#malware
-
Android 17 Locks Accessibility Services to Verified Tools Under Advanced Protection
Google is closing one of the main delivery channels for mobile malware: with Advanced Protection on, only verified apps classified as Accessibility Tools will reach the AccessibilityService API.
-
DirtyBlanket: fake Express packages on npm spread a self-replicating Linux worm
In 33 minutes the npm account dirtyblanket published nine malicious packages impersonating Express and React. Installing any of them on Linux starts a worm that steals keys and tokens and infects new machines.
-
Lunex Stealer Turns an AMD Driver Against the Very Tools Meant to Stop It
Ontinue has detailed the Lunex malware-as-a-service platform, whose Psychedelic stealer abuses a vulnerable AMD Radeon driver to blind security monitoring and harvest browser passwords.
-
Carbonato malware turns AI agents loose on exposed Docker hosts
A new worm-like botnet hijacks unprotected Docker daemons and deploys the GH0ST AI agent, which runs operator commands and harvests credentials.
-
Schneier: Defense-Evading Malicious npm Packages Feel Like Nation-State Work
Bruce Schneier flagged a set of malicious npm packages built to slip past defenses. Their sophistication, he says, hints at a nation-state — though there is no direct evidence and no attribution.
-
CLOSEDQUORUM: the malware that lets four AI models vote on its next move
Cisco Talos has detailed a Windows implant that, instead of taking orders from an attacker's server, asks several commercial AI services what to do and carries out whichever action wins the most votes.
-
China's UTA0565 Chains Chrome and Windows Zero-Days to Drop CLEANGULP
The group leaned on a three-flaw exploit chain and fake media and NGO websites to escape the browser sandbox and infect victims with a new backdoor.
-
Fake LastPass Installer Kills Antivirus With a Microsoft-Signed Driver
A bogus LastPass Authenticator page on GitHub served an installer that used a legitimately signed kernel driver to switch off security software before stealing passwords.
-
ChainScript: a new RAT hides its C2 lookup in a Polygon smart contract
Attackers are using ClickFix-style lures to deliver a previously undocumented remote access trojan called ChainScript, which finds its command servers through a smart contract on the Polygon blockchain.
-
North Korea's Jade Sleet Hits Indian IT Provider With FLATROOF and ROOFDECK Backdoors
SentinelOne has linked the Jade Sleet group to a breach of a small Indian IT firm using macOS backdoors already seen in the KelpDAO bridge attack. The case again shows that developers remain North Korea's favourite way in.
-
Malicious npm packages slip past install-script defenses by hiding in runtime code
The indexed-btree package poses as the popular sorted-btree library and hides its malicious loader not in install scripts but in an ordinary method that runs during normal application use.
-
North Korean WaterPlum group infects 30,000 devices worldwide
A joint alert from the intelligence agencies of four countries reports that North Korean hackers have stolen more than $10.7 million in cryptocurrency, targeting job seekers under the guise of fake interviews.
-
PhantomRaven: An AI-Written npm Stealer Built to Chase Bug Bounties
CrowdStrike has linked a financially motivated threat actor to malicious npm packages that stole developer tokens. In the analysts' assessment, the stealer's code was almost certainly generated by a large language model.
-
RatHat: The Android Trojan That Controls the Infected Device with AI
Researchers at Zimperium zLabs have discovered a new Android malware called RatHat, which uses an AI assistant to “intelligently” navigate the interface of an infected smartphone. Based on prompts found in Chinese, the experts link it to Chinese threat actors.
-
Chinese Group FamousSparrow Targets Latin American Governments with the SparroWocky Backdoor
ESET researchers have discovered a new modular backdoor, SparroWocky, that the China-linked group FamousSparrow is using for cyberespionage against government organizations in Latin America.
-
Iranian hackers spy on activists with the CHOSEN BRICK spyware
Government agencies in the US, the UK and the Netherlands, together with the FBI, have warned about a Windows malware that Iran's intelligence services use against dissidents, activists and journalists around the world.
-
Kaspersky: Three Groups Are Attacking Russian Companies — Backdoors, Ransomware and Wipers
Kaspersky Lab has detailed campaigns by the NightEagle, Hacking Cat and Toy Ghouls clusters against Russian enterprises: from stealthy espionage to destructive attacks.
-
BambooToken: Malware Controls Windows and Linux Through the IoT Protocol MQTT
A previously unknown malware framework called BambooToken, active since at least 2023, has adopted the lightweight MQTT protocol for covert communication with infected servers. According to Lumen researchers, the nature of the attacks points to a link with pro-Chinese operations.
-
Red Heron Breaches 13 Organizations Through a Gitea Vulnerability
In a matter of days, the presumed Chinese group Red Heron turned a public Gitea exploit into an automated tool and struck targets across six countries.
-
Twitch Extension Leaked OAuth Tokens of Nearly 31,000 Users
The malicious browser extension “Twitch Enhanced Viewer | JeetBot” forwarded viewers' session tokens to the proxy servers of a commercial bot service — except for the sessions of ten Russian streamers.
- More