Malware

AI Agent Attack Turns One Exposed Endpoint Into a Full Server Takeover in Under 24 Hours

• Malware

AI Agent Attack Turns One Exposed Endpoint Into a Full Server Takeover in Under 24 Hours

Do Son October 13, 2026 0

ReliaQuest details an AI agent attack that used one exposed endpoint and the Cairn platform to achieve a full server takeover in under 24 hours.

Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data

• Malware

Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data

Do Son October 12, 2026 0

Warden Stealer, a fast-growing Rust infostealer, steals AI agent tokens, browser data, and crypto while bundling its own loader and clipper.

16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases

• Malware

16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases

Do Son October 9, 2026 0

Socket found 16 malicious Firefox extensions posing as Rabby and OKX. These crypto wallet stealers grabbed seed phrases. Here is what to do.

The Silent Threat of Midnight Mimosa Malware

• Malware

The Silent Threat of Midnight Mimosa Malware

Do Son October 9, 2026 0

Discover the Midnight Mimosa malware threatening cheap Android devices. Read the Bitdefender report on how OEMs pre-install this dangerous cybersecurity threat.

Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients

• Malware

Phishing Campaign Abuses Microsoft Power BI to Install Rogue ScreenConnect Clients

Do Son October 9, 2026 0

A Power BI phishing campaign uses Microsoft's real domain to install rogue ScreenConnect clients. Learn how it works and how to block it.

Rogue AI Agents Hijacked urlquery Scan Browsers to Reach Russian Bankruptcy Records

• Malware

Rogue AI Agents Hijacked urlquery Scan Browsers to Reach Russian Bankruptcy Records

Do Son October 8, 2026 0

Rogue AI agents abused the urlquery remote browser and VNC to chase Russian bankruptcy data. See how the swarm escaped its sandbox limits.

Four Attacker Clusters Exploit Citrix NetScaler Flaw CVE-2026-88771 to Plant Web Shells

• Malware

Four Attacker Clusters Exploit Citrix NetScaler Flaw CVE-2026-88771 to Plant Web Shells

Do Son October 7, 2026 0

eSentire tracks four clusters behind CVE-2026-88771 exploitation, planting NetScaler web shells and backdoor accounts. Learn how to detect them.

ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes

• Malware

ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes

Do Son October 6, 2026 0

The ClingSTUN backdoor hijacks unpatched IoT devices and hides in traffic to public STUN servers. Learn how it spreads and how to stop it.

Moroccan Intelligence Deploys Vast Surveillance Panopticon

• Malware

Moroccan Intelligence Deploys Vast Surveillance Panopticon

Do Son October 5, 2026 0

Amnesty reveals a massive Moroccan DGST surveillance network utilizing Pegasus spyware and physical espionage to target journalists and activists.

DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel

• Malware

DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel

Do Son October 5, 2026 0

A new DragonForce backdoor hides in Microsoft Teams TURN relays and falls back to MQTT. See how it works and how defenders can spot it.

New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes

• Malware

New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes

Do Son October 5, 2026 0

2CLoader malware dodges sandboxes and security tools to deliver Vidar and Remus infostealers. See how it works and how to detect it.

BPFDoor Backdoor and New AVERAT Implant Hide in SMTP Traffic on Telecom Edge Devices

• Malware

BPFDoor Backdoor and New AVERAT Implant Hide in SMTP Traffic on Telecom Edge Devices

Do Son October 5, 2026 0

A new BPFDoor backdoor variant and the AVERAT implant hide on telecom edge devices by posing as mail traffic. See how they work and how to hunt them.

Socket Links Popular VS Code Color Themes to the GlassWorm Supply Chain Campaign

• Malware

Socket Links Popular VS Code Color Themes to the GlassWorm Supply Chain Campaign

Do Son October 5, 2026 0

Socket links GlassWorm VS Code themes to malicious VS Code extensions with 8,000+ installs, including a Coca-Cola theme. See how to check yours.

UAT-11587 Targets Asian Governments With Antino Backdoor

• Malware

UAT-11587 Targets Asian Governments With Antino Backdoor

Do Son October 2, 2026 0

UAT-11587 Antino backdoor attacks hit Asian targets. Cisco Talos reveals how the Antino backdoor abuses Microsoft 365 for cyberespionage.

PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot

• Malware

PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot

Do Son October 1, 2026 0

Attackers used a PaperCut zero-day to plant a web shell and an AdaptixC2 implant hidden in fake Microsoft Copilot, then took over Active Directory.

Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions

• Malware

Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions

Do Son October 1, 2026 0

Microsoft details NeedyMantis malware, a modular backdoor that uses DLL sideloading to keep long-term access in telecom, academic, and government networks.

New MacSync macOS Infostealer Targets Crypto Wallets

• Malware

New MacSync macOS Infostealer Targets Crypto Wallets

Do Son September 29, 2026 0

A new MacSync macOS infostealer spreads via fake apps. Learn how the MacSync macOS infostealer abuses iCloud to compromise Apple systems.

SectopRAT Malware Variant Hidden in Legitimate Software

• Malware

SectopRAT Malware Variant Hidden in Legitimate Software

Do Son September 29, 2026 0

A new SectopRAT malware variant hides inside legitimate audio software. Learn how SectopRAT malware extracts data and controls devices.

Android Toll Fraud Malware Found on Google Play

• Malware

Android Toll Fraud Malware Found on Google Play

Do Son September 29, 2026 0

Security teams uncovered Google Play Android toll fraud malware. Learn how this Android toll fraud malware abuses fake ads to bill victims.

PamStealer macOS Malware Spreads via Fake Wavel Crypto App

• Malware

PamStealer macOS Malware Spreads via Fake Wavel Crypto App

Do Son September 28, 2026 0

A new PamStealer macOS infostealer spreads via fake Wavel apps. Learn how the PamStealer macOS infostealer steals system passwords and browser data.

RemControl Android Banking Trojan Steals Bank PINs

• Malware

RemControl Android Banking Trojan Steals Bank PINs

Do Son September 28, 2026 0

Group-IB found the RemControl Android banking trojan, a new malware using AI phishing overlays and fake TVTap apps to steal banking PINs and credentials.

Malicious Terraform Providers Spread Graphalgo Go Malware

• Malware

Malicious Terraform Providers Spread Graphalgo Go Malware

Do Son September 25, 2026 0

Learn how to detect malicious Terraform providers. New malicious Terraform providers spread Graphalgo Go malware through typosquatted packages.