Tag: malware operations
775 articles
AI-Powered Windows Malware Autonomously Decides Attack Steps
Meet ClosedQuorum, a sneaky new Windows malware that uses AI to call the shots - autonomously deciding its next move by gathering intel from infected hosts and getting advice from a panel of commercial AI models. This cutting-edge threat is making waves as the first publicly documented Windows implant to hand over tactical decisions to AI.
NightmareEclipse Exploits Microsoft Defender Update Process
Meet BigDiskBuster, a clever tool created by NightmareEclipse that cleverly blocks Microsoft Defender updates, leaving you stuck with your current version if it's running in the background. This proof-of-concept has been designed to prevent platform and security intelligence updates from installing.
North Korean Hackers Infect 30,000 Devices in Global Cyberattack
In a massive global cyberattack, North Korean hackers infected a staggering 30,000 devices across over 100 countries, siphoning off a whopping $10.7 million in cryptocurrency. The brazen heist, which ran from December 2025 to July 2026, also compromised over 7,000 cryptocurrency wallets.
Microsoft Defender Zero-Day Blocks Antivirus Updates
A security researcher just released a clever tool called BigDiskBuster that can block Microsoft Defender updates, leaving your antivirus stuck in limbo. This sneaky proof-of-concept allows anyone to prevent Defender from getting the latest signature and platform updates, as long as the tool is running in the background.
Malicious npm Packages Evade Detection by Hiding in Runtime Code
A sneaky malicious npm package, indexed-btree, has been hiding in plain sight by disguising its loader inside ordinary library code, allowing it to evade detection and rack up millions of downloads. This cleverly crafted package mimicked a legitimate B-tree utility, but with a sinister twist that went undetected until it was removed from the npm registry.
SideCopy Targets Indian Academia with ReverseRAT Spear-Phishing
SideCopy, a notorious Pakistani threat actor, has set its sights on Indian academia with a cunning spear-phishing campaign, marking a tactical shift from its previous targets of government and defense forces. Using malicious scripts to evade security protocols, this group is now compromising academic institutions in India.
North Korea Targets 30,000 Devices in Global Crypto Heist
North Korean hackers have launched a massive global crypto heist, compromising over 30,000 devices in more than 100 countries and stealing at least $10.71 million in cryptocurrency. This staggering cybercrime spree has been uncovered by a joint advisory from top cybersecurity agencies worldwide.
Ransomware Actors Exploit Active Directory Group Policy
In a clever twist, hackers used Active Directory Group Policy to spread ransomware across an entire domain without installing a single malicious file on individual computers. By exploiting this native tool, they were able to hijack wallpapers, lock screens, and even disable admin accounts, all with just a few clicks.
PowerShell Backdoor TASK#STOMP Exfiltrates Sensitive Data in Stealthy Campaign
Meet TASK#STOMP, a sneaky PowerShell backdoor that's quietly harvesting sensitive business data, including documents, Wi-Fi passwords, and clipboard contents, while also taking screenshots and allowing remote control. This stealthy campaign uses a clever VBS-driven framework to evade detection and keep its operators informed.
Exvicy Malware Framework Exploits Rival Code to Target WordPress Sites
Malware operators are sounding the alarm: detections of the Exvicy Malware Framework are on the rise, with one seller warning that daily detections are making their service less effective. The Russian-speaking actor behind Exvicy is now charging $2,000 a month for the malware-as-a-service framework, up from $1,200 just a few months ago.
Attackers Exploit npm Trusted Publishing in GHAPPIER Supply Chain Campaign
Malicious actors have cleverly exploited npm's trusted publishing feature to unleash a supply-chain attack, using a hijacked maintainer account to distribute a sneaky loader called GHAPPIER. They got away with it by hiding behind a valid provenance attestation, highlighting a loophole in the system.
ShinyHunters Disrupts Clop Ransomware Gang's Operations
In a bold move, ShinyHunters infiltrated and defaced Clop's dark web leak site, claiming to have stolen sensitive private keys and server data that could dismantle the notorious ransomware gang's operations. This daring cyber heist has sent shockwaves through the ransomware underworld.
Rivals Hijack Clop's Leak Site, Demand Eight-Figure Payout
A rival hacking crew, ShinyHunters, has hijacked Clop's dark-web leak site, posting a bold takeover message and demanding an eight-figure payout in a shocking display of cyber power. The group claimed to have exploited a vulnerability in Clop's software to seize control of the site.
Rust Project Warns of Fake Job Interviews Used to Spread Malware
Scammers are tricking people into installing malware or executing malicious commands by posing as potential employers or clients on video calls, often under the guise of a job interview or contract opportunity. They set up fake company profiles and LinkedIn pages to make their ruse appear legitimate.
Malware Campaigns Exploit ClickFix to Deploy RATs via Blockchain Infrastructure
Malicious ads masqueraded as legitimate software, spreading malware like ChainScript RAT through blockchain infrastructure via ClickFix lures, targeting both macOS and Windows users. Security researchers uncovered 108 fake ads from a hijacked Reddit account that seeded multiple malware families over just 48 hours.
Jade Sleet Targets Indian IT Provider with FLATROOF and ROOFDECK Backdoors
North Korean-aligned threat actor Jade Sleet has launched a targeted attack on an Indian IT provider, using FLATROOF and ROOFDECK backdoors to gain long-term access to high-value targets by exploiting developer workflows and supply-chain tooling. The attack, detected as early as March 18, 2026, is part of a persistent campaign that highlights the group's evolving tactics.
North Korean Hackers Infect 30,000 Devices in Global Campaign
North Korean hackers have pulled off a massive global cyberattack, infecting 30,000 devices in over 100 countries and making off with millions in cryptocurrency. The financially motivated gang, known as WaterPlum, has been siphoning funds and account credentials from over 7,000 cryptocurrency wallets since December 2025.
Malware Campaign Targets LastPass Users with Rapuncel Infostealer
Beware of a sneaky malware campaign targeting LastPass users with the Rapuncel Infostealer - hackers are using fake GitHub repositories and search engine tricks to steal your info. Victims who search for popular software like LastPass Authenticator may unknowingly download the malware.
Settra Ransomware Targets Retail, Manufacturing with Advanced Tactics
Meet Settra, a sneaky new ransomware variant that's targeting retail and manufacturing firms with clever tactics, leaving a trail of chaos in its wake. First spotted in June, this malicious software has already been linked to two separate attacks, one in July and another in September.
npm Packages Deliver WeaselBiscuit Stealer to Harvest Chrome Data
Meet WeaselBiscuit, a sneaky new malware that's small but packs a punch, stealing Chrome data by masquerading as harmless npm packages. This stripped-down stealer is designed to evade detection, and it's being spread through 13 infected npm packages.
Threat Actor Exploits LLM to Craft PhantomRaven npm Stealer
Meet PhantomRaven, a sneaky JavaScript information stealer crafted by a financially motivated actor - and likely created with the help of a large language model, a cutting-edge AI tool. The surprising twist? The malware's code reveals telltale signs of AI involvement, including verbose comments and placeholder code.
RatHat Malware Exploits ADB to Maintain Shell Access on Android Devices
Meet RatHat, a sneaky Android malware that uses Accessibility tricks and ADB exploits to break free from the sandbox and gain shell-level control on your device. By combining these tactics, RatHat can secretly pair with your device and run malicious daemons with elevated privileges.
Iran-Linked Malware Exploits Telegram for Password Theft
Meet HEAVYGRAM, a sneaky Telegram backdoor linked to Iran that's packed with espionage capabilities, from snapping screenshots to siphoning off sensitive data, and controlled remotely by its masters. This malicious tool has been quietly lurking in the shadows since September 2023, leaving a trail of compromised systems in its wake.
MovieReaper Malware Targets Users via Compromised Torrents
Meet MovieReaper, a sneaky new malware that's been infecting hundreds of victims worldwide by hiding in compromised torrents, and Kaspersky's security researchers are sounding the alarm. This modular threat has been spreading rapidly across Europe, Asia, and Africa, putting both individuals and organizations at risk.