Malware Archives • Page 2 of 127 • Daily CyberSecurity

Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions A graphic showing BGP routing hijacking redirecting a server update to a malicious source

A graphic showing BGP routing hijacking redirecting a server update to a malicious source

Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions

Do Son October 1, 2026

A fake update component for the Poedit translation app gave attackers a quiet foothold on Windows machines....

New MacSync macOS Infostealer Targets Crypto Wallets Diagram of the new MacSync macOS infostealer showing how the MacSync macOS infostealer infects Apple devices

Diagram of the new MacSync macOS infostealer showing how the MacSync macOS infostealer infects Apple devices

New MacSync macOS Infostealer Targets Crypto Wallets

Do Son September 29, 2026

At a Glance Attribute Details Malware Family MacSync (originally advertised as Mac.c) Threat Actor Unknown cybercriminals (Malware-as-a-Service...

SectopRAT Malware Variant Hidden in Legitimate Software Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

SectopRAT Malware Variant Hidden in Legitimate Software

Do Son September 29, 2026

At a Glance Attribute Details Malware Family SectopRAT (also known as ArechClient2) Threat Actor Unknown (Unconfirmed attribution)...

Android Toll Fraud Malware Found on Google Play Diagram of the Google Play Android toll fraud malware infection chain showing how Android toll fraud malware executes

Diagram of the Google Play Android toll fraud malware infection chain showing how Android toll fraud malware executes

Android Toll Fraud Malware Found on Google Play

Do Son September 29, 2026

At a Glance Attribute Details Malware Family Android Toll Fraud family (including Messenger Pro and AqMu builds)...

PamStealer macOS Malware Spreads via Fake Wavel Crypto App Diagram of the new PamStealer macOS infostealer showing how the PamStealer macOS infostealer infects Apple devices

Diagram of the new PamStealer macOS infostealer showing how the PamStealer macOS infostealer infects Apple devices

PamStealer macOS Malware Spreads via Fake Wavel Crypto App

Do Son September 28, 2026

At a Glance Attribute Details Malware Family PamStealer (internal project name: MacClient) Threat Actor Unknown cybercriminals (unconfirmed...

RemControl Android Banking Trojan Steals Bank PINs

RemControl Android banking trojan blocking Play Protect, RemControl malware fake TVTap app delivery

RemControl Android Banking Trojan Steals Bank PINs

Do Son September 28, 2026

At a Glance Attribute Details Actor or Group Operator tracked as UNKK Activity Type Android banking malware,...

Malicious Terraform Providers Spread Graphalgo Go Malware Diagram to detect malicious Terraform providers and stop malicious Terraform providers in CI/CD

Diagram to detect malicious Terraform providers and stop malicious Terraform providers in CI/CD

Malicious Terraform Providers Spread Graphalgo Go Malware

Do Son September 25, 2026

At a Glance Attribute Details Malware Family Graphalgo (Go port) Threat Actor Unknown (suspected Graphalgo campaign operator)...

CLOSEDQUORUM AI Malware Uses LLMs for Autonomous C2 Diagram of the autonomous CLOSEDQUORUM AI malware architecture showing how CLOSEDQUORUM AI malware queries language models

Diagram of the autonomous CLOSEDQUORUM AI malware architecture showing how CLOSEDQUORUM AI malware queries language models

CLOSEDQUORUM AI Malware Uses LLMs for Autonomous C2

Do Son September 25, 2026

At a Glance Summary Attribute Details Malware Family CLOSEDQUORUM Threat Actor Unknown developer (suspected ties to criminal...

WordPress Must-Use Plugin Malware Uses EtherHiding Analysis of stealthy WordPress must-use plugin malware and WordPress must-use plugin malware architecture

Analysis of stealthy WordPress must-use plugin malware and WordPress must-use plugin malware architecture

WordPress Must-Use Plugin Malware Uses EtherHiding

Do Son September 25, 2026

At a Glance Attribute Details Malware Family Unnamed WordPress Must-Use Plugin Malware (EtherHiding variant) Threat Actor Unknown...

New TASK#STOMP PowerShell Backdoor Targets Windows Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

New TASK#STOMP PowerShell Backdoor Targets Windows

Do Son September 24, 2026

At a Glance Attribute Details Malware Family TASK#STOMP Threat Actor Unknown (Unconfirmed attribution) Target Victims Enterprise networks...

Vidar Information Stealer Upgrades Evasion Tactics AutoIt-Delivering-Vidar-Stealer

Vidar Information Stealer Upgrades Evasion Tactics

Do Son September 23, 2026

At a Glance Attribute Details Malware Family Vidar information stealer Threat Actor Unknown financially motivated cybercriminals Target...

MemTensor MemOS Compromise Exposes AI Developer Secrets Diagram showing the MemTensor MemOS compromise details and how the MemTensor MemOS compromise affects developers

Diagram showing the MemTensor MemOS compromise details and how the MemTensor MemOS compromise affects developers

MemTensor MemOS Compromise Exposes AI Developer Secrets

Do Son September 23, 2026

At a Glance Attribute Details Malware Family sckit Go binary Threat Actor Unknown Target Victims AI developers...

KRSID Ransomware Targets Private HTS Investment Platforms KRSID ransomware targeting private HTS malware victims

KRSID Ransomware Targets Private HTS Investment Platforms

Do Son September 23, 2026

At a Glance Malware Family: KRSID ransomware, Quasar RAT (historical). Threat Actor: Suspected investment fraud groups (Telegram:...

MovieReaper Malware Spreads via Compromised Torrents The MovieReaper malware torrent attacks infection chain

MovieReaper Malware Spreads via Compromised Torrents

Do Son September 22, 2026

At a Glance Attribute Details Malware Family MovieReaper Threat Actor Unknown cybercriminals Target Victims Hundreds of organizations...

HEAVYGRAM Malware Abuses Telegram for Cyberespionage Diagram of Iranian HEAVYGRAM malware illustrating how HEAVYGRAM malware compromises endpoints

Diagram of Iranian HEAVYGRAM malware illustrating how HEAVYGRAM malware compromises endpoints

HEAVYGRAM Malware Abuses Telegram for Cyberespionage

Do Son September 22, 2026

At a Glance Attribute Details Malware Family HEAVYGRAM (associated with CRUDEEXCLUDE) Threat Actor Handala Hack (suspected persona...

LLM-Generated PhantomRaven Information Stealer Discovered Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

LLM-Generated PhantomRaven Information Stealer Discovered

Do Son September 21, 2026

At a Glance Attribute Details Malware Family PhantomRaven Threat Actor Suspected bug bounty hunter (Aliases: JPD, jpdhellonpm1)...

KREMLIN Banking Malware Targets Brazilian Banks Diagram of Brazilian KREMLIN banking malware showing how KREMLIN banking malware installs malicious browser extensions

Diagram of Brazilian KREMLIN banking malware showing how KREMLIN banking malware installs malicious browser extensions

KREMLIN Banking Malware Targets Brazilian Banks

Do Son September 21, 2026

At a Glance Attribute Details Malware Family KREMLIN (also tracked as CHROMEBALLRAT) Threat Actor REF9334 (alias Kr3mlin4rt1st;...

Mantax Otax Android Malware: Spyware Meets Ransomware Mantax Otax Android malware infection screen

Mantax Otax Android Malware: Spyware Meets Ransomware

Do Son September 17, 2026

Security researchers recently uncovered the Mantax Otax Android malware. This dangerous Indonesian mobile ransomware integrates deep espionage...

SloppyRAT Malware Analyzed in Ransomware Attacks Gryxa toolkit AI-built malware diagram showing RMM abuse and crypto credential theft across 324 hosts

Gryxa toolkit AI-built malware diagram showing RMM abuse and crypto credential theft across 324 hosts

SloppyRAT Malware Analyzed in Ransomware Attacks

Do Son September 16, 2026

At a glance Malware family: SloppyRAT Threat actor: Suspected ransomware operators Targets or victims: Windows endpoints Delivery...

Vwork Android Malware Clones Apps in Gigabud Attacks Vwork Android malware diagram showing the Gigabud Vwork Android malware attack chain

Vwork Android Malware Clones Apps in Gigabud Attacks

Do Son September 16, 2026

At a glance Malware family: Vwork and Gigabud Threat actor: GoldFactory (confirmed attribution) Targets or victims: Mobile...

Casbaneiro Banking Trojan Hits Latin American Banks Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Casbaneiro Banking Trojan Hits Latin American Banks

Do Son September 16, 2026

At a glance Malware family: Casbaneiro Threat actor: Unknown Latin American cybercriminal group (suspected attribution) Targets or...

Cyclops Blink Malware Returns to Target Network Appliances Sophos CTU researchers discovered a new 64-bit Linux variant of the Cyclops Blink malware targeting Cisco FMC devices, featuring advanced network scanning.

Sophos CTU researchers discovered a new 64-bit Linux variant of the Cyclops Blink malware targeting Cisco FMC devices, featuring advanced network scanning.

Cyclops Blink Malware Returns to Target Network Appliances

Do Son September 14, 2026

At a glance Malware family: Cyclops Blink Threat actor: Suspected IRON VIKING (Sandworm / Russian nexus) Targets...