Tag: malware operations
775 articles
UAC-0099 Deploys ASHVEIN RAT in Targeted Attacks on Ukrainian Government Personnel
Meet ASHVEIN, a sneaky new malware that's helping Russia-aligned hackers steal sensitive info from Ukrainian government targets - and hiding their tracks in clever, invisible ways. This .NET infostealer and remote access trojan is a master of disguise, blending credential theft, surveillance, and remote control features to fly under the radar.
Russia-Aligned UAC-0099 Refines MATCHBOIL Malware
The operators of UAC-0099, a group likely aligned with Russian interests, have been steadily refining their MATCHBOIL malware, making it a more potent tool for future attacks. This deliberate evolution shows a clear intent to evade detection and enhance the malware's flexibility.
Malicious Firefox Extensions Target Crypto Wallets, Exfiltrate Recovery Phrases
Beware of malicious Firefox extensions that masquerade as helpful tools but secretly steal your crypto wallet secrets, including recovery phrases and private keys, by intercepting them during wallet import flows. These sneaky add-ons can even fake legitimate wallet interfaces to trick you into handing over sensitive info.
Web3 Enables Sophisticated Cloud Supply Chain Attacks
Malware authors are now using blockchain technology to launch devastating cloud supply chain attacks, as seen in the ChainDrop attack that infected over 400 npm packages. This sneaky tactic uses a custom runtime to launch a credential harvester, allowing attackers to capture sensitive cloud provider IAM keys and more.
Malware Exploits AI Systems with 'Adversarial Poetry
Meet the first-ever malware that uses a clever trick - a poem - to hijack AI systems and steer them to its command center, cleverly hidden in a forked GitHub repository. This sneaky tactic was uncovered by Lumen's Black Lotus Labs, revealing a new level of sophistication in cyber threats.
PoeLLM Malware Targets Exposed AI Servers in Global Cryptomining Campaign
Meet PoeLLM, a sneaky malware that's compromised over 2,100 AI servers worldwide, with a staggering 800 infected systems active in just one day, all part of a massive global cryptomining campaign.
PoeLLM Malware Exploits Poem to Fuel Growing Botnet
Meet PoeLLM, a sneaky malware that's hijacked over 3,400 servers since April by cleverly extracting command-and-control addresses from a harmless-sounding poem on GitHub. This cunning botnet uses a poem-based system to stay one step ahead - but its unique approach also makes it vulnerable to takedown.
FBI Warns of Ongoing FortiBleed Attacks Targeting Fortinet Firewalls
Beware: ongoing FortiBleed attacks are putting Fortinet firewalls at risk, with some victims potentially getting locked out of their own devices if attackers delete or change account passwords. The FBI and US Secret Service have issued a joint warning about this sustained threat.
CERT-UA Warns of 100+ Sites Serving LunexStealer via Fake Cloudflare Checks
Beware of over 100 compromised websites serving up the nasty LunexStealer malware by masquerading as a Cloudflare verification page - just a click away from trouble! When you visit these sites, you're tricked into executing a command that lets the malware swipe your sensitive info.
Linux Backdoors Masquerade as Email Security Tools in Korea, Taiwan Attacks
Cyber attackers are sneaking Linux backdoors into systems in Korea and Taiwan, cleverly disguising them as email security tools to fly under the radar. The malware, known as AVERAT, uses a sneaky tactic of communicating with its controllers via ordinary email protocols to avoid detection.
Cybersecurity Events Surge to 2,514 per Second
The astonishing truth is that a whopping 2,514 cybersecurity events occur every single second, according to the Comcast Business 2026 Cybersecurity Threat Report, which analyzed a massive 79.3 billion events over just 12 months.
Microsoft Warns of ClickFix Attack Hiding VBScript in Browser Cache
Beware of the sneaky ClickFix attack, where hackers hide a malicious VBScript payload in your browser cache, disguising it as an innocent image - and Microsoft is sounding the alarm. A clever trick allows attackers to get a head start, loading the script into your cache before you even take action.
Microsoft Warns of ClickFix Browser Cache Smuggling Attacks Bypassing Windows Defenses
Microsoft warns of a sneaky new attack called ClickFix browser cache smuggling, where hackers disguise malicious scripts as harmless image files in your browser cache, allowing them to bypass Windows defenses. This clever trick lets attackers execute their payload without downloading or executing remote files in real time.
Malicious Backdoors Infiltrate Telecoms via Email Traffic Disguise
Malicious backdoors are sneaking into telecom systems by masquerading as regular email traffic, making them nearly undetectable. Researchers at Rapid7 uncovered an implant family called AVERAT that cleverly disguises itself as legitimate mail activity on TCP port 25 and SMTP.
ClingSTUN Malware Exploits IoT Flaws to Create Proxy Networks
Meet ClingSTUN, a sneaky Linux proxy backdoor that's exploiting known flaws in unpatched IoT devices to turn them into remotely controlled proxy nodes, allowing hackers to hijack your network. FortiGuard Labs has tracked 24 vulnerabilities so far, and it's crucial to stay ahead of this threat.
Malware Exploits Realtek SDK Flaw to Deploy Cling Botnet
Malware operators have seized on a critical flaw in the Realtek Jungle SDK (CVE-2021-35394) to spread the Cling botnet, exploiting the vulnerability to infect devices and turn them into unwitting accomplices. By cleverly hijacking the ordinary STUN protocol, Cling creates a stealthy command-and-control channel to issue instructions and disguise its malicious activities.
US Arrests Alleged Developer of Ploutus ATM Malware
A major breakthrough in the fight against cybercrime: US authorities have arrested Anibal Alexander Canelon Aguirre, the alleged mastermind behind the notorious Ploutus ATM malware that drained over $5.4 million from banks and credit unions nationwide. The suspect, also known as "Prometheus" and "The Engineer," was added to the FBI's Most Wanted list in 2026 and now faces charges of conspiracy to commit bank fraud.
WordPress Backdoor Persists Through Self-Healing Mechanisms
Meet the sneaky WordPress backdoor that refuses to be erased, thanks to its cunning self-healing mechanisms that spread its payload across eight files, the database, and shared memory. This clever malware can rebuild itself from any surviving copy, making it a formidable foe for security experts.
CloudSyncD Backdoor Exploits Zoom Installer to Infiltrate MacOS Systems
Meet CloudSyncD, a sneaky backdoor that's exploiting the Zoom installer to secretly infiltrate MacOS systems. This cleverly disguised malware can masquerade as a legitimate Zoom installer, putting your system at risk.
Star Blizzard Deploys RedFlick Malware via Automated Phishing Attacks
Microsoft warns that Star Blizzard, a Russian state actor, has launched over 13 large-scale phishing campaigns this year, infecting over 100 US and UK organizations with the RedFlick malware. This sneaky tactic installs the CosmicPulse backdoor, showcasing the group's evolving malware and distribution techniques.
Threat Actors Exploit ChatGPT Custom GPTs in ClickFix Malware Campaign
At least 40 users have fallen victim to a sneaky malware campaign that uses ChatGPT Custom GPT pages and Google Sites to spread a powerful remote access trojan (RAT). Attackers cleverly created fake Custom GPT links that appeared on Google search results, tricking users into downloading the malware.
ChatGPT Abused to Deliver Trojan Malware via ClickFix Attacks
Beware of a sneaky malware attack that's using ChatGPT and other trusted brands to trick you into downloading Trojan malware via a clever ClickFix scheme. Don't fall for it - no legitimate site will ever ask you to copy and paste a command to prove you're human!
Custom ChatGPTs Target Users with ClickFix Malware Attacks
Researchers at Huntress uncovered a sneaky campaign where custom ChatGPT versions were used to trick victims into downloading ClickFix malware, leading to a remote access trojan (RAT) infection. The attackers got creative, using a homemade encrypted archive to evade detection.
Malicious npm Packages Hijack Developers' WhatsApp Accounts
Beware of malicious npm packages that have been downloaded a staggering 490,000 times, hijacking developers' WhatsApp accounts and adding them to groups without consent. These 101 rogue packages exploit the popular Baileys WhatsApp open source project to pull off the scam.