Malware Archives • Page 2 of 125 • Daily CyberSecurity

PackClient RAT: New C2 Framework Sold on Telegram ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

PackClient RAT: New C2 Framework Sold on Telegram

Do Son September 2, 2026

At a Glance Malware family PackClient (RAT / C2 framework) Threat actor TA4922 (Chinese-speaking) – confirmed attribution...

Amatera Password Stealer Abuses Service Workers and Smart Contracts Amatera password stealer campaign attack chain diagram and Amatera password stealer workflow

Amatera password stealer campaign attack chain diagram and Amatera password stealer workflow

Amatera Password Stealer Abuses Service Workers and Smart Contracts

Do Son September 2, 2026

At a Glance Category Details Malware Family Amatera (rebrand of ACR Stealer / AcridRain) Threat Actor Unattributed...

Miraak Post Exploitation Framework Adopts Database C2 Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

Miraak Post Exploitation Framework Adopts Database C2

Do Son September 1, 2026

At a Glance Malware Family: Miraak Threat Actor: Unknown (Discovered via adversary operational security failure) Targets: Broad...

ToxNetV2 Botnet Integrates AI ToxNetV2 botnet infrastructure diagram highlighting AI integration

ToxNetV2 Botnet Integrates AI

Do Son August 31, 2026

Language models are steadily infiltrating tools where AI responses directly dictate the functionality of malicious programs. Security...

Anthropic Issues Claude Security Warnings A conceptual illustration of malware stealing session tokens from a Claude user account

Anthropic Issues Claude Security Warnings

Do Son August 31, 2026

According to recent information shared by users on Reddit, Anthropic recently initiated emergency security protocols. The company...

ToxicPanda 2.0 Banking Trojan Attacks Escalate Globally Diagram showing how the ToxicPanda 2.0 banking Trojan attacks victims using the updated ToxicPanda 2.0 banking Trojan

Diagram showing how the ToxicPanda 2.0 banking Trojan attacks victims using the updated ToxicPanda 2.0 banking Trojan

ToxicPanda 2.0 Banking Trojan Attacks Escalate Globally

Do Son August 31, 2026

At a glance Factor Details Malware Family ToxicPanda 2.0 Threat Actor Unconfirmed (Suspected Chinese-speaking actors) Targets Android...

NPM Typosquatting Malware Targets WSL Developers Diagram showing npm typosquatting malware and the npm typosquatting malware campaign infection chain

Diagram showing npm typosquatting malware and the npm typosquatting malware campaign infection chain

NPM Typosquatting Malware Targets WSL Developers

Do Son August 31, 2026

At a glance Factor Details Malware Family Rust-based cryptocurrency and credential stealer Threat Actor Unconfirmed Target or...

Aurora Ransomware Targets VMware ESXi and Abuses Cursor Agent Aurora ransomware infection chain and Aurora ransomware ESXi attack architecture

Aurora ransomware infection chain and Aurora ransomware ESXi attack architecture

Aurora Ransomware Targets VMware ESXi and Abuses Cursor Agent

Do Son August 30, 2026

At a Glance Category Details Malware Family Aurora Ransomware Threat Actor Aurora Ransomware Group (suspected Russian-speaking operator)...

SynkLoader Malware Deploys Multi-Language Attack Tools C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

SynkLoader Malware Deploys Multi-Language Attack Tools

Do Son August 28, 2026

At a glance Factor Details Malware Family SynkLoader Threat Actor Suspected initial access broker or ransomware affiliate...

macOS ClickFix Malware Exploits Polygon C2 macOS ClickFix malware campaign infection flow and macOS ClickFix malware execution diagram

macOS ClickFix Malware Exploits Polygon C2

Do Son August 28, 2026

At a glance Factor Details Malware Family AMOS (Atomic macOS Stealer), Light Stealer, and XMRig miner Threat...

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites

Do Son August 27, 2026

At a Glance Malware family WeedHack (Malware-as-a-Service infostealer) Threat actor Unnamed MaaS operators and customers (not publicly...

Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR

Do Son August 27, 2026

At a glance Malware family Cruciferra malware loader (delivers Remus stealer) Threat actor Cruciferra and LenAI (ErrTraffic)...

Malicious Firefox extensions stealing crypto wallet secrets and credentials in the Offside Wallet Theft Factory campaign

77 Malicious Firefox Extensions Steal Crypto Wallet Secrets and Credentials

Do Son August 26, 2026

At a Glance Malware family Offside Wallet Theft Factory (campaign of cloned wallet-stealing extensions) Threat actor Unattributed;...

Grandoreiro Banking Trojan Returns With a DLL Sideloading Campaign TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Grandoreiro Banking Trojan Returns With a DLL Sideloading Campaign

Do Son August 26, 2026

At a glance Malware family Grandoreiro banking trojan Threat actor Portuguese-speaking operators (suspected) Target or victims Bank...

Clop Deploys Custom Web Shell in PTC Windchill Extortion Attacks Clop web shell exploiting PTC Windchill CVE-2026-12569 to steal credentials and engineering data

Clop web shell exploiting PTC Windchill CVE-2026-12569 to steal credentials and engineering data

Clop Deploys Custom Web Shell in PTC Windchill Extortion Attacks

Do Son August 25, 2026

At a glance Malware family Custom Java web shell (unnamed implant) Threat actor Clop / Cl0p (highly...

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns WordlistLoader malware delivering Amatera Stealer via a ClearFake fake CAPTCHA ClickFix prompt

WordlistLoader malware delivering Amatera Stealer via a ClearFake fake CAPTCHA ClickFix prompt

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns

Do Son August 24, 2026

At a glance Malware family WordlistLoader (loader); Amatera Stealer / ACR Stealer (payload) Threat actor Amatera sold...

C2Looper: Rust Backdoor Uses GitHub for C2 Control C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper: Rust Backdoor Uses GitHub for C2 Control

Do Son August 24, 2026

At a glance Malware family C2Looper (Rust-based backdoor) Threat actor Suspected ransomware-related actor or initial access broker...

Manic Android Malware Steals Data Without Active Internet Manic Android malware utilizing offline mesh relay to steal data

Manic Android Malware Steals Data Without Active Internet

Do Son August 23, 2026

At a glance Factor Details Malware Family Manic Threat Actor Unknown organized criminal groups (Suspected) Targets Users...

Android Head Unit Malware Recruits Vehicles into Botnet Diagram illustrating Android head unit malware and the Android head unit malware botnet infection chain

Diagram illustrating Android head unit malware and the Android head unit malware botnet infection chain

Android Head Unit Malware Recruits Vehicles into Botnet

Do Son August 21, 2026

At a glance Factor Details Malware Family JarService dropper and zhima proxy module Threat Actor MoYu Group...

Projextor Malware Hides in Fake PDF and Recipe Apps Projextor Electron malware fake PDF converter and recipe apps diagram showing injected scripts and desktop capture

Projextor Electron malware fake PDF converter and recipe apps diagram showing injected scripts and desktop capture

Projextor Malware Hides in Fake PDF and Recipe Apps

Do Son August 21, 2026

At a glance Malware family Projextor (Electron-based) Threat actor Unknown; shared code base, no confirmed single operator...

Evooo1Bot Linux Botnet Employs SOCKS Relays and DDoS Evooo1Bot Linux botnet architecture and Evooo1Bot Linux botnet analysis diagram

Evooo1Bot Linux Botnet Employs SOCKS Relays and DDoS

Do Son August 20, 2026

At a glance Malware family: Evooo1Bot Threat actor: Unknown Target or victims: Internet-facing devices, routers, firewalls, and...

AmnesiaStealer macOS infostealer malware diagram detailing the new AmnesiaStealer macOS infostealer

AmnesiaStealer macOS Infostealer Hacks Apple Devices

Do Son August 19, 2026

Jamf Threat Labs researchers recently identified a fresh, multi-stage AmnesiaStealer macOS infostealer circulating online. Specifically, this malware...