Malware Archives • Daily CyberSecurity

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins GoldPickaxe banking Trojan stealing biometric data and lock screen credentials from an Android phone

GoldPickaxe banking Trojan stealing biometric data and lock screen credentials from an Android phone

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins

Do Son July 17, 2026

At a glance Malware family GoldPickaxe (Android banking Trojan, GoldDigger suite) Threat actor GoldFactory (confirmed by Zimperium;...

RokRAT Malware Hides in Fake PDF Files to Spy on Academics APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

RokRAT Malware Hides in Fake PDF Files to Spy on Academics

Do Son July 17, 2026

At a glance Malware family RokRAT variant (x64) Threat actor Assessed highly likely APT37 (suspected, not confirmed)...

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users Fake GitHub repositories BoryptGrab infostealer attack chain diagram

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users

Do Son July 17, 2026

At a Glance Malware family BoryptGrab-lineage in-memory infostealer Threat actor Unattributed; financially motivated, likely Russian-speaking Targets Opportunistic...

Supply Chain Trojan Targets Software Developers Through Project Files Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Supply Chain Trojan Targets Software Developers Through Project Files

Do Son July 17, 2026

At a glance Malware family Multi-stage trojan (Doctor Web: Trojan.DownLoader49, BackDoor.Siggen2.5906, Trojan.BtcMine.3956) Threat actor Unknown; not attributed...

Albiriox Android Banking Trojan Spreads Through Fake UniCredit Rewards on Telegram Albiriox malware Android banking trojan spread via fake UniCredit banking rewards and Telegram bot

Albiriox malware Android banking trojan spread via fake UniCredit banking rewards and Telegram bot

Albiriox Android Banking Trojan Spreads Through Fake UniCredit Rewards on Telegram

Do Son July 16, 2026

At a Glance Malware family Albiriox (Android banking RAT, sold as Malware-as-a-Service), delivered by a UniCredit-branded dropper...

GigaWiper Backdoor Bundles Disk Wiping Malware and Fake Ransomware illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

GigaWiper Backdoor Bundles Disk Wiping Malware and Fake Ransomware

Do Son July 16, 2026

At a glance Malware family GigaWiper (Golang backdoor; code ties to Crucio and FlockWiper) Threat actor Not...

Fake Braintree NuGet Package Skims Credit Cards and Steals Merchant API Keys Braintree NuGet typosquat credit card skimmer stealing payment data and merchant API keys

Braintree NuGet typosquat credit card skimmer stealing payment data and merchant API keys

Fake Braintree NuGet Package Skims Credit Cards and Steals Merchant API Keys

Do Son July 15, 2026

At a Glance Malware family Braintree.Net typosquat, a multi-stage .NET implant with a companion harvester (DependencyInjector.Core) Threat...

CrySome RAT Spread Through Fake Freight Rate Confirmation Phishing NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

CrySome RAT Spread Through Fake Freight Rate Confirmation Phishing

Do Son July 15, 2026

Malware family CrySome RAT, a .NET remote access trojan Threat actor Not named; no confirmed attribution Target...

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram

Do Son July 15, 2026

Malware family RedWing (Android spyware/RAT; suspected new variant of Oblivion) Threat actor Unnamed operators; suspected Russian-nexus, not...

GodDamn Ransomware Rebrands Beast and Uses a Malicious Signed Driver to Disable Defenses

Do Son July 15, 2026

At a Glance Malware family GodDamn ransomware (rebrand of Beast, formerly Monster) Threat actor Hyadina, a ransomware-as-a-service...

Node.js Backdoor Hides Its C2 on the TON Blockchain Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Node.js Backdoor Hides Its C2 on the TON Blockchain

Do Son July 15, 2026

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no...

Vidar Stealer Campaign Uses Factory-v3 Loader Diagram showing how a Vidar stealer campaign uses the Factory-v3 loader to infect systems.

Vidar Stealer Campaign Uses Factory-v3 Loader

Do Son July 13, 2026

In April 2026, security researchers uncovered a massive Vidar stealer campaign distributing data theft and cryptocurrency mining...

ScreenConnect AsyncRAT Campaign infrastructure and remote monitoring tools

ScreenConnect AsyncRAT Campaign Hides Inside Fake Freeware

Do Son July 13, 2026

At a Glance Malware Family: AsyncRAT Threat Actor: Unknown cybercriminals Target or Victims: Individual consumers and corporate...

Mycelium Framework: First AI-as-a-Service Botnet TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Mycelium Framework: First AI-as-a-Service Botnet

Do Son July 13, 2026

At a Glance Malware Family: Mycelium Framework Threat Actor: Unknown (suspected underground developer) Targets or Victims: Enterprise...

PamStealer macOS Malware Poses as Maccy to Steal Passwords PamStealer macOS malware delivering a Rust infostealer through a fake Maccy clipboard app

PamStealer macOS malware delivering a Rust infostealer through a fake Maccy clipboard app

PamStealer macOS Malware Poses as Maccy to Steal Passwords

Do Son July 10, 2026

Malware family PamStealer (Rust-based macOS infostealer) Threat actor Not attributed by Jamf Targets Apple Silicon Mac users;...

JADEPUFFER Marks the First AI-Driven Agentic Ransomware Attack JADEPUFFER agentic ransomware attack chain diagram from Langflow RCE to database extortion

JADEPUFFER agentic ransomware attack chain diagram from Langflow RCE to database extortion

JADEPUFFER Marks the First AI-Driven Agentic Ransomware Attack

Do Son July 10, 2026

At a Glance Malware family JADEPUFFER (agentic ransomware) Threat actor Unnamed operator; Sysdig assesses an autonomous AI...

Hidden LG Monitor Adware: Stop Unwanted Pop-ups Now LG monitor adware warning showing unwanted McAfee pop-ups and bloatware installation

Hidden LG Monitor Adware: Stop Unwanted Pop-ups Now

Do Son July 9, 2026

Hidden LG Monitor Adware Sparks Outrage Typically, intrusive pop-up advertisements originate from pre-installed adware or deliberately downloaded...

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat

Do Son July 8, 2026

At a Glance Malware type Native Messaging backdoor with a malicious Chrome extension Threat actor Unattributed Targets...

Veil#Drop Malware Uses Blogspot to Deliver PureLog Stealer China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

Veil#Drop Malware Uses Blogspot to Deliver PureLog Stealer

Do Son July 8, 2026

Malware family PureLog Stealer (delivered by the Veil#Drop framework) Threat actor Not attributed by Securonix Targets Windows...

RustDuck Botnet: A Two-Stage DDoS Threat Shifting From C to Rust RustDuck botnet two-stage DDoS malware loader core architecture analysis diagram

RustDuck botnet two-stage DDoS malware loader core architecture analysis diagram

RustDuck Botnet: A Two-Stage DDoS Threat Shifting From C to Rust

Do Son July 7, 2026

At a Glance Malware family RustDuck Threat actor Unattributed Targets / victims IoT devices, web apps, and...

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users