Malware Archives • Page 3 of 124 • Daily CyberSecurity

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors

Do Son July 27, 2026

A single crypter is now hiding malware for many unrelated criminal crews at once. Proofpoint researchers call...

NadMesh Botnet Targets AI Services and Cloud Environments NadMesh botnet targeting cloud systems and presenting an AI infrastructure threat.

NadMesh botnet targeting cloud systems and presenting an AI infrastructure threat.

NadMesh Botnet Targets AI Services and Cloud Environments

Do Son July 24, 2026

The NadMesh botnet recently emerged as a significant danger to modern cloud networks. Researchers observed this Go-based...

TAG-150 Attack Chain Deploys DenoRAT Malware Head Mare TrueConf attack PhantomCore backdoor diagram

TAG-150 Attack Chain Deploys DenoRAT Malware

Do Son July 24, 2026

A recent cyberattack targeted a financial institution using a ClickFix social engineering lure. This incident revealed an...

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains

Do Son July 24, 2026

At a glance Malware family ACR Stealer (infostealer; linked to a rebrand of Amatera Stealer) Threat actor...

GST Phishing Campaign Distributes Remcos RAT Malware DPRK IT Workers, APT38 Crypto Forfeiture

GST Phishing Campaign Distributes Remcos RAT Malware

Do Son July 23, 2026

Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase...

Spirals Ransomware Encrypts a South Asian IT Network in Under 24 Hours Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals Ransomware Encrypts a South Asian IT Network in Under 24 Hours

Do Son July 22, 2026

At a glance Malware family Spirals (new Rust-based ransomware, named by its operators) Threat actor Unknown. No...

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files

Do Son July 22, 2026

A global phishing campaign hides a low-detection Lua loader inside fake .ttf font files to drop Remcos,...

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor

Do Son July 22, 2026

At a Glance Actor or group Unnamed China-linked espionage group (per Symantec’s 2022 attribution) Activity type Suspected...

Gafgyt Botnet Hijacks Langflow AI Servers for DDoS Attacks Gafgyt botnet Langflow DDoS attack infection chain diagram

Gafgyt Botnet Hijacks Langflow AI Servers for DDoS Attacks

Do Son July 22, 2026

At a Glance Malware family Gafgyt / BASHLITE variant (DDoS bot) Threat actor Unattributed; banner references handle...

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases

Do Son July 22, 2026

At a Glance Malware family OkoBot framework (TookPS lineage; 20+ payloads and implants) Threat actor Unattributed; suspected...

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks

Do Son July 21, 2026

At a glance Malware family TELEPUZ Threat actor Unnamed; suspected solo developer or small team running a...

TuxBot v3 Evolution — an IoT Botnet Built With LLM Help TuxBot v3 Evolution IoT botnet C2 panel and cross-compilation build screen

TuxBot v3 Evolution — an IoT Botnet Built With LLM Help

Do Son July 21, 2026

At a glance Malware family TuxBot v3 Evolution (also tracked as Akiru) Threat actor Suspected link to...

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password

Do Son July 21, 2026

At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or...

LG Monitors Auto-Install Adware Through Windows Device Metadata LG monitor adware pop-up promoting McAfee on a Windows desktop via device metadata

LG monitor adware pop-up promoting McAfee on a Windows desktop via device metadata

LG Monitors Auto-Install Adware Through Windows Device Metadata

Do Son July 21, 2026

Owners of LG monitors recently discovered something unwelcome on their desktops. Their displays had silently triggered the...

HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars HOLLOWGRAPH malware using Microsoft Graph API abuse to hide command-and-control inside a Microsoft 365 calendar event dated 2050

HOLLOWGRAPH malware using Microsoft Graph API abuse to hide command-and-control inside a Microsoft 365 calendar event dated 2050

HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars

Do Son July 20, 2026

At a glance Malware family HOLLOWGRAPH, linked with high confidence to the Cavern backdoor framework Threat actor...

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords

Do Son July 20, 2026

At a Glance Field Detail Malware family CrashStealer (native C++ macOS infostealer) Threat actor Unattributed; part of...

LabubaRAT Poses as NVIDIA Software to Hand Operators Full Control of Windows Hosts Exploited VMware

LabubaRAT Poses as NVIDIA Software to Hand Operators Full Control of Windows Hosts

Do Son July 20, 2026

At a Glance Malware family LabubaRAT (previously undocumented) Threat actor Unattributed; no group named Targets Windows hosts;...

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins GoldPickaxe banking Trojan stealing biometric data and lock screen credentials from an Android phone

GoldPickaxe banking Trojan stealing biometric data and lock screen credentials from an Android phone

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins

Do Son July 17, 2026

At a glance Malware family GoldPickaxe (Android banking Trojan, GoldDigger suite) Threat actor GoldFactory (confirmed by Zimperium;...

RokRAT Malware Hides in Fake PDF Files to Spy on Academics APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

RokRAT Malware Hides in Fake PDF Files to Spy on Academics

Do Son July 17, 2026

At a glance Malware family RokRAT variant (x64) Threat actor Assessed highly likely APT37 (suspected, not confirmed)...

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users Fake GitHub repositories BoryptGrab infostealer attack chain diagram

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users

Do Son July 17, 2026

At a Glance Malware family BoryptGrab-lineage in-memory infostealer Threat actor Unattributed; financially motivated, likely Russian-speaking Targets Opportunistic...

Supply Chain Trojan Targets Software Developers Through Project Files Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Supply Chain Trojan Targets Software Developers Through Project Files

Do Son July 17, 2026

At a glance Malware family Multi-stage trojan (Doctor Web: Trojan.DownLoader49, BackDoor.Siggen2.5906, Trojan.BtcMine.3956) Threat actor Unknown; not attributed...

Albiriox Android Banking Trojan Spreads Through Fake UniCredit Rewards on Telegram Albiriox malware Android banking trojan spread via fake UniCredit banking rewards and Telegram bot

Albiriox malware Android banking trojan spread via fake UniCredit banking rewards and Telegram bot

Albiriox Android Banking Trojan Spreads Through Fake UniCredit Rewards on Telegram

Do Son July 16, 2026

At a Glance Malware family Albiriox (Android banking RAT, sold as Malware-as-a-Service), delivered by a UniCredit-branded dropper...

Critical Alert 6 Active Exploits Detected Today