#malware
-
ClickFix: How a Fake CAPTCHA Tricks Victims into Infecting Their Own Computers
ClickFix attacks have gone from an exotic rarity to a mass phenomenon: PC and Mac users are being tricked into running malicious commands themselves. Even pro-Kremlin hacking groups have taken up the technique.
-
WeWorm: the first zero-click worm for WeChat calls, written with the help of AI
Researchers at Calif Research have unveiled a demonstration of a worm that spreads through WeChat calls on iOS and Android without a single action by the victim. According to them, artificial intelligence did most of the work.
-
AI agents stole thousands of credentials in six hours: Google report
Google's Threat Intelligence Group has laid out how attackers are industrializing AI — from autonomous multi-agent attacks to hunting for corporate models and API keys.
-
Reconstructed Stuxnet source code posted on GitHub
A user going by the handle Sadpainy has published a repository containing the recovered source code of the legendary Stuxnet worm, framing it as educational material for malware analysis.
-
PEEP Turns Chrome and Edge into Backdoors for Running Commands on the Host
SOCRadar researchers have exposed PEEP, a post-exploitation toolkit that masquerades as a bookmarks extension and turns the browser into a channel for remote access to the operating system.
-
JSCeal: Crypto Malware Hijacks Google Sessions and Spoofs Exchange Traffic
Researchers at Check Point have dissected JSCeal — a compiled JavaScript malware that steals browser cookies, bypasses Google authentication, and tampers with crypto-exchange traffic.
-
REVSTEALER leaves four modules behind — one disables Windows Update and Defender to make room for a miner
Elastic Security Labs has documented four previously unknown programs tied to a new Windows stealer, REVSTEALER. Unlike the stealer itself, they persist on the system — and one of the modules muzzles the defenses to launch a cryptominer.
-
5,400 hacked sites serve up ClickFix payloads from the BNB blockchain
A large cybercriminal campaign is using thousands of compromised small-business sites to deliver malicious code hidden inside smart contracts on the BNB Smart Chain test network.
-
The Shai-Hulud Worm Now Hunts for Credentials in 469 Places — and That's a Symptom of a Tactical Shift
GitGuardian researchers have found that a new variant of the Shai-Hulud infostealer worm checks 469 secret-storage locations instead of the previous 189. Attackers have stopped breaking trust in the supply chain and are simply harvesting the keys that trust rests on.
-
Russian Extradited to U.S. Over Malicious Excel Files Sent to 80,000 Freelancers
The U.S. Justice Department accuses Searzhudin Aktulaev, a 40-year-old extradited from Cyprus, of a 2016–2017 campaign: using 255 fake accounts, he sent out infected Excel spreadsheets that installed remote-access trojans.
-
The Sality Botnet Neutralized by Its Own P2P Protocol
The US Justice Department has announced the takedown of the peer-to-peer Sality network, active since 2003. Investigators turned the botnet's resilient P2P architecture against itself.
-
GuardBreaker: hackers hide a nuclear-weapons prompt in their code to fool AI analysts
The pro-Russian group UAC-0099 embedded provocative text in a malicious script, designed to trip the safety mechanisms of language models and derail automated analysis.
-
Fire Ant Moves From Hypervisors to Cisco Routers
The Chinese cyber-espionage group Fire Ant is hijacking Cisco IOS XR routers, TACACS servers and Linux hosts, turning them into platforms for intercepting traffic and stealing credentials while blinding defenders' monitoring tools along the way.
-
Infostealers Are Hijacking Claude Sessions and Quietly Draining Users' Limits
Anthropic has warned some Claude customers that malware stole their active sessions, giving attackers access to their accounts and the ability to burn through someone else's usage limits.
-
TerminalFix: Fake Cloudflare CAPTCHAs Open the Door to Corporate Networks
Microsoft has disclosed a new strain of ClickFix attacks that tricks the user into running a malicious command in Windows Terminal or PowerShell and deploys a reverse tunnel into the victim's network.
-
18 Chrome extensions and one for Edge stole crypto wallet keys
Socket researchers have exposed the Superior campaign: attackers bought up and built harmless extensions, then used auto-updates to turn them into tools for stealing cryptocurrency.
-
HOOKEDGE: How APT28 Hides Espionage in Free Webhooks
Researchers at Recorded Future have detailed a new backdoor from the Russian group APT28 that has targeted diplomats in Romania, Spain and Turkey and disguises its command-and-control as ordinary network traffic.
-
SLEEPWALKER: the backdoor that sleeps until one “magic packet” arrives
An independent researcher has described a previously unknown Windows backdoor that lies dormant in memory until it receives a specially crafted network packet, then executes commands written in a custom 23-instruction language.
-
UAT-10147: cybercriminals turn server attacks into an assembly line with AI
Cisco Talos researchers have profiled a Chinese-speaking group that mass-compromises Windows and Linux servers, leaning on AI tools and a new cross-platform SPECTRE implant with EDR bypass and a Linux rootkit.
-
ToxicPanda 2.0 Blocks Google Play via VPN Permissions and Seizes Control of Android over ADB
The Android banking trojan has gained new capabilities: it hijacks VPN permissions to cut the device off from Google's protective services, and automates wireless ADB to gain shell access.
- More