Tag: malware operations
775 articles
ClickFix Injects Malicious Scripts into Browsers to Siphon Cryptocurrency
A notorious fraud operation has taken a disturbing leap, evolving from tricking victims into running malicious commands on their computers to injecting harmful code directly into their browsers - all while masquerading as routine requests. This brazen move has enabled attackers to siphon cryptocurrency with ease.
Gigabud Malware Exploits Android App Cloning to Evade Detection
Malware attackers have found a sneaky way to evade detection by cloning legitimate Android apps, with a recent campaign racking up an estimated $960,939 in losses across 1,469 compromised devices in Indonesia. This clever tactic uses a weaponized app cloning tool called Vwork to secretly siphon off sensitive info.
WeChat Flaw Enables Zero-Click Worm Propagation
A shocking security flaw in WeChat allows hackers to take over an account in seconds with just a phone call, no answer required, and spread a zero-click worm to contacts automatically. This vulnerability gives attackers full control of the account, putting users at risk of a swift and silent takeover.
Hackers Deploy Linux Rootkit via F5 BIG-IP Flaw
Hackers are exploiting a critical F5 BIG-IP flaw, known as CVE-2025-53521, to deploy a sneaky Linux rootkit that allows them to execute code on vulnerable servers. This alarming attack vector has already exposed 795 endpoints online, putting countless systems at risk.
Threat Actors Target AI Coding Tools in Software Supply Chain Compromises
Threat actors are increasingly targeting AI coding tools to compromise software supply chains, with financially motivated groups like UNC6780 using malware like Dustmaker to gain initial access to AI environments. This growing trend highlights the need for heightened security measures in modern AI development pipelines.
Threat Actors Deploy AI Frameworks for Widescale Credential Theft
Threat actors have upgraded their game, leveraging AI frameworks to supercharge credential theft and drastically cut the time between initial compromise and large-scale attacks. Gone are the days of simple, one-off AI prompts - now, attackers are orchestrating entire attacks with sophisticated multi-agent frameworks.
THost9 Android RAT Exploits Exposed ADB Services to Spread
Meet the sneaky THost9 Android RAT that's exploiting exposed ADB services to spread its reach - and it can scan a massive 65,025-host range with ease.
BengalSEO Campaign Exploits Bing Search Results
Meet BengalSEO, a notorious group that's been secretly manipulating Bing search results with sneaky Black Hat SEO tactics since at least 2015, luring victims into malware and tech-support scams. They're masters of creating fake support pages that look legit, but actually serve as traps.
Rogue ScreenConnect Clients Propagate VBScript Worm
A sneaky VBScript worm is spreading rapidly through new ScreenConnect connections, launching a four-stage attack chain that wreaks havoc on unsuspecting hosts. This malicious chain was triggered by three distinct initial access routes, including tech-support scams, phishing, and fake refund forms.
JSCeal Malware Exploits Stolen Cookies to Bypass Google Authentication
Meet JSCeal, a sneaky malware that's using stolen cookies to outsmart Google's authentication - putting retail traders and cryptocurrency users in its crosshairs. It's spread through clever malvertising tactics, including fake ads on Facebook and Google that lead victims to counterfeit trading sites.
Phishers Exploit Invisible Unicode Characters to Evade Email Filters
Microsoft researchers uncovered a massive phishing campaign that used sneaky invisible Unicode characters to slip past email filters, peaking at a staggering 2.37 million messages per day in late February. This clever tactic, dubbed "ASCII smuggling," allowed scammers to hide finance-themed lures in plain sight.
Malware Modules Disable Windows Update, Defender for Crypto Mining
Meet LockAppHost, a notorious malware module that cripples your Windows defenses by disabling updates and Microsoft Defender, making way for a sneaky cryptocurrency miner to take over. By weakening your machine's security, it allows the miner to run undetected, wreaking havoc on your system.
Hackers Exploit 5,400 Sites to Serve Blockchain-Stored Payloads
Over 5,400 small-business websites, mostly built on WordPress and PrestaShop, have been hijacked to spread modular malware through a sneaky covert channel, with payloads cleverly stored on the BNB Smart Chain test network. This clever scheme uses a fake WebRTC handshake to trick victims into downloading the malware.
Microsoft Warns of Phishing Campaign Using Invisible Unicode to Evade Filters
Microsoft uncovered a massive phishing campaign that sent a whopping 1-2.37 million messages daily on weekdays, peaking on February 26, 2026, and cleverly used invisible Unicode characters to slip past filters. The campaign's weekly rhythm was remarkably consistent, with a sharp drop in activity after May 15, 2026.
CrowdStrike Zero-Day Exploit Grants SYSTEM Privileges on Windows Systems
A new zero-day exploit, dubbed FalconFlank, can grant attackers SYSTEM-level access to fully patched Windows machines protected by CrowdStrike Falcon, allowing them to spawn a command prompt with elevated privileges. This alarming vulnerability leverages CrowdStrike's own Office malicious macros remediation feature to perform a devastating privilege escalation.
Toy Ghouls Deploys Custom Backdoor via Unconventional Channels
Meet Toy Ghouls, a group that's taking malware to the next level with a custom backdoor that's deployed through unconventional channels, marking a significant shift from their previous reliance on public tools. Their new bespoke malware, mqtt-bird-agent and matrix-bird-agent, is a game-changer in the world of cyber threats.
BraZetsu Malware Fuels Underground Marketplace for Compromised Hosts
Meet BraZetsu, a powerful malware toolkit that's turning compromised computers into hot commodities on the dark web, allowing cybercrooks to buy, sell, and trade access to unsuspecting victims' systems. This game-changing tool has evolved from a simple remote-access trojan to an AI-enhanced platform, making it a highly sought-after asset for Initial Access Brokers.
Outsider Phishing Kit Persists After Takedown Effort
Despite a major takedown effort that seized servers, domains, and $100,000 in payment wallets, the Outsider Phishing Kit is still up and running, with over 700 new phishing pages created within just a month. This alarming resurgence shows that threat actors are relentless in their pursuit of online deception.
Infostealer Logs Expose New Identity Risks
Nearly half of all stolen corporate credentials come from personal or unmanaged devices, putting businesses at risk of identity breaches. Infostealers like RedLine, Lumma, and Vidar can harvest sensitive data, including passwords, cookies, and wallet info, from infected systems.
Shai-Hulud Infostealer Worm Targets 469 Credential Locations, Threatens Software Supply Chains
A recent Shai-Hulud infostealer worm variant has significantly upped the ante, now scanning 469 credential locations - a massive jump from 189 in earlier variants - to harvest sensitive access credentials and threaten software supply chains. This strategic shift allows attackers to exploit existing trust and gain unauthorized access with ease.
Threat Actors Exploit Node.js in Targeted Attacks
Malicious actors have compromised at least 31 organizations by exploiting Node.js, a trusted developer tool, to deliver long-running implants - and here's why this tactic is so appealing to attackers. By using legitimate Node.js runtime to deploy malicious payloads, threat actors can cleverly evade detection.
US-Led Operation Disrupts Sality P2P Botnet Infrastructure
A major international crackdown led by US law enforcement has successfully disrupted the notorious Sality P2P botnet, a malware network that has been wreaking havoc for over two decades. On August 31, authorities from Bulgaria, Hungary, Romania, and the US joined forces with Europol and private-sector partners to seize key domains and dismantle the botnet's infrastructure.
Law Enforcement Disrupts 23-Year-Old Russia-Based Botnet Sality
In a major cybercrime sting, law enforcement has dismantled a 23-year-old Russia-based botnet that had infected over 11 million devices worldwide. By cleverly tricking the network into cutting off access to its own devices, CrowdStrike rendered the notorious Sality botnet irrecoverable.
Malware Campaign Disables Windows Update, Weakens Defender
A sneaky malware campaign has been disabling Windows Update and weakening Defender, compromising multiple organizations and industries worldwide, with a focus on China-based operations and Chinese-speaking users. The culprit behind this malicious activity is linked to a Chinese threat cluster known as Silver Fox, or Yinhu.