Tag: malware operations
775 articles
ICS Threats Decline, But Biometrics Sector Remains Vulnerable
The threat landscape for industrial control systems (ICS) is showing a welcome decline, with only 19.15% of ICS computers encountering blocked malicious objects in Q2 2026 - the lowest level since 2022. However, amidst this positive trend, one sector remains alarmingly vulnerable: biometrics.
Australia Charges Two in TeamPCP Cybercrime Case Tied to Supply Chain Attacks
In a major breakthrough, the Australian Federal Police charged two men with 14 offences for their alleged roles in the notorious TeamPCP cybercrime syndicate, which compromised over 1,000 organizations worldwide and stole more than 500,000 credentials. The suspects, aged 23 and 21, were arrested and appeared in court after a joint operation seized electronic devices for forensic analysis.
Spark RAT Campaign Targets Cambodia, Abuses OPSWAT Driver to Disable Security Tools
A new Spark RAT campaign is targeting Cambodia, using clever tactics like phishing emails and signed DLLs to disable security tools and sneak malicious payloads into victims' systems. The attackers are casting a wide net with diverse lure themes, trying to catch as many unsuspecting victims as possible.
GoCaracal Malware Exploits Ethereum for Covert C2 Communications
Researchers have uncovered a sneaky new malware, GoCaracal, that uses Ethereum to secretly communicate with its controllers, and with medium confidence, they've linked it to the notorious Dark Caracal group. This clever malware was used in a recent attack on a Venezuelan communications organization.
FBI Disrupts Chinese Hacking Tools Targeting US Critical Networks
The FBI has successfully disrupted a Chinese hacking operation, seizing two malicious platforms - QScan and QTRouter - used to target high-value US networks and critical infrastructure. This significant takedown thwarts a major threat to US security, thanks to the Justice Department's court-authorized seizures of key domains.
Iranian Hacker Group Expands Arsenal with Advanced Backdoor, SSH Tunneler
Meet the Iranian Hacker Group that's expanding its cyber espionage arsenal with advanced tools, potentially setting its sights on a broader target list that includes Middle Eastern and European countries. Their latest moves suggest a more aggressive and sophisticated approach to digital spying.
Tortoiseshell Malware Toolkit Expands with New Backdoor, SSH Tunneling
Meet Tortoiseshell, a stealthy malware toolkit that's been lurking in the shadows since 2018, and just got a nasty upgrade with a new backdoor and SSH tunneling capabilities. This cyber-espionage group's toolkit expansion could spell trouble for defense, aerospace, and military organizations worldwide.
SLEEPWALKER Backdoor Exploits Windows for Stealthy Command Execution
Meet SLEEPWALKER, a sneaky new Windows backdoor that's been flying under the radar, allowing attackers to execute commands stealthily. This highly sophisticated malware is designed to evade detection, suggesting a targeted and well-resourced operation.
Hackers Exploit npm Mirrors to Host Phishing Pages
Hackers are exploiting npm mirrors to host phishing pages by uploading malicious HTML files to the npm registry, which are then mirrored and can be accessed directly in a browser. This clever tactic turns the trusted registry into a free web host for malware, allowing threat actors to spread phishing pages under the guise of legitimate content.
AI-Enabled Malware Detected but Not Dominant
The surprising truth about AI-enabled malware: despite collecting 405 samples, only 12 actually appeared on customer endpoints, revealing a significant gap in detection. This finding highlights the limited presence of AI-powered threats in the wild.
Malware Campaign Exploits FTP Banners to Deliver E4del and PINHOLE RATs
Malware attackers have found a sneaky way to control infected computers by hiding commands in plain sight - specifically, within the welcome messages that FTP servers send when you log in. This clever trick lets hackers use FTP server banners as secret instructions for their malicious software, E4del and PINHOLE.
npm Packages Host Fake Cloudflare CAPTCHA Pages via Unpkg Mirrors
Researchers uncovered a sneaky scam where attackers hide a fake Cloudflare CAPTCHA page inside harmless-looking npm packages, using mirrors to trick victims into revealing sensitive info. This clever tactic relies on exploiting trusted domains to deploy a ClickFix-style scam that redirects users to attacker-controlled infrastructure.
WeedHack Malware Persists, Adapts After Infrastructure Takedown
Even after its infrastructure was taken down, the sneaky WeedHack malware managed to adapt and persist, continuing to infect Minecraft players with its malicious code. McAfee researchers tracked over 6,300 attempts to access the malware in August, showing its resilience as a malware-as-a-service operation.
Mac Malware Exploits Fake OpenAI Codex Ads
Beware of fake OpenAI Codex ads: hackers are using Google search results to trick Mac users into downloading malware by pasting a malicious Terminal command. This sneaky tactic unleashes a multi-stage malware infection, putting your device at risk.
Malware Spreads via Fake Minecraft Clients Using SEO Poisoning
Malware is sneaking its way into gamers' computers through fake Minecraft clients, using clever tricks like search engine manipulation and spreading malicious links on popular platforms like Discord and YouTube. Over 6,300 attempts to access these malicious sites have already been blocked by McAfee Labs.
Malware researcher uncovers Sleepwalker Windows backdoor with custom command language
Meet Sleepwalker, a sneaky new Windows backdoor discovered by malware researcher Dominik Reichel, featuring a custom command language that allows it to hide in plain sight. This clever malware masquerades as a Microsoft system component, making it a formidable foe in the world of cyber threats.
Medusa Ransomware Gang Targets Over 500 Organizations, Experts Warn
The Medusa Ransomware gang has hit over 500 organizations since June 2021, and experts are sounding the alarm. This active and rapidly expanding Ransomware-as-a-Service campaign has prompted urgent warnings from top US security agencies.
Google Sites Abused to Deliver macOS Malware via Fake Codex Download
Malicious actors are tricking users into downloading macOS malware by hijacking Google searches for "Codex macOS download" and using fake Google Sites pages that mimic the real OpenAI Codex download portal. These convincing sites offer both macOS and Linux downloads, but only deliver a Mach-O payload to unsuspecting macOS users.
Malware Campaigns Deliver Stealers via ClickFix and Phishing
Beware of the sneaky ClickFix trick: just a click on the 'I'm not a robot' checkbox can lead to a malware attack, putting your sensitive info at risk. This clever scam uses a malicious command to download WordlistLoader, ultimately unleashing the Amatera Stealer.
UAT-10147 Deploys AI-Powered SPECTRE Backdoor with EDR Bypass
Meet UAT-10147, a Chinese-speaking cybercrime group that's taking AI-powered attacks to the next level with its sophisticated SPECTRE backdoor, capable of bypassing EDR defenses. This group's arsenal includes a range of open-source tools and custom AI solutions that streamline and scale their malicious operations.
ToxicPanda Malware Exploits VPN Permissions to Evade Google Play Security Checks
Meet ToxicPanda, a sneaky malware that's evolved to outsmart Google Play's security checks by exploiting VPN permissions and controlling device traffic. This cunning threat can now target nearly 350 apps and execute over 160 remote commands, putting your mobile security at risk.
Malware Targets Android Car Head Units in Proxy Botnet Scheme
Meet the first-ever malware specifically designed to infect Android car head units, forming a sneaky proxy botnet - a groundbreaking discovery made by Kaspersky researchers. This clever attack starts with a rogue APK hidden in a legitimate app from DoFun, a Chinese automotive software provider.
Supply Chain Attacks Target SDLC's Overlooked Corners
Meet the ChainDrop npm worm, a sneaky threat that infiltrated over 400 packages, including popular libraries like keyv and cacheable-request, by hiding in plain sight within routine developer workflows. This highly evasive threat uses a three-step chain to steal sensitive tokens and secrets, spreading its reach with alarming ease.
Malicious npm Packages Deploy AI-Powered RedC2 Linux Backdoor
Beware of 14 seemingly harmless npm packages that masquerade as calendar and streak utilities, but secretly deploy an AI-powered Linux backdoor, turning your system into a vulnerable target. These trojanized packages contain a bundled native binary that launches a detached background process, allowing malware to spread undetected.