#malware
-
Android Car Head Units Turned Into Proxy Botnet Nodes
Kaspersky researchers have described a supply-chain attack in which infected Android-based car head units become part of a proxy network and take part in advertising fraud.
-
SynkLoader: New Malware Strikes Through Microsoft Teams Phishing
Researchers at Expel have discovered a previously unknown piece of malware called SynkLoader that steals corporate passwords through a fake Windows lock screen. The attack begins with a message from a bogus IT support desk in Teams.
-
14 Trojanized npm Packages Deploy the AI-Controlled Linux Backdoor RedC2 4.0
Trend Micro researchers have found a set of npm packages that, posing as calendar utilities, covertly deploy the Linux implant RedC2 4.0. A single import anywhere in the dependency tree — even a transitive one — is enough to trigger the payload.
-
A Rust Supply-Chain Attack: the Poisoned arrayref 0.3.10 and the proc-macro1 Typosquat
A compromised maintainer account and a fake copy of a well-known author's crate turned a routine cargo update into the silent execution of malicious code whenever a project was built.
-
Microsoft Links More Than 30 Domains to the Infrastructure of the MacSync macOS Stealer
Microsoft Defender experts traced the path of the MacSync macOS stealer from payload download to data theft, correlating recurring network and behavioral markers across constantly shifting infrastructure.
-
“Mind Viruses” Hop Between AI Agents Through Memory Files
Researchers at Anthropic and EPFL have shown that self-propagating payloads can flow from one autonomous AI agent to another through the editable files that store state between sessions. In the real world, the technique hasn't worked so far.
-
16 Fake RubyGems Steal Passwords and Crypto Wallets Under the Guise of a Build
The StubMaker campaign disguises typos as popular Ruby libraries and launches a Windows stealer, exploiting flaws in RubyGems itself.
-
Microsoft Pulls WMIC from Windows 11 — a Tool Beloved by Hackers
The legendary WMIC command-line utility is vanishing from Windows 11: Microsoft is finishing its removal in versions 24H2 and 25H2, as well as in the latest beta builds. The reason — years of the tool being abused by attackers.
-
A Duo of Android Malware Takes Out Loans and Relays Victims' Cards in Real Time
The new NFC relay tool WindRelay works in tandem with the RAT SpyNote: attackers gain remote access to a smartphone, take out a loan in the victim's name, and siphon off their bank card data live.
-
Malicious Solidity Pro Extensions for VS Code Steal Developers’ Wallets and Keys
Researchers at Yeeth Security have uncovered Solidity Pro extensions that, posing as tools for Ethereum developers, steal crypto wallets, tokens and API keys. The malware activates on a delay to slip past marketplace review and antivirus scanners.
-
TeamPCP: From 2020 Redis Attacks to Supply-Chain Attacks
Researchers at Oligo Security have linked the TeamPCP group to campaigns against internet infrastructure stretching back to 2020. One variant of the malware gained a wiper function that triggers based on the Iranian time zone.
-
ClickFix for macOS: an infostealer quietly skims a slice of your crypto
Researchers at Huntress have uncovered a Go-based piece of malware that steals passwords, Apple Keychain data and hijacks cryptocurrency transactions through fake instructions in Terminal — but drains only a portion of the wallet rather than the whole thing.
-
Open VSX Removes 77 “Evil Twin” Extensions That Stole Developer Data
The Open VSX marketplace has purged a cluster of 77 malicious extensions that masqueraded as genuine tools and shipped data about developers' systems and environments to a domain controlled by the attackers.
-
ChainDrop worm infects more than 1,300 npm packages with 2 billion downloads a month
The self-propagating ChainDrop malware has compromised popular npm packages, including the Keyv and Cacheable caching utilities, and steals developer and cloud-service credentials.
-
DOUBLECUP: a ClickFix service that hides malware in the browser's image cache
DOUBLECUP, a new Russian-language loader-as-a-service, conceals malicious code in PNG images cached by the victim's browser and delivers CountLoader and a new DeviceManager trojan.
-
18 Malicious npm Packages Target Alibaba Tooling Developers
Researchers have uncovered a targeted supply-chain attack: masquerading as private Alibaba packages, a cross-platform remote access trojan is being spread to Chinese-speaking developers.
-
Chrome Prepares to Block New-Tab Hijacker Extensions
Google is developing a protection that will stop malicious programs from swapping out Chrome's start page and search engine through enterprise policies. The feature is still in development.
-
Hacked Hotel Wi-Fi Pushes Fake Updates Carrying a Spyware Trojan
Microsoft has detailed an operation dubbed CaptiveCrunch: through hijacked hotel networks, guests are served bogus browser updates that lead to the CornFlake trojan, which can reach the camera, microphone and keyboard.
-
OctLurk and SilkLurk: a new espionage campaign against Central Asia
Kaspersky has documented a wave of attacks on government bodies in Central Asia dating back to January 2025. Behind them stands a presumably Chinese-speaking group armed with two previously unknown backdoors.
-
Arch Linux Disables Adoption of “Orphaned” AUR Packages After Attacks
The Arch Linux DevOps team has temporarily banned the adoption of orphaned packages in the AUR: attackers were seizing them en masse and planting a remote access trojan.
- More