Do Son XWorm V6.0 has resurfaced with 35+ plugins, including ransomware functionality. The modular RAT uses stealth injection and obfuscated PowerShell to bypass AMSI.
Malware
The Cavalry Werewolf APT is using FoalShell reverse shells and StallionRAT backdoors, controlled via Telegram, to target Russian state agencies and energy/mining firms.
WARMCOOKIE has resurfaced post-Operation Endgame with new execution handlers, a MaaS model, and evasive techniques like disguised scheduled tasks using company names.
Rhadamanthys stealer's v0.9.2 update adds new anti-analysis checks, a custom executable format, and uses noisy PNG files for payload delivery to bypass security tools.
The malicious PyPI package SoopSocks masqueraded as a SOCKS5 proxy but secretly installed a Go-based backdoor with SYSTEM privileges, leaking system data to a Discord webhook.
Cleafy uncovers Klopatra, a new Android RAT using commercial Virbox obfuscation and native code to target banks in Spain/Italy, allowing invisible remote device control.Export to Sheets
The Datzbro Android Trojan is targeting seniors via fake Facebook groups and AI content. The hybrid malware can remotely control devices and steal banking credentials.
NCSC exposes RayInitiator, a bootkit for Cisco ASA 5500-X devices without Secure Boot, which deploys the LINE VIPER shellcode loader for persistent and stealthy attacks.
The new infostealer Acreed is rapidly gaining market share post-Lumma takedown. It uses BNB Smart Chain and Steam profiles for C2, with a focus on crypto theft.
Olymp Loader, a new assembly-based MaaS, has emerged in underground markets. It's a turnkey solution for cybercriminals, with stealth and persistence features.
The TamperedChef malware campaign uses trojanized apps and digitally signed binaries to steal browser data. Attackers use SEO poisoning to trick users into downloading.
A phishing campaign is impersonating Ukrainian police via malicious SVG files to deliver Amatera Stealer and PureMiner, a stealthy cryptominer, to victims.
Akira ransomware is exploiting stolen SonicWall VPN credentials, even with MFA enabled, to gain access and deploy its payload within as little as 55 minutes.
Huntress details a multi-stage attack that uses DLL sideloading and obfuscated Python to deliver PureRAT, a commercial-grade remote access trojan linked to PXA Stealer.
A new XCSSET variant targets macOS developers by infecting Xcode projects. It now steals Firefox data, hijacks clipboards for crypto theft, and enhances its persistence.
A new Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and enterprise apps. The Loader-as-a-Service model saw a 230% spike this summer.
Russia-linked APT COLDRIVER is using a new multi-stage malware campaign (BAITSWITCH/SIMPLEFIX) with a ClickFix lure to target journalists and activists for espionage.
LockBit 5.0 resurfaces with advanced Windows, Linux, and ESXi variants, boasting heavy obfuscation and anti-forensic techniques, making it more dangerous than ever.
Malicious Rust crates, downloaded 8,400+ times, were found to be typosquatting legitimate libraries to scan source code and steal Solana and Ethereum private keys.
GTIG reveals BRICKSTORM, a stealthy Go backdoor linked to China-nexus UNC5221, targeting US legal/SaaS firms to steal IP and establish long-term espionage access.
The Lone None group uses fake copyright notices to deliver a new stealer malware that focuses on crypto theft via clipboard replacement and utilizes Telegram for C2.
A new campaign uses a malicious LNK shortcut sent via Discord to deploy a multi-functional RAT that hijacks legitimate Windows binaries to evade detection.