#malware
-
953 Online Stores Hit by JavaScript That Hides From Scanners
Since July 2025 an unknown group has planted a malicious loader in Magento stores — code that tells real shoppers apart from security scanners and only serves its payload to live visitors.
-
AdFection: Spyware Delivered to Journalists Through an Ad Network — Without a Single Click
Citizen Lab researchers describe a first-of-its-kind attack that fuses malvertising with zero-click infection: the surveillance ad-tech ecosystem turned into a precision delivery channel for spyware.
-
AI Agents on the Job: Ransomware Crews Automate Break-Ins With the Phantom Framework
SOCRadar researchers uncovered an AI-driven intrusion ecosystem used by affiliates of the INC and The Gentlemen ransomware groups. At its core is Phantom, where a human merely sets the target and approves each step while commercial language models do the work.
-
Sandworm and UAC-0099 Hit Ukraine With a Backdoor Hidden in the Yggdrasil Mesh Network
ESET reports that two Russia-linked groups joined forces for a destructive wiper attack on a Ukrainian logistics firm, running a backdoor over the Yggdrasil peer-to-peer network for the first time.
-
Compromised LiteLLM 1.107.0 on PyPI shipped a credential stealer and backdoor
Version 1.107.0 of the popular LLM gateway LiteLLM, uploaded to PyPI, carried a credential stealer and a remote-code-execution backdoor. The GitHub source was clean, yet the malicious files ran on every Python process start on the host.
-
Chrome to Warn Users About ClickFix Command Traps
Google is adding ClickFix protection to Chrome: with Enhanced Protection on, the browser spots suspicious clipboard commands and warns users before they run them.
-
Hijacked account: five OVHcloud CLI releases swapped for secret-stealing malware
An attacker used a hijacked contributor account to replace the archives in five releases of OVHcloud's command-line tool. The malicious build stole secrets from disk and was live on GitHub for just 94 minutes.
-
ClickFix Attack Abuses Siemens Software Center Flaw to Drop a Remote Access Trojan
Siemens has patched a DLL sideloading flaw in Siemens Software Center that attackers already exploited, using the legitimately signed program as a carrier for malicious code.
-
ROMULUS Platform Turns ClickFix Into a Malware Delivery Pipeline
Forescout has detailed ROMULUS, a malware delivery service that uses ClickFix lures on fake landing pages to make victims run malicious commands themselves.
-
WordPress SEO plugin Rank Math PRO turned its own update channel into a backdoor pipeline
Copies of the paid Rank Math PRO plugin downloaded or delivered as an update between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware. Any site that installed and activated one should be treated as compromised.
-
Fake Web3 Accelerator Pushed Malicious npm Packages Posing as Free AI Credits
A crew masquerading as a venture accelerator for crypto startups spread infostealers and backdoors through npm, dangling free Claude and Gemini credits — while quietly hijacking the traffic of AI agents.
-
Malicious npm Package imgdecode Hides a Shellcode Loader in a Windows Native Addon
SafeDep researchers flagged imgdecode, an npm package that is part of the long-running MALFEX campaign aimed at compromising Windows systems. Despite public exposure, it remains available and has already been downloaded 979 times.
-
Targeted ads used to deliver 0-click exploits and install mercenary spyware
Researchers report what appears to be the first confirmed case of commercial spyware delivered through targeted advertising.
-
Fake Arch Linux packages delivered root-level malware
A threat actor uploaded AUR packages posing as the popular yay and paru helpers, bundling legitimate code with a malicious script that ran with root privileges.
-
Hirudo Android Trojan Swaps Banking Apps for Their Own Patched Copies
ThreatFabric has detailed Hirudo, a new Android trojan that deletes the genuine banking app and installs a pre-patched copy that blinds the app's own security checks from the inside.
-
Budget Android Phones Arrive With Malware Already Built Into the Firmware
Bitdefender has uncovered Midnight Mimosa, malware baked into the firmware of cheap Android phones that turns them into residential-proxy nodes and ad-fraud tools.
-
Karaoke giant's contractor hit by malware, exposing 8.6 million fan records
Japan's largest karaoke operator, Daiichi Kosho, says a malware infection at its contractor Nippon Columbia may have exposed data on more than 8.7 million customers and employees.
-
PoeLLM Hides Its C2 Address in a Poem, Infecting 3,400+ Servers
The Canto Incognito campaign hunts internet-exposed AI and LLM services, turning them into cryptocurrency miners and scanners that seek out fresh victims.
-
CERT-UA: 100+ Hacked Sites Push LunexStealer via Fake Cloudflare Check
Ukraine's CERT-UA has found over a hundred compromised websites that, under the guise of a "prove you're human" check, coax visitors into running a malicious command themselves.
-
Linux Backdoors Pose as Email Security Tools to Hide in Korean and Taiwanese Networks
Rapid7 has detailed a family of Linux implants that disguise their traffic as email services and name their processes after SpamSniper and ShareTech, two email-security products popular across the region.
- More