Tag: malware operations
775 articles
Microsoft Tracks NeedyMantis Malware Enabling Persistent Network Access
Microsoft uncovered a sneaky malware operation, dubbed NeedyMantis, that's been secretly giving hackers prolonged access to compromised networks since at least October 2025. This stealthy threat has been targeting key sectors like telecommunications, universities, and government-linked organizations, primarily in campaigns linked to China.
Microsoft Exposes NeedyMantis Malware Used in Long-Term Network Breaches
Microsoft uncovered a sneaky malware called NeedyMantis that's used to secretly maintain long-term access to compromised networks. This lightweight but persistent threat is designed to fly under the radar, allowing attackers to keep a grip on networks for an extended period.
Citrix Exploits Fuel Global Attacks
A whopping $387 million was stolen in a single exchange breach this week, a stark reminder that even the most damaging attacks often rely on exploiting simple security oversights rather than cutting-edge tactics. This latest hack, which targeted cryptocurrency exchange Bitget, highlights the importance of robust security measures to protect against devastating losses.
Carbonato Botnet Exploits Docker Hosts to Deploy AI-Controlled Malware
Meet Carbonato, a sneaky botnet that's exploiting Docker hosts to spread AI-controlled malware, and learn how it uses a clever worm-like approach to propagate across networks. It starts by targeting Docker daemons left exposed without authentication, allowing it to install malware and create remote access.
Fake HR Apps Install ScreenConnect for Remote Access
Cybercriminals are using fake HR apps to trick employees into installing ScreenConnect, granting hackers persistent remote access to their machines. This sneaky tactic targets HR and payroll staff, putting sensitive company data at risk.
PamStealer Malware Evolves with Live C2 Decryption and Enhanced Persistence
Meet the latest variant of PamStealer malware, which has evolved with a sneaky new trick: it can only be decrypted through a live command-and-control session, making it even harder to track and stop. This fresh threat uses a fake cryptocurrency wallet site, wavel.app, to lure victims into downloading a malicious disk image file.
GitHub Actions Resumes Executing Mini Shai-Hulud Malware After Re-Enablement
Malware linked to the Mini Shai-Hulud campaign suddenly roared back to life on September 16, 2026, when two compromised GitHub Actions repositories were mysteriously re-enabled. This alarming revival happened despite previous efforts to take the repositories offline following a security breach in May 2026.
AI Compresses Cyberattack Loops, Pressures SOC Response Times
Cybercriminals are now leveraging AI to supercharge their attacks, using it to discover vulnerabilities, develop exploits, and automate tasks - putting pressure on security teams to respond faster than ever. In fact, by late 2025, AI-powered malware and illicit AI tools were already emerging on the dark web, changing the game for threat actors.
MacSync Malware Exploits iCloud Calendars for Payload Delivery
Meet MacSync, a sneaky new malware that's exploiting iCloud calendars to spread its reach - it hides commands in public calendar events to download its next-stage payload. This Swift-based infostealer has recently upgraded its tricks, using social engineering and fake apps to infect Macs.
Carbonato Malware Exploits Exposed Docker Hosts with AI-Powered Botnet
Meet Carbonato, a sneaky new malware campaign that's taking advantage of exposed Docker hosts to build an AI-powered botnet, and discover how it compromises vulnerable systems with ease. It targets Docker daemons with exposed APIs, using them to launch a privileged container and gain broad access to the host.
ClickFix Campaign Targets Ukraine with Psychedelic Stealer Malware
Malicious hackers have launched a sneaky campaign in Ukraine, hijacking local business websites to spread a powerful malware called Psychedelic Stealer, which can swipe sensitive info from unsuspecting victims' computers. They even used a fake Cloudflare verification trick to make the attack look legit.
Ransomware Gang n0n Threatens Backup Destruction to Press Victims
Meet the ransomware gang n0n, a new player in the cybercrime scene that's taking extortion to the next level by threatening to destroy or encrypt backup systems, leaving victims with a daunting choice: pay up or lose everything. Organizations are urged to take immediate action to protect themselves from this double-extortion threat.
MacSync Malware Evolves With New Delivery Methods
Meet the latest evolution of MacSync malware, which has upgraded its delivery methods with compiled binaries, Objective-C and Swift modules, and clever use of Apple infrastructure to spread its reach. This rapidly changing threat was first spotted in the wild in September 2026, and it's getting more sophisticated by the minute.
Corp MDM Spyware Targets Logistics Firms with SMS Theft and Call Redirects
Meet Corp MDM, a sneaky Android spyware implant that's targeting logistics firms by stealing SMS messages and redirecting calls, allowing hackers to get their hands on high-value content. This compact surveillance tool is designed to fly under the radar, making it a potent threat to unsuspecting victims.
ClickFix Malware Exploits Legitimate Sites via Clipboard Trickery
Beware of ClickFix malware, a sneaky threat that's taking over 47% of enterprise networks by tricking users into pasting a malicious command into their own systems. It starts with a fake fix for a common problem, quietly copying a malicious command to your clipboard and asking you to paste it into a trusted tool.
Ransomware gangs exploit TeamCity flaw in targeted attacks
A critical TeamCity vulnerability, now patched, could let attackers run malicious commands and bypass security checks, putting sensitive data and configurations at risk. This flaw highlights the importance of updating to versions 2025.11.7 and 2026.1.3 to safeguard against potential threats.
Malicious Site Exploits Placeholder Domain to Target Windows Users
This sneaky malicious site uses a simple yet effective trick to target Windows users, pretending to be a harmless CAPTCHA verification process while secretly loading a PowerShell command that puts users at risk. By tailoring its attack to only Windows users, the site's operators increase the likelihood of a successful exploit.
North Korean Hackers Exploit Terraform Registry to Deliver Go Malware
In a groundbreaking move, North Korean hackers have exploited the Terraform Registry to spread Go-based malware, marking the first time threat actors have used this centralized repository as a distribution vector for malicious payloads. This alarming development was uncovered by security firm Aikido, which identified several malicious Terraform providers and Go modules published to public registries.
AI Agents Fuel 600K Credit Card Heist, Infect 100+ Sites
In a massive heist, over 600,000 valid credit card details were stolen from online retailers using open-source AI agent frameworks to compromise at least 119 websites and deliver skimmer malware at scale. The alarming campaign, active since July, saw a concentrated burst of 105 attack waves in just five days, targeting major companies and leaving a trail of digital devastation.
Malware Leverages AI Models to Decide Next Move
Meet CLOSEDQUORUM, a sneaky Windows implant that outsources its decisions to commercial AI services like DeepSeek and Google Gemini, allowing it to adapt and evolve its attacks in real-time. This clever malware sends a snapshot of its host environment to multiple AI models, then executes the action that gets the most votes.
Malicious MemTensor Packages Spread sckit Credential Stealer via npm and PyPI
Beware: compromised MemTensor packages on npm and PyPI are spreading a sneaky credential stealer called sckit, which can steal your sensitive info. Malicious actors have hijacked these packages to secretly install the sckit malware, putting your credentials at risk.
Ransomware Attacks Soar to Record 1073 in August
Ransomware attacks just hit a record high, with a staggering 1,073 organizations falling victim in August - a 12% surge from the previous month and a clear sign that these threats are on the rise. This worrying trend marks the second consecutive month of peak activity, with North America bearing a significant 44% of the incidents.
Windows Malware Exploits AI Models for Autonomous Post-Compromise Actions
Meet CLOSEDQUORUM, a sneaky Windows malware that outsources its decision-making to AI giants like Google Gemini and Mistral, allowing it to autonomously pull off post-compromise actions. This cunning code queries multiple AI models, tallying their votes to determine its next move - and even has a tiebreaker system in place!
Malicious npm Package Exploits Twilio Developers for Credential Theft
Malicious actors have struck again, this time with a fake npm package called tw-pkgprobe-7731 that masquerades as a security research tool to steal credentials from unsuspecting Twilio developers. The package was cleverly designed to evade detection, only collecting and exfiltrating sensitive data when it detected a Twilio developer environment.