Tag: malware operations
775 articles
Fortinet Flaw Exploited to Deploy PEERSTITCH Malware
Hackers exploited a critical Fortinet flaw to breach a telecom provider's system, harvesting sensitive data from over 500 firewalls to deploy a sneaky, hard-to-detect malware implant. This novel attack, detected in September 2024, used the stolen data to stage a diskless ARM64 implant that evades normal security detection.
Hackers Exploit Devices to Build Global Proxy Network
Meet the sneaky hackers who've been secretly hijacking devices worldwide to build a massive proxy network, making a profit by reselling innocent victims' internet bandwidth. At least 143 devices across 34 countries have been compromised in this covert operation.
Aoki Infostealer Expands to Target AI Coding Assistant Credentials
Stolen AI coding assistant credentials can be a goldmine for attackers, allowing them to resell or rack up usage charges on the victim's account, and even gain a foothold into the developer's broader environment. The Aoki infostealer has evolved to target these valuable credentials, expanding its reach beyond browser data and cryptocurrency wallets.
Fake AI Attacks Target US Companies via Impersonated Brands
US companies are under attack by fake AI campaigns that impersonate trusted brands like Claude, ChatGPT, and Copilot, spreading malware and stealing sensitive data. Attackers are using clever tactics, such as sponsored search results and fake download websites, to trick victims into compromising their business accounts.
Microsoft Disrupts Global Phishing Network Behind 1 Billion Messages
Microsoft and Japanese police have joined forces to take down a notorious phishing network, known as Yam Store or Storm-3119, that was responsible for a staggering 1 billion phishing emails and texts sent to over 75,000 organizations since January 2026. This underground marketplace was selling compromised accounts, licenses, and storage to threat actors, fueling a massive wave of cyber scams.
GhostAction Exploits 1,900 GitHub Accounts, Hits 30,000 Repositories
Malicious actors launched a massive attack, dubbed GhostAction, that compromised nearly 1,900 GitHub accounts and infected over 30,000 repositories with a malicious workflow. The concentrated surge, which occurred on October 8-9, 2026, put thousands of users and organizations at risk.
Forescout Researchers Expose ROMULUS Malware Server Leveraging ClickFix
Forescout researchers have uncovered a cunning malware server, dubbed ROMULUS, that's linked to a notorious campaign called ClickFix, and what's alarming is that it can deliver multiple payloads. This discovery was made by Vedere Labs, part of Forescout Research, who identified six servers running the ROMULUS platform.
Law Enforcement Disrupts Phishing Network Behind 1 Billion Malicious Messages
A massive phishing network responsible for sending over 1 billion malicious messages to 75,000 organizations in 150 countries has been disrupted by law enforcement, bringing relief to countless individuals and businesses worldwide. This enormous operation had been targeting victims with sophisticated device-code phishing scams, with over 750 million messages aimed specifically at Microsoft customers.
Hirudo Malware Disrupts Banking Apps with Advanced Evasion Tactics
This sneaky malware outsmarts banking apps by hijacking their own defenses, essentially turning their security against them. By cleverly replacing legitimate apps with malicious versions, Hirudo malware intercepts sensitive info, putting victims' financial data at risk.
AI Models Expose Vulnerability to Self-Propagating IoT Botnets
Small AI models could soon spread like digital wildfire, replicating themselves across internet-connected devices like smart ovens and Android TVs to form autonomous botnets that are almost impossible to shut down. This emerging threat, dubbed an AI worm, could become a self-propagating menace within months.
MFA Gaps Leave Organizations Exposed to Credential Attacks
In just seven minutes, a hacker exploited a vulnerable account lacking multi-factor authentication, gaining access to sensitive data and nearly pulling off a devastating ransomware attack. This alarming incident highlights the critical importance of robust security measures to prevent credential attacks.
Android Phones Expose Users to Malware-Backed Residential Proxy Networks
Malware lurking in the firmware of low-cost Android phones has been found communicating with the same servers as 13 malicious apps on Google Play, putting users at risk of being roped into a massive residential proxy network. This sneaky campaign, tracked as "Midnight Mimosa," has the potential to compromise a wide range of devices.
Ledger Exposes Supply-Chain Attack Behind Crypto Theft
Ledger just confirmed a shocking case of tampering behind recent crypto thefts, tracing the issue to a single reseller, CryptoBilis, and finding an unauthorized hardware implant in one user's device. The company is now working with authorities to catch the culprit and reach out to affected users.
AvisLoader Exposes New Evasion Tactics in Windows Malware Attacks
Meet AvisLoader, a sneaky new Windows malware loader that's changing the game with its clever evasion tactics and encrypted communication methods. It starts with a convincing ClickFix page that tricks victims into pasting a malicious command into their terminal.
Ransomware Groups Exploit Palo Alto VPN Flaw Despite Patch Release
Ransomware groups are actively exploiting a patched vulnerability in Palo Alto VPNs, allowing them to masquerade as legitimate remote workers and evade detection until they strike. This sneaky tactic enables hackers to steal credentials, move laterally, and deploy ransomware, causing devastating consequences.
FBI Arrests Ransomware Negotiator in ShinyHunters Probe
In a major breakthrough in the ShinyHunters ransomware probe, the FBI has arrested a key player - a ransomware negotiator - in Pennsylvania, dealing a significant blow to the group that's extorted over $70 million from victims so far this year. The suspect, Edward Dobrovsky, faces charges of conspiracy and interference with commerce by threats.
GitHub Repositories Targeted in Credential-Stealing Workflow Attack
Malicious actors have launched a sneaky credential-stealing attack on GitHub repositories, using hijacked accounts to spread a malicious workflow that hit 345 repositories in just a few hours. The GhostAction campaign is back with a vengeance, putting developer credentials at risk.
Hackers Exploit Bing Redirects in Google Ads to Spread ClickFix Malware
Malicious actors have found a sneaky way to spread ClickFix Malware by exploiting Bing redirects in Google Ads, tricking macOS users into downloading a fake Claude installer that secretly installs harmful commands. This clever tactic, dubbed Adception, uses legitimate search-ad and redirect infrastructure to evade security checks.
P7 DarkSword Exploit Kit Enhances iOS Data Theft Capabilities
Meet P7 DarkSword, a sneaky new iOS exploit kit that's taking data theft to the next level by shrinking its footprint, swiping sensitive info like keychain and crypto-wallet data right from your device. Its clever tactics include extracting data into JSON on your phone and using a two-way communication channel with its command center.
AhsayCBS Flaws Exploited to Deploy XMRig Miners
Hackers are exploiting weaknesses in AhsayCBS to spread XMRig cryptominers, using clever tactics like disguising malware as Microsoft Edge. They gain access by chaining two recently disclosed vulnerabilities, CVE-2026-105133 and CVE-2026-105134.
Ransomware Attacks Soar to Record High in Q3 2026
Ransomware attacks have skyrocketed to a record high, with 2,627 claimed incidents in Q3 2026 - a 27% surge from the previous quarter and a 61% jump from the same period last year. This alarming trend signals a significant escalation of the threat landscape across all major sectors.
FBI Disrupts Chinese Hacking Tools, Warns of PRC Spies Targeting Global Networks
The FBI has struck a blow against Chinese hackers, seizing seven web domains linked to a suite of hacking tools, including the notorious FishHub malware, which was used to target global networks, including roughly 20 Taiwanese universities. This malware was designed to facilitate phishing activity, allowing hackers to gain a foothold in vulnerable systems.
Shai-Hulud Worm Compromises AI Platform Tensorlake
A malicious version of the Tensorlake SDK, downloaded around 12,000 times per week, was briefly infected with the Shai-Hulud worm, which could have allowed attackers to hijack credentials and sensitive data. Fortunately, the issue was quickly detected and resolved, with the package being pulled and updated to a safe version.
FakeGit Campaign Resurfaces, Spawns 17,610 Malicious GitHub Repos
In a shocking resurgence, the FakeGit campaign sprang back to life on October 4, hijacking 17,610 dormant GitHub repositories to deliver malware at an alarming rate of nearly 3,000 per hour. The attackers cleverly exploited existing repositories, needing to create zero new ones to unleash this massive threat.