TamperedChef serves bad ads, with infostealers as the main course | Sophos X-Ops explores a malvertising campaign that leverages Google Ads to distribute an infostealer | Malware blog | SOPHOS |
| 24.1.26 | Inside a Multi-Stage Windows Malware Campaign | FortiGuard Labs analysis of a multi-stage Windows malware campaign that abuses trusted platforms to disable defenses, deploy RATs, and deliver ransomware. | Malware blog | FORTINET |
| 24.1.26 | Check Point Research is tracking an active phishing campaign involving KONNI, a North Korea-affiliated threat ... | Malware blog | ||
| 24.1.26 | Check Point Research has identified VoidLink, one of the first known examples of advanced malware ... | Malware blog | ||
| 24.1.26 | Weaponized WinRAR Exploitation and Stealth Deployment of Fileless .NET RAT | EXECUTIVE SUMMARY At CYFIRMA, we continuously monitor emerging threat techniques that abuse trusted software and routine user behavior to achieve stealthy system compromise. | Malware blog | Cyfirma |
| 24.1.26 | VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun | Check Point Research (CPR) believes a new era of AI-generated malware has begun. VoidLink stands as the first evidently documented case of this era, as a truly advanced malware framework authored almost entirely by artificial intelligence, likely under the direction of a single individual. | Malware blog | |
| 17.1.26 | New Remcos Campaign Distributed Through Fake Shipping Document | FortiGuard Labs analyzes a phishing campaign delivering a fileless Remcos RAT via malicious Word templates, CVE-2017-11882 exploitation, and in-memory execution. | Malware blog | FORTINET |
| 17.1.26 | Uncovering Hidden Forensic Evidence in Windows: The Mystery of AutoLogger-Diagtrack-Listener.etl | FortiGuard IR uncovers forensic insights in Windows AutoLogger-Diagtrack-Listener.etl, a telemetry artefact with untapped investigative value. | Malware blog | FORTINET |
| 17.1.26 | deVixor: An Evolving Android Banking RAT with Ransomware Capabilities Targeting Iran | Cyble analyzed deVixor, an advanced Android banking RAT with ransomware features actively targeting Iranian users. | Malware blog | |
| 17.1.26 | SOLYXIMMORTAL : PYTHON MALWARE ANALYSIS | EXECUTIVE SUMMARY SolyxImmortal is a Python-based Windows information-stealing malware that combines credential theft, document harvesting, keystroke logging, screen surveillance, | Malware blog | |
| 17.1.26 | Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response | Threat actors exploited Cloudflare's free-tier infrastructure and legitimate Python environments to deploy the AsyncRAT remote access trojan, demonstrating advanced evasion techniques that abuse trusted cloud services for malicious operations. | Malware blog | |
| 17.1.26 | Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework | VoidLink is an advanced malware framework made up of custom loaders, implants, rootkits, and modular plugins designed to maintain long-term access to Linux systems. The framework includes multiple cloud-focused capabilities and modules, and is engineered to operate reliably in cloud and container environments over extended periods. | Malware blog | |
| 10.1.26 | Unpacking the packer ‘pkr_mtsi’ | This RL Researcher’s Notebook highlights the packer’s evolution — and offers a YARA rule to detect all versions. | Malware blog | REVERSINGLABS |
| 10.1.26 | Ladvix: Inside a Self-Propagating ELF Malware with IoT Botnet Traits | This week, the SonicWall Capture Labs Threat Research team analyzed a sample of a malicious ELF file infector that shares characteristics of IoT botnet malware. The sample demonstrates self-propagation capabilities, file system scanning, and selective infection mechanisms targeting other ELF binaries. | Malware blog | SonicWall |
| 10.1.26 | VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion | This article details our technical analysis of VVS stealer, also styled VVS $tealer, including its distributors’ use of obfuscation and detection evasion. | Malware blog | Palo Alto |