New malware strains, ransomware campaigns, botnet activity
RSS feed for this categoryArmenia has detained a Russian tourist, Aleksandr Ermakov, based on a U.S. extradition request. The U.S. is seeking him as a suspect linked to the REvil ransomware group. However, the detained individual's wife claims the U.S. has arrested the wrong person, presenting a potential misidentification case.
The ACR Stealer malware, active since 2024, is capable of exfiltrating sensitive data including browser passwords, active session tokens, PDFs, and Microsoft 365 files from synced cloud storage. It achieves initial access through user execution of malicious commands, as detailed by Microsoft's Defender Experts team.
Cybersecurity researchers have identified a new malware named GoSerpent, in use since late 2025, specifically targeting government and diplomatic entities in Southeast Asia. The malware, discovered by Kaspersky, is designed for long-term access and intelligence gathering, suggesting a sophisticated espionage campaign.
Threat actors are employing a global phishing campaign that abuses standard TrueType Font (TTF) files to deliver stealthy malware. This campaign uses heavily obfuscated JavaScript and a Lua-based loader disguised as a font file to evade detection and install malware like RATs and infostealers.
Coca-Cola has suspended production at its US Fairlife facilities due to a ransomware attack. The company stated that the incident has not compromised product quality or safety, nor has it impacted Fairlife's operations in Canada.
A new macOS malware named ClickLock has been discovered that terminates visible processes, tricking users into entering their system login password. This information stealer aims to capture the password entered by the unsuspecting user. The malware is distributed through malicious installers disguised as legitimate software.
Coca-Cola's dairy subsidiary, Fairlife, has experienced a ransomware attack that has temporarily halted its production across the United States. The attack has impacted operations, leading to a suspension of Fairlife product manufacturing.
A recent article highlights how over a million emails are employing a technique called 'text salting' to bypass AI-powered security filters. This method involves embedding hidden text within emails, making them appear legitimate to AI and thus increasing the success rate of phishing campaigns.
A new malicious framework named OkoBot has been identified, which deploys over 20 distinct payloads. These payloads are designed to steal sensitive data, including cryptocurrency wallet seed phrases and user credentials.
This article summarizes 15 security-related stories from the past week. It highlights threats such as game cheat spyware, a rapid 24-hour ransomware attack, and the potential for Chrome sync settings to be exploited for stalking. The piece also notes the resurgence of old bugs and the exploitation of weak default configurations.
A new macOS stealer named ClickLock targets users through social engineering tactics, tricking them into running malicious commands in their Terminal. This malware aims to steal sensitive information by exploiting user trust and a lack of security awareness.
A new modular malware named TELEPUZ has been observed spreading since late April 2026, utilizing websites infected with ClickFix lures. This malware is described as full-featured, lightweight, and modular, with capabilities for data theft and command execution.
A new macOS malware named 'ClickLock Stealer' has been identified that targets users by stealing passwords and cryptocurrency. The malware employs social engineering tactics and the ability to kill processes to bypass macOS security measures.
A new macOS infostealer named ClickLock Stealer has been identified that pressures victims into revealing their passwords by repeatedly terminating running applications. The malware is initiated via a command pasted into the Terminal and employs a fake system dialog to request the user's password.
Over 20 Brazilian government websites have been compromised and used as a distribution channel for malware by the PhantomEnigma threat group. The campaign, uncovered by ANY.RUN, also revealed new backdoor functionalities and hidden infrastructure details.
The Daxin kernel-mode rootkit, linked to a China-affiliated threat actor, has reappeared after more than four years, infecting a manufacturing firm in Taiwan. Alongside Daxin, a new, previously unknown backdoor named Stupig has also been discovered.
A financially motivated Russian threat actor known as UAT-11795 is distributing a new backdoor malware called Starland RAT by trojanizing legitimate WebEx and Zoom applications. This malware is designed to steal user credentials and cryptocurrency from infected systems.
A new ransomware variant named Spirals has been observed rapidly encrypting victim networks within a 24-hour timeframe, encompassing initial access, data exfiltration, and final encryption. This rapid attack cycle highlights the increasing efficiency of ransomware operations.
Ransomware operators are reportedly leveraging artificial intelligence to enhance their negotiation tactics. This development allows them to craft more persuasive and personalized demands, potentially increasing their success rate in extorting victims.
Spanish police have dismantled a significant cyber fraud ring that generated an estimated €140 million through various online attacks. The group's activities included phishing, malware distribution, and other forms of cybercrime, with proceeds being laundered through sophisticated financial schemes.
A cyberattack has significantly disrupted operations at KFC Japan, impacting its online ordering system and potentially leading to store closures. The attack targeted a logistics partner, causing its systems to go offline and halting the delivery of crucial supplies.
A critical OS command injection vulnerability (CVE-2026-25089) has been identified in Fortinet FortiSandbox products. An unauthenticated attacker can exploit this flaw via crafted HTTP requests to execute unauthorized commands. Organizations are urged to apply vendor-provided mitigations and adhere to CISA's risk-based patching guidance.
Dutch police have arrested suspects in a large-scale investment fraud ring that allegedly defrauded tens of thousands of victims out of over €100 million. The criminal group operated internationally, using fake investment platforms and social media to lure victims. Authorities seized assets and are continuing investigations into the full extent of the operation.
Two significant supply chain compromises have affected the npm ecosystem, impacting multiple packages from AsyncAPI and Jscrambler Code Integrity. Attackers gained access through compromised development credentials and exploited a known vulnerability in GitHub Actions CI/CD workflows to inject malware into open-source packages. Affected organizations are advised to rebuild systems from clean images and rotate all credentials.
Email-based attacks have surpassed exploit kits as the primary entry point for ransomware. Despite widespread adoption of multifactor authentication (MFA), it was ineffective in 97% of credential-based attacks, failing to prevent compromise.
Microsoft has released a record number of patches for its operating systems and other products, addressing 76 vulnerabilities. Concurrently, a zero-day exploit dubbed HiveLegacy has surfaced, which researchers describe as a powerful primitive with the potential for further malicious activities.
TuxBot v3 Evolution is a new IoT botnet framework that researchers believe was developed with the help of a large language model (LLM). While the AI generated code for the botnet, it included a disclaimer, indicating the developer did not fully implement the AI's suggestions.
A Russian-speaking threat actor, "bandcampro," has been observed using Google's open-source Gemini Command Line Interface (CLI) as a hacking agent. This actor leveraged the AI tool to establish a small-scale botnet, demonstrating a novel abuse of generative AI capabilities for malicious purposes.
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) as part of a supply-chain attack. These packages contained a remote access trojan designed to steal credentials and other sensitive information from infected systems.
The OkoBot malware framework, active since April 2025 on Windows, includes a module specifically designed to phish users for their hardware wallet recovery phrases. This module injects fake recovery phrase prompts into legitimate desktop applications for Ledger and Trezor wallets on infected machines.
This article provides a cheatsheet for KAPE (Kroll Artifact Parser and Extractor), a tool used for efficiently locating, extracting, and parsing Windows forensic artifacts. These artifacts can be crucial for identifying adversary activity within the operating system.
Mozilla has released updates for Firefox to fix two critical security vulnerabilities. The company has warned that exploit code for these flaws is publicly available. One vulnerability affects the WebAssembly component, while the other impacts the DOM navigation.
Researchers at Bitdefender have discovered a new attack technique on Windows systems that leverages bind links. These links create conflicting filesystem views, allowing malware to evade detection by Endpoint Detection and Response (EDR) tools.
Four npm packages within the @asyncapi namespace have been found to be compromised and are distributing a multi-stage botnet loader. This malicious activity was identified by researchers from OX Security, SafeDep, Socket, and StepSecurity.
U.S. federal prosecutors have charged three Russian nationals for allegedly operating a bulletproof hosting service that supported ransomware gangs. This service is believed to have facilitated criminal activities resulting in over $62 million in damages to victims globally.
A recent report indicates that while organizations are paying less in ransomware demands, the use of encryption by attackers is on the rise. This trend suggests a shift in attacker tactics, potentially focusing on data exfiltration and disruption over direct financial gain from ransoms.
A threat actor has created nearly 300 GitHub repositories designed to impersonate legitimate software and security projects. These fake repositories are being used to distribute infostealer malware to unsuspecting users.
Researchers have identified a new Rust-based remote access trojan (RAT) called LabubaRAT that disguises itself as NVIDIA software. This RAT aims to establish a persistent foothold on Windows hosts, allowing attackers to profile the system and potentially control it.
ClickFix, a newly emerged attack vector, is being offered for rent and can bypass standard antivirus and EDR solutions. The most effective detection method currently identified is YARA analysis, indicating a growing need for updated defense strategies against this evolving threat.
LastPass is alerting its users to a phishing campaign that employs deceptive security alerts to lure victims to fake websites. These fraudulent notices are designed to trick users into divulging sensitive information. The campaign appears to be targeting users of both LastPass and Bitwarden password managers.
Two new phishing kits, named Jalisco and OmegaLord, are actively targeting Microsoft 365 accounts. These kits employ advanced techniques designed to bypass multi-factor authentication (MFA), posing a significant threat to user credentials and sensitive data.
A Russian fraudster reportedly used a jailbroken version of Google's Gemini AI to rapidly set up a command-and-control (C2) server for fraudulent activities. The AI was credited with performing 90% of the work, with human intervention accounting for only 10%, in just six minutes.
A new phishing-as-a-service platform called Forg365, distributed via Telegram, is making Microsoft 365 account takeovers more accessible to less-skilled attackers. The platform utilizes AI for lure creation, device-code abuse, and adversary-in-the-middle techniques to bypass authentication controls and maintain access.
A threat actor successfully poisoned several Jscrambler NPM packages, leading to the distribution of a cross-platform credential stealer. This supply chain attack targeted widely used JavaScript packages, compromising users who updated to affected versions.
A campaign involving 148 npm packages, presented as student web proxies, was discovered to have turned visitors' browsers into a distributed denial-of-service (DDoS) botnet for approximately two weeks in May. The malicious packages utilized the npm registry as free hosting for a booby-trapped proxy site, targeting students attempting to circumvent internet restrictions.
A malicious version of the Jscrambler npm package was published by a threat actor, containing infostealer malware. This compromised package has been downloaded nearly 1,500 times.
A new macOS information-stealing malware named CrashStealer has been discovered. It disguises itself as Apple's legitimate crash-reporting tool to trick users into installing it, subsequently stealing sensitive data such as credentials, keychain information, and cryptocurrency wallet details.
Cybersecurity researchers have identified a new macOS information stealer named CrashStealer, which is written in native C++. This malware utilizes a notarized dropper to bypass Apple's Gatekeeper security checks, allowing it to harvest sensitive data from infected systems.
Google and Microsoft have removed the ModHeader browser extension, used by approximately 1.6 million users, due to the discovery of a hidden browsing history collector. Although this collector was dormant and there's no evidence of data exfiltration, its presence prompted the removal by the tech giants.
A new modular implant called GigaWiper has been identified, which combines backdoor and wiper functionalities. This allows threat actors to customize their destructive attacks for maximum impact with minimal operational effort.
