Tag: malware operations
775 articles
Russian Man Extradited for Malware Campaign Targeting Freelancers
A massive malware campaign targeting nearly 80,000 freelancers worldwide has led to the extradition of a Russian national, Searzhudin Tamirlanovich Aktulaev, who faces charges of conspiracy, computer damage, and identity theft. Aktulaev's alleged crimes, committed between 2016 and 2017, have finally caught up with him after an international arrest and extradition.
BGP Hijack Targets Virtualizor Users with Persistent Root Access Malware
A recent BGP hijack attack targeted users of Virtualizor with malware that granted persistent root access, affecting a limited number of servers that received rerouted Softaculous update traffic during a 33-hour window. The attackers cleverly obtained a valid Let's Encrypt certificate, making the malicious server appear trustworthy to clients.
Russian Hacker Charged Over Excel Malware Campaign Targeting Freelancers
A massive malware campaign, involving around 255 fake accounts and 80,000 targeted users, has led to charges against a Russian national, Searzhudin Tamirlanovich Aktulaev, who has been extradited and charged by the U.S. Department of Justice. The campaign, which spread malware through infected Excel attachments, allegedly ran from June 2016 to November 2017, targeting freelancers and others.
US Indicts Russian for Infecting 80,000 Freelancers with Malware
A massive phishing campaign infected 80,000 freelancers with malware, using 255 fake accounts to spread malicious Excel attachments with hidden macros that downloaded additional software onto victims' systems. The cleverly designed scam exploited a popular freelance employment platform's online messaging feature to spread its digital damage.
Authorities Disrupt Sality's P2P Network, Neutralize Malware Payloads
In a major win for national security, authorities have successfully dismantled the Sality malware's peer-to-peer network, crippling its ability to spread and cause harm. By cleverly turning the malware's own protocols against it, law enforcement and private partners isolated infected hosts and rendered the threat actor powerless.
Global Authorities Disrupt Sality Botnet Infrastructure
In a major win for cybersecurity, global authorities have joined forces to dismantle the notorious Sality botnet infrastructure, seizing key domains in the US and Europe. This coordinated crackdown, involving the US Department of Justice and international partners, has disrupted the malware's grip on thousands of infected computers.
CrowdStrike and Law Enforcement Disrupt 23-Year-Old Sality Botnet
In a major win for cybersecurity, CrowdStrike and international law enforcement agencies joined forces to dismantle the notorious Sality botnet, crippling its ability to communicate and operate by corrupting its core network. By targeting the botnet's peer list, they effectively isolated infected machines and brought the 23-year-old threat to a grinding halt.
Hackers Exploit Faronics Tool to Install ScreenConnect on Compromised Endpoints
Hackers are using clever phishing lures disguised as invoices and business files to trick victims into installing malicious software, with over 457 endpoints compromised in just a month. They exploited a legitimate endpoint-management tool to gain remote control and install additional remote-access software.
Breeze Comet Exploits Brazilian Payment Systems in Hundreds of Fraudulent Transactions
Meet Breeze Comet, a financially motivated threat actor that's been wreaking havoc on Brazilian payment systems with hundreds of fraudulent transactions, exploiting customized malware and compromised websites to siphon off tens of thousands of dollars. Their tactics are evolving, and Latin American countries should beware of potential expansion.
Hackers exploit BGP hijacking to deliver malicious Virtualizor updates
Malicious actors hijacked internet traffic to deliver fake Virtualizor updates to a small number of users, exploiting a vulnerability in the Border Gateway Protocol (BGP) to divert update requests to their own servers. This sneaky move allowed them to push malicious updates to unsuspecting users.
Russia-Aligned Hackers Inject Nuclear Prompt to Evade AI Analysis
Hackers have found a sneaky way to outsmart AI-powered security tools by injecting a provocative phrase, like a threat to create a nuclear weapon, into malicious code to disable analysis. This clever trick, dubbed GuardBreaker, tricks AI scanners into failing to examine the rest of the script.
Venezuelans Plead Guilty to ATM Jackpotting Attacks
Meet the five Venezuelan nationals who just pleaded guilty to orchestrating a string of daring ATM jackpotting attacks across the US, using malware to target vulnerable machines and make off with the cash. Their clever - but ultimately doomed - scheme involved installing malware in ATMs, but surveillance caught them in the act, leading to their arrest and guilty pleas.
Microsoft Exposes TerminalFix Attacks Deploying Reverse Tunnels
Beware of TerminalFix attacks that use fake Cloudflare CAPTCHA prompts on compromised websites to trick you into executing malicious PowerShell commands in Windows Terminal. These sneaky attacks can lead to more complex threats, making it crucial to stay vigilant online.
Microsoft Warns of TerminalFix Malware Hiding in PNGs
Microsoft researchers have uncovered a sneaky malware campaign, dubbed TerminalFix, that hides in plain sight by masquerading as harmless PNG images - only to delete them after extraction, leaving behind a trail of PowerShell commands that can compromise your system. This fresh variant of the ClickFix social-engineering trick tricks victims into pasting malicious commands into Windows Terminal or PowerShell.
Anthropic Disrupts AI Token Mining by Hijacked User Accounts
Anthropic swiftly took action against compromised accounts, logging users out and removing payment methods to prevent stolen sessions from being exploited for paid AI usage. The company assured users that its investigation found no link between the malware and its AI model, Claude.
Silver Fox Exploits Adware to Deploy ValleyRAT Backdoor
Meet Silver Fox, a sneaky threat actor that's been using adware to disguise a powerful backdoor called ValleyRAT, which can give attackers full control over your computer. They've even hijacked a legitimate Chinese desktop wallpaper tool to spread their malicious software.
ValleyRAT Exploits Adware to Evade Detection
Meet ValleyRAT, a sneaky backdoor that's been evading detection with the help of adware, infecting over 1500 users in China and India with a staggering 100,000 detections in 2026 alone. Its clever disguise was uncovered when researchers dug deeper into a suspicious installer initially labeled as ordinary adware.
Anthropic Warns of Infostealer Malware Hijacking Claude Sessions
Beware of infostealer malware that's hijacking Claude sessions! Anthropic is taking swift action to protect users, including signing them out of compromised accounts, removing saved payment methods, and offering refunds for unauthorized charges.
Microsoft Warns of TerminalFix Backdoor Deploying via Fake Cloudflare CAPTCHAs
Beware of fake Cloudflare CAPTCHAs that can lead to a sneaky backdoor invasion, giving attackers direct access to your organization's internal network. A new variant of malware, called TerminalFix, tricks victims into executing a malicious PowerShell command, allowing hackers to gain control.
Malicious Extensions Target Chrome, Edge Users With Crypto-Draining Code
Beware: malicious Chrome extensions have been discovered that can secretly drain your cryptocurrency wallet! Security researchers uncovered a sneaky campaign that uses 19 extensions to steal wallet secrets and drain crypto funds.
SVG Attachments Fuel Large-Scale Phishing with JavaScript Smuggling
A massive phishing campaign, detected in over 5,500 organizations, used sneaky JavaScript smuggling tactics to evade native defenses, with a whopping 26,589 messages sent over just two months. The attackers cleverly exploited SVG attachments and voicemail lures to spread executable code.
Ransomware Actors Exploit AI Tool in Sophisticated Attacks
Ransomware attackers are now using AI tools like Claude Sonnet to supercharge their assaults, with one group successfully exploiting the technology to target 10 victims in just a few weeks. By leveraging advanced tools like SpaceX's Cursor Agent, these cybercriminals are refining their tactics and getting bolder.
CRPx0 Ransomware Service Rapidly Expands, Targets 48 Organizations
CRPx0's ransomware service has exploded onto the scene, rapidly expanding its reach to target a staggering 48 organizations - a number that's skyrocketed from fewer than 10 just a few months ago. This alarming growth follows the group's shift from a basic hacking service to a full-fledged, white-label ransomware operation.
China Exploits US Infrastructure in Widespread Hacking Campaign
The US Department of Justice has taken a major stand against China's widespread hacking campaign, disabling malicious software and seizing two key hacking platforms, QScan and QTRouter, to protect America's critical infrastructure. This decisive action is a significant blow to state-sponsored hackers preying on the US, with the Attorney General vowing to use every tool at their disposal to keep the American people safe.