Malware Archives • Page 2 of 124 • Daily CyberSecurity

Fake AI Tools Malware Targets Developers Through GitHub Fake AI tools malware in a GitHub infostealer campaign targeting developers

Fake AI Tools Malware Targets Developers Through GitHub

Do Son August 11, 2026

At a glance Malware family MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) Threat actor...

DOUBLECUP ClickFix Loader-as-a-Service infection chain deploying CountLoader and DeviceManager RAT

DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT

Do Son August 11, 2026

At a Glance Attribute Detail Malware family DOUBLECUP (Loader-as-a-Service); payloads CountLoader 4.5p and DeviceManager RAT Threat actor...

Interlock Ransomware Abuses Volatility3 for Credential Theft Interlock ransomware attack chain abusing Volatility3 memory forensics tool for credential theft

Interlock ransomware attack chain abusing Volatility3 memory forensics tool for credential theft

Interlock Ransomware Abuses Volatility3 for Credential Theft

Do Son August 10, 2026

At a Glance Attribute Detail Malware family Interlock ransomware (double extortion) Threat actor Interlock, tracked by Sophos...

BdThemes Supply Chain Attack Poisons Plugin API to Hijack WordPress Admins BdThemes supply chain attack diagram showing a poisoned WordPress plugin API feed injecting XSS into an admin dashboard

BdThemes supply chain attack diagram showing a poisoned WordPress plugin API feed injecting XSS into an admin dashboard

BdThemes Supply Chain Attack Poisons Plugin API to Hijack WordPress Admins

Do Son August 9, 2026

At a Glance Malware family API-driven XSS supply chain implant (Biggopti banner abuse) Threat actor Suspected; linked...

QuickFox Supply Chain Attack Delivers FDMTP Implant to Windows Users C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

QuickFox Supply Chain Attack Delivers FDMTP Implant to Windows Users

Do Son August 7, 2026

At a Glance Attribute Detail Malware family FDMTP implant (.NET, TouchSocket-based) Threat actor Suspected Twill Typhoon (not...

Xeno Roblox Malware Spreads a Java Stealer Through Fake Cheats CVE-2024-3393 - Zservers sanctions

Xeno Roblox Malware Spreads a Java Stealer Through Fake Cheats

Do Son August 6, 2026

At a glance Malware family Powercat (Java-based stealer and RAT) Threat actor Not attributed to a named...

XCSSET v40 Malware Targets macOS Developers Through Xcode XCSSET v40 malware infection chain showing Xcode project supply chain attack on macOS

XCSSET v40 malware infection chain showing Xcode project supply chain attack on macOS

XCSSET v40 Malware Targets macOS Developers Through Xcode

Do Son August 6, 2026

At a glance Malware family XCSSET (version 40) Threat actor Unattributed; tracked by Unit 42 since 2020,...

HostDzire Ransomware Attack Causes Complete Data Loss HostDzire ransomware attack on VMware infrastructure and encrypted VPS virtual disks

HostDzire ransomware attack on VMware infrastructure and encrypted VPS virtual disks

HostDzire Ransomware Attack Causes Complete Data Loss

Do Son August 6, 2026

Ransomware Intrusion Erases User Data When utilizing Virtual Private Server (VPS) infrastructure, performing routine data backups remains...

OctLurk and SilkLurk backdoors targeting Central Asian government espionage campaign

OctLurk and SilkLurk Backdoors Hit Central Asian Government Networks

Do Son August 5, 2026

At a glance Field Detail Malware family OctLurk (plugin-based backdoor); SilkLurk (plugin-based backdoor); LurkProxy (network proxy utility)...

XMRig Botnet Abuses Linux PAM to Spread Forensic Smokescreen Across User Accounts XMRig Linux PAM abuse fileless cryptominer V25 botnet forensic smokescreen

XMRig Linux PAM abuse fileless cryptominer V25 botnet forensic smokescreen

XMRig Botnet Abuses Linux PAM to Spread Forensic Smokescreen Across User Accounts

Do Son August 5, 2026

At a glance Field Detail Malware family Modified XMRig 6.25.0 botnet implant (marked “PRIVATE VERSION FOR BOTNET”),...

GenieLocker Ransomware Targets Russian Manufacturers on Windows, Linux, and ESXi GenieLocker ransomware by Toy Ghouls targeting Russian manufacturing on Windows Linux ESXi

GenieLocker ransomware by Toy Ghouls targeting Russian manufacturing on Windows Linux ESXi

GenieLocker Ransomware Targets Russian Manufacturers on Windows, Linux, and ESXi

Do Son August 5, 2026

At a glance Field Detail Malware family GenieLocker (PE builds for Windows; ELF builds for Linux and...

npm Supply Chain Attack Hijacks Keyv and Spreads Shai-Hulud Malware npm supply chain attack on keyv and cacheable packages spreading Shai-Hulud malware credential stealer to CI/CD pipelines

npm supply chain attack on keyv and cacheable packages spreading Shai-Hulud malware credential stealer to CI/CD pipelines

npm Supply Chain Attack Hijacks Keyv and Spreads Shai-Hulud Malware

Do Son August 4, 2026

At a glance Malware family Shai-Hulud variant (“Mini Shai-Hulud”) Threat actor Unattributed; linked to the Shai-Hulud lineage...

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays

Do Son August 4, 2026

At a glance Malware family Dysphoria (jackskid/fbot-derived IoT botnet) Threat actor Unattributed; run as a commercial DDoS-for-hire...

npm supply chain attack delivering a cross-platform RAT via malicious npm packages targeting Alibaba developers

npm Supply Chain Attack Delivers a Cross-Platform RAT to Alibaba Developers

Do Son August 3, 2026

At a glance Malware family Unnamed cross-platform RAT (final payload “aone-cli”) Threat actor Unattributed; suspected Chinese-speaking actor...

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices

Do Son August 3, 2026

At a glance Malware family Tengu (Mirai-derived IoT botnet) Threat actor Unattributed; no operator named Target Internet-facing...

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers

Do Son August 3, 2026

At a glance Malware family CastleLoader (loader); payloads include CastleStealer, NetSupport RAT, Lobshot, and NeedleStealer Threat actor...

SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks SonicWall SMA exploit chain diagram showing wsproxy bypass leading to INC Ransomware root access

SonicWall SMA exploit chain diagram showing wsproxy bypass leading to INC Ransomware root access

SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks

Do Son August 3, 2026

Malware family ROOTRUN, KNUCKLEBALL, Suo5, ORANGETAIL Threat actor UTA0533 (pre-disclosure cluster, suspected link to INC Ransomware); INC...

Copybara Android RAT Spreads Through N26 Vishing Scam in Italy Copybara Android RAT delivered through N26 vishing and Fake Control 1.0 phishing panel

Copybara Android RAT delivered through N26 vishing and Fake Control 1.0 phishing panel

Copybara Android RAT Spreads Through N26 Vishing Scam in Italy

Do Son July 30, 2026

At a glance Malware family Copybara (Android RAT) Operators Not attributed; kit uses Portuguese-language identifiers Targets N26...

TrickBot Variant Hides C2 Traffic Inside Malformed DNS Queries FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

TrickBot Variant Hides C2 Traffic Inside Malformed DNS Queries

Do Son July 29, 2026

At a Glance Malware family TrickBot (modular Windows banking trojan and loader) Threat actor Not attributed by...

Lampion Malware Campaign Targets Portugal With Fake Payment Receipts C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

Lampion Malware Campaign Targets Portugal With Fake Payment Receipts

Do Son July 29, 2026

At a Glance Malware family Lampion, a Brazilian banking trojan from the ChePro lineage Threat actor No...

Chaos Ransomware Uses msaRAT to Hide C2 Traffic Inside Chrome msaRAT malware used by the Chaos ransomware group to route C2 traffic through a headless Chrome browser session

msaRAT malware used by the Chaos ransomware group to route C2 traffic through a headless Chrome browser session

Chaos Ransomware Uses msaRAT to Hide C2 Traffic Inside Chrome

Do Son July 29, 2026

At a glance Malware family msaRAT, a Rust remote access trojan Threat actor Chaos ransomware group (confirmed...

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads

Do Son July 27, 2026

Attackers are hiding malware inside fake game and software installers. Malwarebytes Labs calls the threat RenPy Loader....

Critical Alert 6 Active Exploits Detected Today