https://infosecradar.com/feeds/malware.xml Malware & Ransomware stories from InfoSecRadar http://www.rssboard.org/rss-specification InfoSecRadar en Fri, 17 Jul 2026 14:10:19 +0000 https://infosecradar.com/stories/2026/07/13/gigawiper-lets-threat-actors-choose-their-own-destructive-attack/ A new modular implant called GigaWiper has been identified, which combines backdoor and wiper functionalities. This allows threat actors to customize their destructive attacks for maximum impact with minimal operational effort. https://www.darkreading.com/cyberattacks-data-breaches/gigawiper-threat-actors-choose-their-own-destructive-attack Mon, 13 Jul 2026 16:50:54 +0000 Dark Reading https://infosecradar.com/stories/2026/07/13/google-and-microsoft-pull-modheader-with-16-million-installs-after-dormant-colle/ Google and Microsoft have removed the ModHeader browser extension, used by approximately 1.6 million users, due to the discovery of a hidden browsing history collector. Although this collector was dormant and there's no evidence of data exfiltration, its presence prompted the removal by the tech giants. https://thehackernews.com/2026/07/google-and-microsoft-pull-modheader.html Mon, 13 Jul 2026 17:17:24 +0000 The Hacker News https://infosecradar.com/stories/2026/07/13/crashstealer-macos-malware-uses-notarized-dropper-to-pass-gatekeeper-checks/ Cybersecurity researchers have identified a new macOS information stealer named CrashStealer, which is written in native C++. This malware utilizes a notarized dropper to bypass Apple's Gatekeeper security checks, allowing it to harvest sensitive data from infected systems. https://thehackernews.com/2026/07/crashstealer-macos-malware-uses.html Mon, 13 Jul 2026 17:36:12 +0000 The Hacker News https://infosecradar.com/stories/2026/07/13/new-crashstealer-malware-poses-as-apple-crash-reporting-tool/ A new macOS information-stealing malware named CrashStealer has been discovered. It disguises itself as Apple's legitimate crash-reporting tool to trick users into installing it, subsequently stealing sensitive data such as credentials, keychain information, and cryptocurrency wallet details. https://www.bleepingcomputer.com/news/security/new-crashstealer-malware-poses-as-apple-crash-reporting-tool/ Mon, 13 Jul 2026 19:04:02 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/13/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware/ A malicious version of the Jscrambler npm package was published by a threat actor, containing infostealer malware. This compromised package has been downloaded nearly 1,500 times. https://www.bleepingcomputer.com/news/security/hackers-backdoor-jscrambler-npm-package-with-infostealer-malware/ Mon, 13 Jul 2026 19:44:19 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/14/148-npm-packages-disguised-as-student-proxies-turned-browsers-into-a-ddos-botnet/ A campaign involving 148 npm packages, presented as student web proxies, was discovered to have turned visitors' browsers into a distributed denial-of-service (DDoS) botnet for approximately two weeks in May. The malicious packages utilized the npm registry as free hosting for a booby-trapped proxy site, targeting students attempting to circumvent internet restrictions. https://thehackernews.com/2026/07/148-npm-packages-disguised-as-student.html Tue, 14 Jul 2026 07:08:36 +0000 The Hacker News https://infosecradar.com/stories/2026/07/14/multiple-jscrambler-packages-impacted-by-supply-chain-attack/ A threat actor successfully poisoned several Jscrambler NPM packages, leading to the distribution of a cross-platform credential stealer. This supply chain attack targeted widely used JavaScript packages, compromising users who updated to affected versions. https://www.securityweek.com/multiple-jscrambler-packages-impacted-by-supply-chain-attack/ Tue, 14 Jul 2026 09:04:39 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/14/phishing-for-dummies-forg365-lowers-barrier-to-m365-account-takeovers/ A new phishing-as-a-service platform called Forg365, distributed via Telegram, is making Microsoft 365 account takeovers more accessible to less-skilled attackers. The platform utilizes AI for lure creation, device-code abuse, and adversary-in-the-middle techniques to bypass authentication controls and maintain access. https://www.csoonline.com/article/4196646/phishing-for-dummies-forg365-lowers-barrier-to-m365-account-takeovers.html Tue, 14 Jul 2026 09:46:06 +0000 CSO Online https://infosecradar.com/stories/2026/07/14/the-bots-are-alive-jailbroken-gemini-spun-up-new-c2-server-for-russian-fraudster/ A Russian fraudster reportedly used a jailbroken version of Google's Gemini AI to rapidly set up a command-and-control (C2) server for fraudulent activities. The AI was credited with performing 90% of the work, with human intervention accounting for only 10%, in just six minutes. https://www.theregister.com/research/2026/07/14/the-bots-are-alive-jailbroken-gemini-spun-up-new-c2-server-for-russian-fraudster-in-just-6-minutes/5270131 Tue, 14 Jul 2026 12:15:00 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/14/new-phishing-kits-target-microsoft-365-accounts-evade-mfa/ Two new phishing kits, named Jalisco and OmegaLord, are actively targeting Microsoft 365 accounts. These kits employ advanced techniques designed to bypass multi-factor authentication (MFA), posing a significant threat to user credentials and sensitive data. https://www.bleepingcomputer.com/news/security/new-phishing-kits-target-microsoft-365-accounts-evade-mfa/ Tue, 14 Jul 2026 12:49:00 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/14/lastpass-bitwarden-users-targeted-with-fake-security-alerts/ LastPass is alerting its users to a phishing campaign that employs deceptive security alerts to lure victims to fake websites. These fraudulent notices are designed to trick users into divulging sensitive information. The campaign appears to be targeting users of both LastPass and Bitwarden password managers. https://www.bleepingcomputer.com/news/security/lastpass-bitwarden-users-targeted-with-fake-security-alerts/ Tue, 14 Jul 2026 15:31:52 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/14/clickfixs-mushrooming-ecosystem-demands-new-defense-tactics/ ClickFix, a newly emerged attack vector, is being offered for rent and can bypass standard antivirus and EDR solutions. The most effective detection method currently identified is YARA analysis, indicating a growing need for updated defense strategies against this evolving threat. https://www.darkreading.com/cyberattacks-data-breaches/clickfixs-ecosystem-demands-new-defense Tue, 14 Jul 2026 15:53:54 +0000 Dark Reading https://infosecradar.com/stories/2026/07/14/labubarat-masquerades-as-nvidia-software-to-control-windows-hosts/ Researchers have identified a new Rust-based remote access trojan (RAT) called LabubaRAT that disguises itself as NVIDIA software. This RAT aims to establish a persistent foothold on Windows hosts, allowing attackers to profile the system and potentially control it. https://thehackernews.com/2026/07/labubarat-masquerades-as-nvidia.html Tue, 14 Jul 2026 16:52:37 +0000 The Hacker News https://infosecradar.com/stories/2026/07/14/nearly-300-github-repos-pose-as-legit-software-to-push-malware/ A threat actor has created nearly 300 GitHub repositories designed to impersonate legitimate software and security projects. These fake repositories are being used to distribute infostealer malware to unsuspecting users. https://www.bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware/ Tue, 14 Jul 2026 19:15:17 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/15/the-state-of-ransomware-2026-payments-are-dropping-but-encryption-is-climbing/ A recent report indicates that while organizations are paying less in ransomware demands, the use of encryption by attackers is on the rise. This trend suggests a shift in attacker tactics, potentially focusing on data exfiltration and disruption over direct financial gain from ransoms. https://www.sophos.com/en-us/blog/sophos-state-of-ransomware-2026 Wed, 15 Jul 2026 00:00:00 +0000 Sophos News https://infosecradar.com/stories/2026/07/15/us-charges-alleged-operators-of-russian-bulletproof-hosting-service/ U.S. federal prosecutors have charged three Russian nationals for allegedly operating a bulletproof hosting service that supported ransomware gangs. This service is believed to have facilitated criminal activities resulting in over $62 million in damages to victims globally. https://www.bleepingcomputer.com/news/security/us-charges-alleged-russian-bulletproof-hosting-service-operators/ Wed, 15 Jul 2026 07:45:50 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/15/compromised-asyncapi-npm-packages-deliver-multi-stage-botnet-malware/ Four npm packages within the @asyncapi namespace have been found to be compromised and are distributing a multi-stage botnet loader. This malicious activity was identified by researchers from OX Security, SafeDep, Socket, and StepSecurity. https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html Wed, 15 Jul 2026 09:16:13 +0000 The Hacker News https://infosecradar.com/stories/2026/07/15/windows-bind-link-attacks-can-hide-malware-from-edr-tools/ Researchers at Bitdefender have discovered a new attack technique on Windows systems that leverages bind links. These links create conflicting filesystem views, allowing malware to evade detection by Endpoint Detection and Response (EDR) tools. https://www.securityweek.com/windows-bind-link-attacks-can-hide-malware-from-edr-tools/ Wed, 15 Jul 2026 13:00:00 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/15/firefox-chrome-adobe-and-vmware-updates-fix-multiple-critical-security-flaws/ Mozilla has released updates for Firefox to fix two critical security vulnerabilities. The company has warned that exploit code for these flaws is publicly available. One vulnerability affects the WebAssembly component, while the other impacts the DOM navigation. https://thehackernews.com/2026/07/firefox-chrome-adobe-and-vmware-updates.html Wed, 15 Jul 2026 13:18:53 +0000 The Hacker News https://infosecradar.com/stories/2026/07/15/kape-101-a-kroll-artifact-parser-and-extractor-cheatsheet/ This article provides a cheatsheet for KAPE (Kroll Artifact Parser and Extractor), a tool used for efficiently locating, extracting, and parsing Windows forensic artifacts. These artifacts can be crucial for identifying adversary activity within the operating system. https://www.blackhillsinfosec.com/kape-cheatsheet/ Wed, 15 Jul 2026 14:00:00 +0000 Black Hills Information Security https://infosecradar.com/stories/2026/07/15/okobot-malware-framework-injects-seed-phrase-phishing-into-ledger-and-trezor-app/ The OkoBot malware framework, active since April 2025 on Windows, includes a module specifically designed to phish users for their hardware wallet recovery phrases. This module injects fake recovery phrase prompts into legitimate desktop applications for Ledger and Trezor wallets on infected machines. https://thehackernews.com/2026/07/okobot-malware-framework-injects-seed.html Wed, 15 Jul 2026 15:30:30 +0000 The Hacker News https://infosecradar.com/stories/2026/07/15/asyncapi-npm-packages-infected-with-credential-stealing-malware/ Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) as part of a supply-chain attack. These packages contained a remote access trojan designed to steal credentials and other sensitive information from infected systems. https://www.bleepingcomputer.com/news/security/-asyncapi-npm-packages-infected-with-credential-stealing-malware/ Wed, 15 Jul 2026 15:37:27 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/15/google-gemini-cli-abused-as-a-hacking-agent-malware-botnet-operator/ A Russian-speaking threat actor, "bandcampro," has been observed using Google's open-source Gemini Command Line Interface (CLI) as a hacking agent. This actor leveraged the AI tool to establish a small-scale botnet, demonstrating a novel abuse of generative AI capabilities for malicious purposes. https://www.bleepingcomputer.com/news/security/google-gemini-cli-abused-as-a-hacking-agent-malware-botnet-operator/ Wed, 15 Jul 2026 18:33:48 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/15/tuxbot-v3-evolution-shows-signs-of-llm-assisted-iot-botnet-development/ TuxBot v3 Evolution is a new IoT botnet framework that researchers believe was developed with the help of a large language model (LLM). While the AI generated code for the botnet, it included a disclaimer, indicating the developer did not fully implement the AI's suggestions. https://thehackernews.com/2026/07/tuxbot-v3-evolution-shows-signs-of-llm.html Wed, 15 Jul 2026 18:43:08 +0000 The Hacker News https://infosecradar.com/stories/2026/07/15/windows-0-day-drops-the-same-day-microsoft-releases-record-number-of-patches/ Microsoft has released a record number of patches for its operating systems and other products, addressing 76 vulnerabilities. Concurrently, a zero-day exploit dubbed HiveLegacy has surfaced, which researchers describe as a powerful primitive with the potential for further malicious activities. https://arstechnica.com/security/2026/07/windows-0-day-drops-the-same-day-microsoft-releases-record-number-of-patches/ Wed, 15 Jul 2026 19:59:48 +0000 Ars Technica (Security) https://infosecradar.com/stories/2026/07/15/identity-attacks-overtake-exploits-as-top-ransomware-cause/ Email-based attacks have surpassed exploit kits as the primary entry point for ransomware. Despite widespread adoption of multifactor authentication (MFA), it was ineffective in 97% of credential-based attacks, failing to prevent compromise. https://www.darkreading.com/identity-access-management-security/identity-attacks-overtake-exploits-top-ransomware-cause Wed, 15 Jul 2026 20:16:13 +0000 Dark Reading https://infosecradar.com/stories/2026/07/15/npm-ecosystem-hit-with-two-new-supply-chain-compromises/ Two significant supply chain compromises have affected the npm ecosystem, impacting multiple packages from AsyncAPI and Jscrambler Code Integrity. Attackers gained access through compromised development credentials and exploited a known vulnerability in GitHub Actions CI/CD workflows to inject malware into open-source packages. Affected organizations are advised to rebuild systems from clean images and rotate all credentials. https://www.csoonline.com/article/4197499/npm-ecosystem-hit-with-two-new-supply-chain-compromises.html Wed, 15 Jul 2026 20:33:40 +0000 CSO Online https://infosecradar.com/stories/2026/07/15/dutch-police-bust-investment-fraud-ring-stealing-over-100-million/ Dutch police have arrested suspects in a large-scale investment fraud ring that allegedly defrauded tens of thousands of victims out of over €100 million. The criminal group operated internationally, using fake investment platforms and social media to lure victims. Authorities seized assets and are continuing investigations into the full extent of the operation. https://www.bleepingcomputer.com/news/security/dutch-police-bust-investment-fraud-ring-stealing-over-100-million/ Wed, 15 Jul 2026 21:55:50 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/cve-2026-25089-fortinet-fortisandbox-os-command-injection-vulnerability/ A critical OS command injection vulnerability (CVE-2026-25089) has been identified in Fortinet FortiSandbox products. An unauthenticated attacker can exploit this flaw via crafted HTTP requests to execute unauthorized commands. Organizations are urged to apply vendor-provided mitigations and adhere to CISA's risk-based patching guidance. https://nvd.nist.gov/vuln/detail/CVE-2026-25089 Thu, 16 Jul 2026 00:00:00 +0000 CISA KEV https://infosecradar.com/stories/2026/07/16/cyberattack-threatens-utterly-critical-infrastructure-in-japan-kfc/ A cyberattack has significantly disrupted operations at KFC Japan, impacting its online ordering system and potentially leading to store closures. The attack targeted a logistics partner, causing its systems to go offline and halting the delivery of crucial supplies. https://www.theregister.com/security/2026/07/16/cyberattack-threatens-utterly-critical-infrastructure-in-japan-kfc/5272220 Thu, 16 Jul 2026 02:01:01 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/16/police-disrupt-a-140m-cyber-fraud-ring-in-spain/ Spanish police have dismantled a significant cyber fraud ring that generated an estimated €140 million through various online attacks. The group's activities included phishing, malware distribution, and other forms of cybercrime, with proceeds being laundered through sophisticated financial schemes. https://www.darkreading.com/threat-intelligence/police-disrupt-140m-euro-cyber-fraud-ring-spain Thu, 16 Jul 2026 07:00:00 +0000 Dark Reading https://infosecradar.com/stories/2026/07/16/srsly-risky-biz-ransomware-uses-ai-to-amp-up-negotiations/ Ransomware operators are reportedly leveraging artificial intelligence to enhance their negotiation tactics. This development allows them to craft more persuasive and personalized demands, potentially increasing their success rate in extorting victims. https://news.risky.biz/srsly-risky-biz-ransomware-uses-ai-to-amp-up-negotiations/ Thu, 16 Jul 2026 07:32:27 +0000 Risky Business News https://infosecradar.com/stories/2026/07/16/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/ A new ransomware variant named Spirals has been observed rapidly encrypting victim networks within a 24-hour timeframe, encompassing initial access, data exfiltration, and final encryption. This rapid attack cycle highlights the increasing efficiency of ransomware operations. https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/ Thu, 16 Jul 2026 10:00:00 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malware/ A financially motivated Russian threat actor known as UAT-11795 is distributing a new backdoor malware called Starland RAT by trojanizing legitimate WebEx and Zoom applications. This malware is designed to steal user credentials and cryptocurrency from infected systems. https://www.bleepingcomputer.com/news/security/russian-hackers-trojanize-webex-zoom-apps-to-push-starland-malware/ Thu, 16 Jul 2026 10:19:34 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/daxin-resurfaces-in-taiwan-alongside-stupig-pre-login-system-backdoor/ The Daxin kernel-mode rootkit, linked to a China-affiliated threat actor, has reappeared after more than four years, infecting a manufacturing firm in Taiwan. Alongside Daxin, a new, previously unknown backdoor named Stupig has also been discovered. https://thehackernews.com/2026/07/daxin-resurfaces-in-taiwan-alongside.html Thu, 16 Jul 2026 11:17:23 +0000 The Hacker News https://infosecradar.com/stories/2026/07/16/20-hijacked-government-websites-became-an-attack-channel/ Over 20 Brazilian government websites have been compromised and used as a distribution channel for malware by the PhantomEnigma threat group. The campaign, uncovered by ANY.RUN, also revealed new backdoor functionalities and hidden infrastructure details. https://thehackernews.com/2026/07/20-hijacked-government-websites.html Thu, 16 Jul 2026 11:58:00 +0000 The Hacker News https://infosecradar.com/stories/2026/07/16/new-clicklock-macos-stealer-kills-apps-every-210ms-until-victims-type-their-pass/ A new macOS infostealer named ClickLock Stealer has been identified that pressures victims into revealing their passwords by repeatedly terminating running applications. The malware is initiated via a command pasted into the Terminal and employs a fake system dialog to request the user's password. https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html Thu, 16 Jul 2026 12:33:42 +0000 The Hacker News https://infosecradar.com/stories/2026/07/16/clicklock-stealer-bypasses-macos-security-with-social-engineering-process-killin/ A new macOS malware named 'ClickLock Stealer' has been identified that targets users by stealing passwords and cryptocurrency. The malware employs social engineering tactics and the ability to kill processes to bypass macOS security measures. https://www.securityweek.com/clicklock-stealer-bypasses-macos-security-with-social-engineering-process-killing/ Thu, 16 Jul 2026 12:43:59 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/16/new-telepuz-malware-spreads-via-clickfix-to-steal-data-and-run-commands/ A new modular malware named TELEPUZ has been observed spreading since late April 2026, utilizing websites infected with ClickFix lures. This malware is described as full-featured, lightweight, and modular, with capabilities for data theft and command execution. https://thehackernews.com/2026/07/new-telepuz-malware-spreads-via.html Thu, 16 Jul 2026 12:50:13 +0000 The Hacker News https://infosecradar.com/stories/2026/07/16/cmon-just-copy-this-text-string-and-paste-it-into-your-macos-terminal-itll-fix-y/ A new macOS stealer named ClickLock targets users through social engineering tactics, tricking them into running malicious commands in their Terminal. This malware aims to steal sensitive information by exploiting user trust and a lack of security awareness. https://www.theregister.com/cyber-crime/2026/07/16/cmon-just-copy-this-text-string-and-paste-it-into-your-macos-terminal-itll-fix-your-computer-honest/5273701 Thu, 16 Jul 2026 15:33:01 +0000 The Register (Security) https://infosecradar.com/stories/2026/07/16/threatsday-game-cheat-spyware-24-hour-ransomware-chrome-sync-stalking-12-more-st/ This article summarizes 15 security-related stories from the past week. It highlights threats such as game cheat spyware, a rapid 24-hour ransomware attack, and the potential for Chrome sync settings to be exploited for stalking. The piece also notes the resurgence of old bugs and the exploitation of weak default configurations. https://thehackernews.com/2026/07/threatsday-game-cheat-spyware-24-hour.html Thu, 16 Jul 2026 15:41:15 +0000 The Hacker News https://infosecradar.com/stories/2026/07/16/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/ A new malicious framework named OkoBot has been identified, which deploys over 20 distinct payloads. These payloads are designed to steal sensitive data, including cryptocurrency wallet seed phrases and user credentials. https://www.bleepingcomputer.com/news/security/new-okobot-framework-deploys-20-payloads-to-steal-data-crypto/ Thu, 16 Jul 2026 19:09:35 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/1m-emails-use-hidden-text-to-dupe-ai-security-filters/ A recent article highlights how over a million emails are employing a technique called 'text salting' to bypass AI-powered security filters. This method involves embedding hidden text within emails, making them appear legitimate to AI and thus increasing the success rate of phishing campaigns. https://www.darkreading.com/threat-intelligence/1m-emails-hidden-text-dupe-ai-security-filters Thu, 16 Jul 2026 19:41:31 +0000 Dark Reading https://infosecradar.com/stories/2026/07/16/coca-cola-says-fairlife-ransomware-attack-halts-us-dairy-production/ Coca-Cola's dairy subsidiary, Fairlife, has experienced a ransomware attack that has temporarily halted its production across the United States. The attack has impacted operations, leading to a suspension of Fairlife product manufacturing. https://www.bleepingcomputer.com/news/security/coca-cola-says-fairlife-ransomware-attack-halts-us-dairy-production/ Thu, 16 Jul 2026 21:09:41 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/16/new-clicklock-macos-malware-traps-users-into-revealing-login-password/ A new macOS malware named ClickLock has been discovered that terminates visible processes, tricking users into entering their system login password. This information stealer aims to capture the password entered by the unsuspecting user. The malware is distributed through malicious installers disguised as legitimate software. https://www.bleepingcomputer.com/news/security/new-clicklock-macos-malware-traps-users-into-revealing-login-password/ Thu, 16 Jul 2026 21:52:54 +0000 Bleeping Computer https://infosecradar.com/stories/2026/07/17/coca-cola-suspends-us-fairlife-production-due-to-ransomware-attack/ Coca-Cola has suspended production at its US Fairlife facilities due to a ransomware attack. The company stated that the incident has not compromised product quality or safety, nor has it impacted Fairlife's operations in Canada. https://www.securityweek.com/coca-cola-suspends-us-fairlife-production-due-to-ransomware-attack/ Fri, 17 Jul 2026 06:23:08 +0000 SecurityWeek https://infosecradar.com/stories/2026/07/17/fake-ttf-files-deliver-stealthy-malware-in-global-phishing-campaign/ Threat actors are employing a global phishing campaign that abuses standard TrueType Font (TTF) files to deliver stealthy malware. This campaign uses heavily obfuscated JavaScript and a Lua-based loader disguised as a font file to evade detection and install malware like RATs and infostealers. https://www.csoonline.com/article/4198165/fake-ttf-files-deliver-stealthy-malware-in-global-phishing-campaign.html Fri, 17 Jul 2026 08:45:04 +0000 CSO Online https://infosecradar.com/stories/2026/07/17/new-goserpent-malware-targets-southeast-asian-governments-and-diplomats-for-espi/ Cybersecurity researchers have identified a new malware named GoSerpent, in use since late 2025, specifically targeting government and diplomatic entities in Southeast Asia. The malware, discovered by Kaspersky, is designed for long-term access and intelligence gathering, suggesting a sophisticated espionage campaign. https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html Fri, 17 Jul 2026 08:46:45 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/acr-stealer-uses-clickfix-lures-to-steal-browser-tokens-and-microsoft-365-files/ The ACR Stealer malware, active since 2024, is capable of exfiltrating sensitive data including browser passwords, active session tokens, PDFs, and Microsoft 365 files from synced cloud storage. It achieves initial access through user execution of malicious commands, as detailed by Microsoft's Defender Experts team. https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html Fri, 17 Jul 2026 08:56:39 +0000 The Hacker News https://infosecradar.com/stories/2026/07/17/armenia-detains-russian-tourist-on-us-warrant-for-revil-hacker-lawyers-say-wrong/ Armenia has detained a Russian tourist, Aleksandr Ermakov, based on a U.S. extradition request. The U.S. is seeking him as a suspect linked to the REvil ransomware group. However, the detained individual's wife claims the U.S. has arrested the wrong person, presenting a potential misidentification case. https://thehackernews.com/2026/07/armenia-detains-russian-tourist-on-us.html Fri, 17 Jul 2026 10:53:31 +0000 The Hacker News