#malware
-
North Korean Hackers Target macOS Through Fake Updates and Search Ads
A DPRK-linked group has added a new trick to its Contagious Interview campaign: a full-screen fake macOS update prompts the victim to run a malicious command in the terminal themselves.
-
Flying Eagle Android trojan source spreads across Telegram, traces found on 170 servers
Researchers at Hunt.io and NetAskari have found traces of the Flying Eagle remote-access framework on 170 servers — against the backdrop of its source code leaking into criminal Telegram channels.
-
Two @joyfill npm packages compromised: RAT fires the moment you import them
Malicious code has been found in the beta releases of the npm packages @joyfill/layouts and @joyfill/components; it pulls down a remote access trojan through blockchain transactions. According to Socket, North Korean hackers are behind the attack.
-
Malware Built Right in the Browser: How the SourTrade Campaign Works
Researchers at Confiant have described a large-scale advertising campaign in which malicious JavaScript makes the victim's browser “assemble” the malware from separate components on its own, right in memory.
-
Dolphin X Trojan Uses AI to Rank Victims by Value
A new infostealer with an “AI Profiler” feature automatically scores infected machines, helping attackers pick the most lucrative targets. The feature was spotted by researchers at Varonis Threat Labs.
-
JadeProx: Chinese Group Targets Government Bodies and Hospitals with New TriBack Loader
An open server on Alibaba Cloud exposed an operation that Group-IB tracks as JadeProx: attacks on government, healthcare and educational institutions across Asia and Latin America using a previously unknown Windows loader, TriBack.
-
msaRAT: the backdoor that hides its C2 traffic inside Chrome and Edge
The Chaos group is deploying a new Rust-based backdoor that routes command-and-control traffic through the system's own browser, leaving almost no trace on the network.
-
A Test Assignment with a Surprise: How a Recruiter Sent a Developer Malware in Git Hooks
An Indian developer received a tempting job offer paying $10–15K a month — and along with it, a test project laced with hidden malware. A breakdown of the attack revealed an entire multi-stage operation.
-
Trojanized Newtonsoft.Json Fork Rigs Online Game Results
JFrog researchers found a typosquatting package on NuGet that behaves like the real library for everyone — except a single victim, whose betting rounds it quietly rigs.
-
FakeGit: 7,600 Fake GitHub Repositories Are Now Baiting AI Agents Too
The FakeGit campaign distributes the SmartLoader downloader through bogus repositories masquerading as AI skills and MCP servers. A new technique called AgentBaiting deceives not people, but the AI agents themselves.
-
Lone Hacker Handed Gemini CLI the Reins of an Eight-PC Dental Clinic Botnet
A Russian-speaking attacker going by the handle bandcampro turned Google's open-source AI agent into his engineering team: it wrote code, fixed infrastructure, and commanded the bots on plain-language orders.
-
SleeperGem: Three Malicious RubyGems Packages Target Developer Machines
Researchers have detailed a supply-chain attack on Ruby: the attackers hijack long-abandoned RubyGems accounts and use updates to deliver a loader that installs a stealthy daemon on developers' computers.