#backdoor
-
WordPress SEO plugin Rank Math PRO turned its own update channel into a backdoor pipeline
Copies of the paid Rank Math PRO plugin downloaded or delivered as an update between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware. Any site that installed and activated one should be treated as compromised.
-
AOMEI Backupper Update Servers Tampered With in 5–10 Minute Windows to Push a Backdoor
Between May and July 2026 attackers repeatedly swapped the update files served from AOMEI's own servers, so the Windows backup program only downloaded a backdoor during those brief intervals.
-
Backdooring Open-Weight AI Models: the Hidden Cost of "Uncensored" Builds
Any model with edited weights can carry a hidden backdoor. Researchers built a poisoned model for next to nothing and made it steal a project's credentials straight through the Codex CLI.
-
Lily: an automatic backdoor hunter for the commit and release stages
Researchers have unveiled Lily, a tool that plugs into CI pipelines and release-review processes to catch hidden backdoors in open-source software before they ever reach users.
-
How a Single Link Opened a Backdoor Through the Sogou Keyboard for 455 Million Users
The China-linked group UNC3569 used a vulnerability in the popular Sogou input method to install the GRAYRABBIT backdoor. A single click on a link turned out to be enough.
-
PEEP Turns Chrome and Edge into Backdoors for Running Commands on the Host
SOCRadar researchers have exposed PEEP, a post-exploitation toolkit that masquerades as a bookmarks extension and turns the browser into a channel for remote access to the operating system.
-
Two Factory Implants with Root Access Found in ZBT Router Firmware
Researchers at VulnCheck have discovered two undocumented factory implants in the firmware of Chinese-made ZBT routers, giving an unauthenticated attacker remote command execution with root privileges.
-
SLEEPWALKER: the backdoor that sleeps until one “magic packet” arrives
An independent researcher has described a previously unknown Windows backdoor that lies dormant in memory until it receives a specially crafted network packet, then executes commands written in a custom 23-instruction language.
-
Trojanized QuickFox Installer Delivered the FDMTP Backdoor
Fortinet researchers have uncovered a years-long supply-chain attack on QuickFox, a VPN service aimed at Chinese nationals abroad: an infected Windows installer deployed the FDMTP backdoor, previously linked to the Mustang Panda group.
-
OctLurk and SilkLurk: a new espionage campaign against Central Asia
Kaspersky has documented a wave of attacks on government bodies in Central Asia dating back to January 2025. Behind them stands a presumably Chinese-speaking group armed with two previously unknown backdoors.