PoeLLM Malware Targets AI Servers PoeLLM malware has infected more than 3,400 servers through a campaign targeting exposed AI and language model systems. Researchers discovered that the attackers use these systems to mine cryptocurrency and grow their botnet. The campaign, called Canto Incognito, has been active since April 2026. It targets internet-facing services that may …
Malicious npm packages have recorded more than 40,000 downloads in a software supply chain attack. The packages deliver data-stealing malware and tools that give attackers remote access. Cybersecurity researchers have linked the campaign to a suspected lone operator. They named the activity MALFEX and identified 12 packages published since August 2023. However, researchers flagged only …
Linux backdoors are targeting telecom and network devices. These threats disguise their activity as trusted email services and normal system processes. As a result, security teams may struggle to spot them during routine checks. The attackers copy names linked to legitimate software to avoid raising suspicion. However, these tricks go beyond simple name changes. Researchers …
More than 100 compromised websites have become tools for spreading information-stealing malware. Cyber responders found malicious JavaScript on these sites in September 2026. The code delivers a threat known as LunexStealer, also called Psychedelic Stealer. However, investigators have not named the victims or confirmed successful infections. They link the campaign to a threat group tracked …
100+ Compromised Websites Spread Malware via Fake Checks Read More »
WordPress malware comes back after removal can turn cleanup into a cycle of reinfection. A hidden backdoor called SC can restore deleted malware within seconds. Therefore, removing visible files alone may not solve the problem. The malware spreads across website files, databases, and server memory. As a result, surviving parts can rebuild missing components. How …
A government department lost more than $800,000 in a cyber attack in July 2025 at Queensland. The department plays a major role in improving cybersecurity across the state government. However, officials said the incident did not expose government data or sensitive information. The department recorded the loss in its latest annual report. Therefore, the incident …
Reports say the group shared screenshots that it claims came from compromised FBI systems. The material allegedly includes information linked to current and former personnel. Some records reportedly concern employees in the United States and other locations. However, investigators have not confirmed that the information came from FBI servers. Therefore, readers should treat the material …
ShinyHunters Cybercrime Group Claims FBI Data Breach Read More »
Warlock ransomware is exploiting SharePoint flaws to target vital services. The campaign has hit water, telecom, government, and education groups. Moreover, recent attacks reached Europe, Africa, and Latin America. Researchers link the activity to a China-nexus threat actor. However, different security reports use different names for the group. At least four organizations faced attacks during …
Chinese hackers are exploiting a Chrome-Windows zero-day chain through fake websites. The attacks target victims with carefully designed phishing pages. Researchers detected the activity on September 3 and 4, 2026. However, the campaign may have started before those dates. Attackers used three security flaws to escape browser protections and run malicious code. Therefore, the campaign …
Chinese Hackers Exploit Chrome Through Fake Website Read More »
Corp MDM Spyware now targets logistics firms through fake app download pages. The campaign delivers an Android spyware tool disguised as a system service. Researchers say the malware can steal new SMS messages and redirect phone calls. However, its functions remain narrower than many commercial spyware tools. The campaign also appears linked to wider attacks …
New RemControl Android banking malware targets users through fake app pages and phishing screens. The campaign uses Android malware to steal sensitive financial data. Researchers found the malware in campaigns that impersonate a popular IPTV application. The infrastructure has operated since at least May, according to researchers. However, analysts first found samples in July with …
New RemControl Android Banking Malware Hits Users Read More »
Malicious AI agents are targeting online stores at scale. The attackers use open-source AI tools to automate cyberattacks. Researchers say they stole more than 600,000 valid card records. Meanwhile, the campaign stayed active through September 22. The attacks started at least in July. In one five-day span, the attackers hit at least 27 firms. They …
Claude AI abuse helped hackers scan 1.8 million Android apps for hidden secrets. Researchers say several threat groups also used AI to support cyberattacks. The activity occurred between December 2025 and August 2026. During that period, researchers tracked misuse involving cybercrime, espionage, scams, and influence operations. They also observed attempts involving weapons research and AI …
Passkey phishing campaigns are targeting cloud accounts through convincing social engineering attacks. Researchers found attackers using fake support messages to trick employees. The campaign has affected multiple organizations since May 2026. However, attackers use several methods to gain and keep access. They can steal credentials or trick users into approving authentication requests. Therefore, even accounts …
BambooToken malware uses the MQTT protocol to control Windows and Linux systems remotely. Researchers say the campaign has targeted organizations across Asia and South America. The malware may have operated since February 2023. However, researchers only identified the previously unknown threat in early 2026. Recent activity linked to BambooToken appeared as late as July 2026. …
KREMLIN malware targets users with malicious browser extensions that steal credentials and session tokens. Researchers uncovered the operation in attacks active since at least May 2025. The campaign uses fake banking, invoice, and business documents to start infections. However, the malware later focuses on Chromium-based browsers and their stored data. The attackers have used lures …
Fake IT Calls are helping cybercriminals steal business data and extort organizations. Threat hunters have identified a widespread campaign targeting cloud software and business accounts. The attackers mainly target directors, vice presidents, and other senior employees. However, any employee with valuable account access could become a target. Therefore, organizations need to treat unexpected IT calls …
BengalSEO is a large SEO poisoning campaign that spreads malware and tech support scams. Cybersecurity researchers discovered the campaign in March 2026. However, evidence suggests the operation has existed since at least 2015. The attackers use advanced SEO methods to push harmful pages higher in search results. Therefore, users may click dangerous links while searching …
Gigabud banking trojan now uses Android work profiles to hide from banking app security checks. Researchers found this technique on infected devices in Indonesia. However, the malware first installs another app before creating the separate profile. The second app then places a fake banking app inside that protected space. Therefore, the banking app cannot easily …
Gigabud Uses Work Profiles to Hide Banking Malware Read More »
The StreamRat Android Trojan can gain near-complete control of infected devices. Researchers found the malware through a fake television streaming campaign. The campaign targeted Spanish-speaking Android users through social media ads. However, the attackers disguised the malware as a legitimate streaming application. The campaign mainly focused on users in Spain. Researchers estimated that about 570,950 …
Attackers turn trusted Node.js runtime tools into malware delivery systems. Researchers found this technique in several targeted attacks since February 2026. The campaigns affected government groups, technology firms, and hotels. However, the attackers use a legitimate developer tool to avoid attention. Node.js normally runs JavaScript programs on Windows computers. Its main executable carries a valid …
Attackers Turn Trusted Node.js Runtime Into Malware Read More »
BraZetsu malware turns hacked Windows computers into assets for a criminal marketplace. Security researchers recently uncovered the Python-based malware framework. The malware helps criminals find, study, and sell access to infected systems. Therefore, one infection can create opportunities for several later attacks. Researchers say BraZetsu differs from typical information-stealing malware. Instead, it works as a …
Fake Apple Support calls are now targeting people whose phones were stolen. Security researchers have uncovered a phishing-as-a-service platform built to remove Apple’s Activation Lock from stolen devices. The service uses rented AI voice agents that call victims and pretend to be Apple Support. Their goal is simple: get the device passcode. How the Scam …
What Is SLEEPWALKER? SLEEPWALKER is a newly documented Windows backdoor that hides in plain sight. It stays completely inactive until one specially crafted network packet reaches the machine. Only then does it spring into action. Once triggered, the backdoor runs commands written in its own custom instruction language. Therefore, it does not rely on common …
What Is NovaCookies? NovaCookies is a new phishing toolkit built to steal Microsoft 365 accounts. Researchers describe it as a subscription service, priced at roughly $320 per month. Anyone can rent it, even without technical skills. The kit works as a middleman between a victim and Microsoft. Therefore, it can capture passwords and multi-factor codes …
What Is ToxicPanda 2.0? ToxicPanda 2.0 is an updated version of an Android banking trojan that has circulated since mid-2022. Researchers recently uncovered major upgrades to the malware. It now carries 167 remote commands, far more than earlier versions. Therefore, attackers can control infected phones in far more detailed ways. The malware also includes a …
A New Android Threat Emerges A newly discovered malware called Manic is actively targeting Android users across Europe. Researchers first spotted it attacking Ukrainian banks, government services, and messaging apps. However, its reach extends further. It also hits Russian and European financial institutions, fintech platforms, and cryptocurrency services. Manic blends two dangerous categories into one. …
How the Attack Works The campaign abuses a legitimate software update feature. Therefore, attackers can reach compatible head units without relying on a normal app download. Researchers linked the activity to a wider ad fraud and proxy operation. A head unit manages media, navigation, and some vehicle functions. It may come with a new car …
StopAndProtect uses hacked WordPress sites to spread malware and steal data. Researchers found nearly 2,000 compromised sites linked to the campaign. However, the attackers do not rely on one malware program. Instead, they use several tools for theft, surveillance, spreading, and ransomware. The campaign starts with a ClickFix social engineering trick. Visitors see a fake …
StopAndProtect Hits WordPress Sites With Malware Read More »
AmnesiaStealer macOS malware can hijack browser sessions through remote control features. The malware targets macOS users through fake download pages and ClickFix attacks. However, it does more than steal files and passwords. It can copy browser profiles and use existing login sessions. Therefore, attackers may access online accounts without needing the victim’s password again. Security …
Expired domains are becoming a useful tool for scammers and malware operators. Criminals buy these domains after their original owners abandon them. They then use the old traffic, links, and reputation to reach new victims. Therefore, an old web address can become a powerful security threat. Researchers estimate that criminals spend millions of dollars on …
Mercenary spyware has triggered fresh warnings for users across 110 countries. Researchers say these attacks target a small number of specific people. However, the attacks can use highly advanced tools and expensive techniques. The latest alerts add to notifications sent across more than 150 countries since 2021. Therefore, affected users should treat these warnings as …
AI mind viruses can spread between agents through persistent prompt files. Security researchers demonstrated the technique in controlled experiments. The payload can survive between sessions and reach another AI agent. However, researchers found no evidence of successful spread in real-world systems. Therefore, the threat remains limited but deserves attention. The researchers tested the technique in …
A group called Ransom Busters claims it hacked ransomware servers. It now contacts victims and offers to remove stolen data. However, the group asks for $20,000 to $60,000 in return. It also claims that it can restore access to stolen files and data. Therefore, security experts warn victims not to trust the offer. The group …
Cybersecurity researchers have uncovered AmnesiaStealer, a new malware targeting macOS users. The Rust-based stealer focuses on browser data, passwords, and active sessions. However, it can also give attackers live control of Chromium browsers. Therefore, the malware poses a serious privacy and account security risk. The attack starts with a fake software download page. Moreover, the …
Researchers have uncovered 737 Chrome VPN Extensions linked to hidden proxy services. Most extensions target users seeking access to blocked online services. However, the tools can route browser traffic through servers controlled by one provider. Therefore, users may expose their browsing activity without knowing it. The extensions appeared across at least 40 developer accounts. Together, …
Cybersecurity researchers have uncovered WindRelay Android Malware used in contactless payment fraud. The malware turns infected phones into live NFC relays. Therefore, criminals can capture payment card data in real time. The campaign also uses a remote access trojan to control infected devices. As a result, victims may lose control of their phones and payment …
Cybersecurity researchers have discovered a new malware campaign using HollowFrame Loader. However, the attackers also deploy a backdoor called Matryoshka. The campaign begins with carefully crafted spear-phishing emails. Therefore, victims unknowingly install malware after opening a fake file. The attack focuses on gaining long-term access to targeted systems. Researchers found that the campaign targeted a …
Cybersecurity researchers have found major updates to the Greatness phishing platform. However, the toolkit now supports device code phishing attacks. This technique bypasses multi-factor authentication with legitimate login processes. Therefore, attackers can steal authentication tokens instead of only passwords. The upgrade makes phishing campaigns more dangerous than before. Researchers also found support for adversary-in-the-middle attacks. …
Security researchers have discovered 84 security flaws in 4G and 5G core networks. However, these weaknesses could expose mobile networks to serious cyberattacks. Attackers may launch denial-of-service attacks or hijack user sessions. Therefore, both network operators and users face increased security risks. The findings highlight weaknesses in modern mobile network infrastructure. The researchers examined several …
Cybersecurity researchers have uncovered a new campaign targeting iPhone users. However, the attackers use a leaked exploit kit called DarkSword. The campaign installs GHOSTBLADE malware on vulnerable devices. Therefore, attackers can steal sensitive information from infected iPhones. The activity highlights the growing misuse of leaked cyberattack tools. Researchers found more than 100 malicious websites linked …
Chinese Threat Actor Targets iPhones With DarkSword Read More »
Cybersecurity researchers have discovered a new malware campaign called DOUBLECUP. However, this loader-as-a-service platform uses ClickFix tricks to infect victims. The attack hides malicious code inside PNG image files. Therefore, users may not notice the infection at first. The campaign eventually installs advanced malware on targeted devices. Researchers found that the attackers hide the first …
DOUBLECUP Uses ClickFix to Spread Hidden Malware Read More »
Cybersecurity researchers have uncovered a new phishing campaign. The attack uses fake Adobe and Zoom updates. However, the campaign also uses fake document reviews and system maintenance tools. These tricks convince users to install remote access software. As a result, attackers gain long-term access to infected devices. The researchers named the campaign SMOKE#SCREEN. Moreover, the …
Fake Adobe and Zoom Updates Spread Remote Access Malware Read More »
Malvertising Sends Malware Using Browser Assembly Cybersecurity researchers have uncovered a new Malvertising Sends Malware campaign targeting cryptocurrency investors and retail traders. Instead of downloading a complete malware file, victims unknowingly let their browsers assemble it. As a result, the attack becomes harder to detect. Furthermore, attackers use trusted software components to hide malicious activity. …
Malvertising Sends Malware Through Browser Tricks Read More »
A new Golden Chickens campaign has introduced four new malware families for cybercriminal operations. Researchers found that the malware platform continues to evolve despite previous public exposure. The new tools improve stealth, flexibility, and attack capabilities. Therefore, organizations face an increasing risk from modular malware. The attackers also continue using social engineering to infect victims. …
Cybersecurity researchers have uncovered new details about DevMan RaaS, a ransomware platform built for affiliates. The operation provides a dedicated web portal for managing ransomware campaigns. Moreover, the platform helps affiliates create malware, monitor victims, and track payments. Researchers believe this setup makes cybercrime more efficient. As a result, attackers can organize operations from one …
A new ENCFORGE ransomware campaign is targeting AI model files through vulnerable Langflow servers. Researchers linked this attack to the same threat actor behind an earlier campaign. The attackers exploit exposed Langflow instances to gain remote access. Therefore, AI environments face an increasing ransomware risk. The campaign focuses on encrypting valuable AI assets instead of …
A new FakeGit Campaign is spreading SmartLoader malware through fake GitHub repositories. Researchers discovered nearly 7,600 malicious repositories during the investigation. Many of these repositories imitate AI skills and Model Context Protocol servers. Therefore, developers and organizations face a growing cybersecurity threat. The attackers use trusted platforms to distribute malware and steal sensitive information. Fake …
A new NadMesh Botnet campaign is targeting exposed AI services to steal cloud credentials and Kubernetes tokens. Researchers first detected the malware in early July. The botnet scans internet-facing AI platforms for weak security settings. Therefore, organizations running exposed services face a growing cybersecurity risk. The attackers focus on valuable cloud access instead of the …
A new OtterCookie malware campaign targets software developers through fake job offers and coding tests. Attackers hide malicious code inside SVG image files. As a result, victims unknowingly install malware while completing technical assignments. The malware steals sensitive information and cryptocurrency wallet data. Therefore, developers face a growing cybersecurity risk. Fake Job Offers Deliver the …
A new GoSerpent malware campaign targets government and diplomatic organizations across Southeast Asia. Attackers use the malware to maintain long-term access to compromised systems. As a result, they collect sensitive files and valuable credentials over several months. They also deploy additional tools to expand their operations. Therefore, the campaign presents a serious cyber espionage threat. …
A new TELEPUZ malware campaign targets Windows users through ClickFix attacks. The malware tricks users into running malicious commands themselves. As a result, attackers gain access to sensitive data and system controls. They also install additional malware during the infection. Therefore, the campaign creates a serious cybersecurity threat. ClickFix Starts the Infection Researchers found that …
A new student proxy botnet campaign abused fake npm packages to launch hidden cyberattacks. The packages appeared to offer web proxy services for students. However, they secretly turned visitors’ browsers into attack tools. As a result, users joined a distributed denial-of-service attack without knowing it. Therefore, the campaign exposed both students and organizations to serious …
Student Proxy Botnet Turns Browsers Into Attackers Read More »
A new Microsoft Entra passkey scam targets Microsoft 365 users through phone-based social engineering. Attackers pretend to offer security assistance during the call. As a result, victims believe they must register a new passkey. They unknowingly approve attacker access to their accounts. Therefore, organizations face a higher risk of data theft and extortion. How the …
A new GigaWiper Windows backdoor gives attackers several ways to damage infected computers. It combines disk wiping, fake ransomware, and spyware in one tool. As a result, attackers can steal information before destroying important data. They also control infected systems from a distance. Therefore, this malware creates a serious cybersecurity threat. How the Malware Works …
GigaWiper Windows Backdoor Hides Destructive Tools Read More »
A new GodDamn ransomware campaign is targeting organizations with advanced attack methods. The malware uses a malicious driver to disable security software. As a result, attackers can avoid detection before encrypting files. They also move across networks more easily. Therefore, the threat poses a serious risk to many businesses. How the Attack Begins Researchers found …
A new cyberattack called HalluSquatting attack targets AI coding assistants. It exploits how these tools invent missing project names. As a result, attackers can register fake repositories first. They then wait for AI assistants to download the wrong resource. Therefore, users may unknowingly install malicious software. How the HalluSquatting Attack Works The attack starts when …
A new cyberattack campaign is targeting banking users in Mexico. The attackers focus on bank customers, payment services, digital finance platforms, and cryptocurrency users. They use fake verification pages to trick people into installing malware. As a result, victims unknowingly give attackers access to their devices. The malware is known as SCMBANKER malware. Fake Verification …
Researchers Discover a New macOS Threat PamStealer is a new information-stealing malware targeting macOS users. Researchers found that attackers disguise the malware as a trusted clipboard application. Moreover, they distribute it through fake websites that closely resemble the real software page. Therefore, users may install the malware without realizing the danger. The malware focuses on …
Researchers Discover an Ongoing Campaign North Korean Hackers are running a large campaign that targets software developers. Researchers found more than 100 malicious packages and browser extensions. Moreover, the attackers distributed them across several popular software repositories. Therefore, developers face a growing supply chain security risk. Researchers believe the campaign remains active today. However, attackers …
Researchers Uncover a Growing Cyber Threat Armored Likho is a threat group targeting government organizations and the power sector. Researchers observed attacks in several countries, including Russia, Brazil, and Kazakhstan. Moreover, the group combines financial crime with cyber espionage. Therefore, its campaigns create risks for both public institutions and critical infrastructure. Researchers explained that the …
Researchers Identify a New Malware Campaign VEIL#DROP Malware is a new attack that spreads the PureLogs Stealer. Researchers recently uncovered this multi-stage malware campaign. Moreover, attackers rely on social engineering to trick users. Therefore, the attack can infect systems without raising suspicion. The infection usually starts through phishing emails or compromised websites. However, both methods …
Researchers Discover a New Banking Attack Ousaban Banking Trojan is targeting online banking users in Spain and Portugal. Researchers recently discovered the campaign targeting Windows devices. Moreover, attackers use fake PDF files to deliver the malware. Therefore, banking customers in these countries face a higher security risk. The malware focuses on stealing online banking credentials. …
Researchers Uncover a New Malware Campaign New ChocoPoC RAT is targeting vulnerability researchers through fake proof-of-concept repositories. Attackers disguise the malware inside exploit code for newly disclosed security flaws. As a result, researchers may infect their own systems while testing vulnerabilities. Therefore, this campaign creates serious risks for cybersecurity professionals. Researchers found that the malware …
Researchers Discover a New AI Security Threat Phantom Squatting is a growing cyber threat that targets AI-generated web addresses. Researchers found that attackers register fake domains created by AI models. Moreover, these domains often look trustworthy to users and developers. As a result, attackers can launch phishing campaigns and malware attacks. Therefore, organizations should understand …
Phantom Squatting Threats Targets AI Fake Domains Read More »
Researchers Reveal a New AI Security Risk Microsoft Warns AI Agents Can Leak Data through a new attack method. Researchers discovered that attackers can abuse poisoned tool descriptions. Moreover, the attack can trick AI agents into sharing sensitive company information. The agent follows its normal instructions during the process. Therefore, the attack can remain unnoticed …
Researchers Discover a New Browser-Based Attack AI-Generated Browser Ransomware has introduced a new security concern for browser users. Researchers recently found malware that works entirely inside a web browser. Moreover, the attack uses existing browser features instead of traditional malware methods. This approach allows attackers to avoid installing separate software. Therefore, security experts believe this …
RustDuck Botnet is targeting routers, servers, IP cameras, and Android TV boxes to launch large-scale DDoS attacks. Researchers discovered the malware in early 2026 and found that it continues to evolve rapidly. However, the biggest concern is not its current size but its advanced development. Therefore, security experts urge organizations to strengthen their defenses before …
RustDuck Botnet Rebuilds in Rust for Bigger DDoS Attacks Read More »
AirDrop and Quick Share flaws could allow nearby attackers to crash wireless file-sharing services without permission. Researchers found six security issues that affect popular file-sharing features on millions of devices. However, the attacks only work when the attacker is within wireless range. Therefore, users should install the latest updates and avoid unnecessary file-sharing visibility. Researchers …
AirDrop and Quick Share Flaws Expose Nearby Devices Read More »
BioShocking Exposes a New AI Security Risk AI Browsers can leak user credentials through a newly discovered attack called BioShocking. Researchers recently demonstrated this technique against several AI-powered browsers and assistants. The attack convinced AI agents to reveal private login information. Therefore, the findings raise serious concerns about AI browser security. Unlike traditional browsers, AI …
ClickFix Campaigns Continue to Evolve Cybersecurity researchers have identified several new ClickFix campaigns. These attacks deliver different malware loaders to victim devices. According to multiple researcher reports, the campaigns use advanced delivery methods. Therefore, they pose a growing threat to organizations and individual users. The attacks mainly target Windows systems through social engineering techniques. ClickFix …
ClickFix Campaigns Use New Tricks to Spread Malware Read More »
New Rokarolla Android Malware Targets Mobile Users Security researchers have identified a new Android banking threat called Rokarolla. The malware targets banking and cryptocurrency applications. According to a researcher report, it can attack more than 200 financial apps. Therefore, Android users face a serious security risk. The malware also includes many remote control features that …
New Rokarolla Android Malware Drains Bank Accounts Read More »
Cybersecurity researchers have uncovered a large malware campaign targeting software developers. The campaign uses fake AI coding tools to steal valuable AI service keys. These plugins appear helpful at first glance. However, they secretly send user credentials to attacker-controlled servers. As a result, developers may lose access to paid AI services and face unexpected costs. …
Cybercriminals Use Fake Security Warnings Fake Microsoft Alerts are being used in a new cyberattack campaign. Researchers recently discovered that a state-backed hacking group used these messages to spread malware. The emails looked like legitimate account security notifications. Therefore, many users could mistake them for genuine alerts. The campaign relied on fear and urgency to …
Chinese Hackers Used Hidden Mail Rules to Steal Data A cyber espionage group linked to China secretly targeted research, medical, and defense organizations. The attackers stayed hidden for more than a year. As a result, they collected sensitive emails and research information. According to a recent report, the campaign affected several organizations across North America. …
Introduction A newly discovered Microsoft 365 Copilot Flaw could have allowed attackers to steal sensitive information with a single click. Researchers recently uncovered a chain of security weaknesses that created a powerful data theft path. The attack required no password and no additional user interaction. Instead, a victim only needed to click a trusted link. …
Microsoft 365 Copilot Flaw Exposed Sensitive Data Read More »
Introduction A newly discovered cybersecurity threat called Agentjacking Attack can trick AI coding tools into running malicious code. Researchers recently revealed this technique after testing it against popular AI development assistants. The attack targets AI agents that developers trust every day. However, it does not require phishing emails or server breaches. Instead, attackers abuse trusted …
Agentjacking Attack Tricks AI Tools Into Running Malware Read More »
A cyber espionage group linked to China secretly targeted research and defense organizations for more than a year. The attackers focused on medical, academic, and military institutions across North America. According to a recent report, they stole sensitive emails and research data. However, they used a less common method to avoid detection. The attackers did …
Chrome Wallpaper Extensions Raise Security Concerns Chrome Wallpaper Extensions are under scrutiny after researchers uncovered a large network of suspicious browser add-ons. These extensions appeared as attractive live wallpaper tools for new browser tabs. However, researchers found that many of them carried hidden adware-related functions. The operation involved 152 browser extensions spread across dozens of …
Chrome Wallpaper Extensions Linked to Hidden Adware Read More »
China-Linked Hackers Stay Hidden for Years China-Linked Hackers managed to stay hidden inside Linux systems for nearly a decade. Researchers recently uncovered a long-running operation that targeted critical login software. Instead of using obvious malware, the attackers altered trusted system components. Therefore, their activity blended into normal system operations. As a result, defenders struggled to …
China-Linked Hackers Hidden in Linux Login Systems for Years Read More »
Trusted Scripts Turn Into a Serious Threat A recent security incident has put many website owners at risk. Researchers discovered that attackers tampered with trusted JavaScript files used by a popular WordPress plugin ecosystem. As a result, the modified files secretly created backdoors on affected websites. The attack targeted websites using three widely installed plugins. …
Popular WordPress Plugin Backdoor Attack Exposed Read More »
AI Agent Faces New Security Risks AI Agent has become the focus of new security research. Two separate research teams recently uncovered serious weaknesses. As a result, attackers may trick the agent into running commands or exposing sensitive data. Researchers demonstrated different attack methods. However, both attacks reached the same goal. Attackers gained influence over …
Microsoft 365 Android Apps Hit by Security Flaw Microsoft 365 Android Apps recently faced a serious security issue. Researchers discovered a development flag that remained active in production versions. As a result, the flaw weakened account protection on several Android apps. The issue allowed untrusted apps to request account tokens. Therefore, attackers could gain access …
Google DoubleClick Abused in New Malware Campaign Google DoubleClick Abused is the key phrase security researchers used to describe a new phishing campaign. Researchers recently uncovered an attack that uses a trusted advertising domain to bypass security checks. As a result, attackers can make malicious links appear more legitimate. This method helps cybercriminals avoid early …
FROST Attack Creates New Privacy Risks FROST Attack is a new technique that threatens user privacy. Researchers recently revealed how it works through web browsers. Unlike older attacks, it requires only JavaScript. Therefore, attackers do not need special software or permissions. A user simply opens a malicious website. The page then remains active in the …
Fake Sites Mimicking Open-Source Tools Rise on Search Results Fake Sites Mimicking Open-Source Tools have become a growing cybersecurity threat. Researchers recently uncovered a large campaign targeting software users. These websites imitate trusted open-source projects. Therefore, many visitors believe the sites are legitimate. The fake portals closely resemble real project websites. In some cases, they …
Fake Sites Mimicking Open-Source Tools Trick Users Read More »
FlutterShell Backdoor Emerges in New Campaign FlutterShell Backdoor is the latest threat targeting macOS users. Researchers recently uncovered a large malvertising campaign spreading this malware. The operation uses fake advertisements to lure victims. Therefore, users may unknowingly install infected applications. Researchers believe this campaign evolved from an earlier malware operation. The threat group behind both …
JDY Botnet Grows Into a Larger Threat JDY Botnet has expanded significantly in recent years. Researchers recently warned about its growing size and activity. The network now includes more than 1,500 compromised devices. Therefore, it has become a powerful reconnaissance tool. Researchers describe JDY Botnet as a covert scanning network. It mainly consists of small …
Chinese Hackers Target European Organizations Chinese hackers have expanded their cyberattack campaigns into Europe. Researchers observed a sharp increase in activity during recent months. The group focuses on financial gain through cybercrime operations. However, some of its tools also support surveillance activities. Therefore, security experts continue monitoring the threat closely. The attackers previously focused on …
Google DoubleClick Used in New Malware Campaign Google DoubleClick has been abused in a new phishing campaign. Researchers discovered that attackers use the platform to hide malicious activity. The campaign ultimately delivers a remote access trojan called DesckVB RAT. Therefore, attackers can avoid early detection mechanisms. As a result, victims face a greater risk of …
HTTP/2 Bomb Creates a New DoS Threat HTTP/2 Bomb is a newly identified denial-of-service attack. Researchers found that it can crash web servers quickly. The attack requires only a single machine to operate. Therefore, threat actors do not need large botnets. As a result, the barrier to launching disruptive attacks becomes much lower. Researchers discovered …
Malicious Sicoob NuGet Targets Developers Malicious Sicoob NuGet packages have emerged as a serious threat. Researchers recently uncovered a package that steals sensitive banking data. The package pretends to be a legitimate software development toolkit. However, it secretly collects authentication information from developers. Therefore, organizations using the package face significant security risks. The malicious package …
AI Chatbot Recommendations Fuel New Threats AI chatbot recommendations are helping attackers spread malware. Researchers recently uncovered a cryptojacking campaign using this method. Instead of relying only on search engines, attackers now exploit AI-generated responses. Therefore, malicious websites gain greater visibility. As a result, more users may unknowingly download harmful software. Researchers observed users asking …
Grandoreiro Malware Expands Across Regions Grandoreiro malware continues to target users across Europe and Latin America. Researchers recently identified new campaigns affecting multiple countries. The attacks focus on both businesses and financial institutions. In addition, cybercriminals target users who rely on online banking services. Therefore, the threat remains a major concern. Researchers observed attacks in …
Malicious npm Package Targets AI User Data A malicious npm package has been discovered on a popular software repository. Researchers found that the package contains information-stealing capabilities. The threat specifically targets files linked to an AI development environment. As a result, users may unknowingly expose sensitive information. Therefore, the discovery raises concerns about software supply …
GlassWorm Malware Campaign Targets Developers GlassWorm malware has disrupted software developers since early 2025. The campaign targeted people with access to critical development systems. These systems included source code repositories and cloud platforms. In addition, attackers focused on package registries and CI/CD pipelines. Therefore, a single breach could affect many organizations. Researchers reported that developers …
GlassWorm Malware Takedown Stops Supply Chain Threats Read More »
MuddyWater DLL Side-Loading Attacks Hit 9 Nations A cyber espionage campaign linked to MuddyWater has affected organizations in nine countries. The attacks occurred during the first quarter of 2026. Several industries became targets during the operation. These included manufacturing, education, finance, and public services. Moreover, the campaign reached victims across four continents. Researchers observed attacks …
MuddyWater DLL Side-Loading Attacks Hit 9 Nations Read More »
Trapdoor Ad Fraud Scheme Spreads Through Fake Apps A new Trapdoor ad fraud scheme targets Android users through fake utility apps and hidden advertising attacks. Researchers found 455 harmful apps connected to the operation. In addition, the campaign used 183 malicious control domains to support multi-stage fraud activities. Users often downloaded simple tools, such as …
Malicious npm Packages Target Developers Cybersecurity researchers recently discovered four malicious npm packages that spread dangerous malware to developers. The infected packages appeared harmless at first. However, they secretly delivered information-stealing tools and botnet malware after installation. Researchers found that one package copied code from a previously leaked malware project. Therefore, attackers quickly reused public …
Malicious npm Packages Spread Data-Stealing Malware Read More »
New Malware Targets SMS Codes A dangerous malware campaign now targets Microsoft Phone Link users. Attackers use the tool to steal SMS codes and login data. Researchers found a new version of the CloudZ remote access tool. However, this version includes a new plugin called Pheno that targets Microsoft Phone Link connections. Microsoft Phone Link …
Copyright © 2026 PT PROTERGO SIBER SEKURITI