Malware Archives • Page 4 of 129 • Daily CyberSecurity

CLOSEDQUORUM AI Malware Uses LLMs for Autonomous C2

Diagram of the autonomous CLOSEDQUORUM AI malware architecture showing how CLOSEDQUORUM AI malware queries language models

CLOSEDQUORUM AI Malware Uses LLMs for Autonomous C2

Do Son September 25, 2026

Cisco Talos discovered autonomous CLOSEDQUORUM AI malware. The CLOSEDQUORUM AI malware uses multiple LLMs to guide cyberattacks independently.

WordPress Must-Use Plugin Malware Uses EtherHiding Analysis of stealthy WordPress must-use plugin malware and WordPress must-use plugin malware architecture

Analysis of stealthy WordPress must-use plugin malware and WordPress must-use plugin malware architecture

WordPress Must-Use Plugin Malware Uses EtherHiding

Do Son September 25, 2026

Wordfence uncovered stealthy WordPress must-use plugin malware. Learn how this WordPress must-use plugin malware abuses EtherHiding to steal secrets.

New TASK#STOMP PowerShell Backdoor Targets Windows Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

New TASK#STOMP PowerShell Backdoor Targets Windows

Do Son September 24, 2026

Learn how the new TASK#STOMP PowerShell backdoor steals data. The TASK#STOMP PowerShell backdoor abuses native Windows tools for persistence.

Vidar Information Stealer Upgrades Evasion Tactics AutoIt-Delivering-Vidar-Stealer

Vidar Information Stealer Upgrades Evasion Tactics

Do Son September 23, 2026

Discover the latest Vidar information stealer obfuscation tactics. ThreatLabz reveals how the malware uses a virtual machine and custom stream ciphers.

MemTensor MemOS Compromise Exposes AI Developer Secrets Diagram showing the MemTensor MemOS compromise details and how the MemTensor MemOS compromise affects developers

Diagram showing the MemTensor MemOS compromise details and how the MemTensor MemOS compromise affects developers

MemTensor MemOS Compromise Exposes AI Developer Secrets

Do Son September 23, 2026

Discover the critical MemTensor MemOS compromise details. This MemTensor MemOS compromise targets AI developers via malicious npm and PyPI packages.

KRSID Ransomware Targets Private HTS Investment Platforms KRSID ransomware targeting private HTS malware victims

KRSID Ransomware Targets Private HTS Investment Platforms

Do Son September 23, 2026

Fraudulent investment groups are using the UBP Asset private HTS malware to distribute KRSID ransomware. Learn how to protect your trading accounts today.

MovieReaper Malware Spreads via Compromised Torrents The MovieReaper malware torrent attacks infection chain

MovieReaper Malware Spreads via Compromised Torrents

Do Son September 22, 2026

Learn how the MovieReaper malware compromises torrents. Experts warn that MovieReaper malware torrent attacks use Solana blockchain for command and control.

HEAVYGRAM Malware Abuses Telegram for Cyberespionage Diagram of Iranian HEAVYGRAM malware illustrating how HEAVYGRAM malware compromises endpoints

Diagram of Iranian HEAVYGRAM malware illustrating how HEAVYGRAM malware compromises endpoints

HEAVYGRAM Malware Abuses Telegram for Cyberespionage

Do Son September 22, 2026

Group-IB uncovered Iranian HEAVYGRAM malware campaigns. The HEAVYGRAM malware abuses Telegram channels for command execution and data theft.

LLM-Generated PhantomRaven Information Stealer Discovered Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

LLM-Generated PhantomRaven Information Stealer Discovered

Do Son September 21, 2026

Learn how the LLM-generated PhantomRaven information stealer targets developers. The PhantomRaven information stealer uses npm to hijack CI/CD secrets.

KREMLIN Banking Malware Targets Brazilian Banks Diagram of Brazilian KREMLIN banking malware showing how KREMLIN banking malware installs malicious browser extensions

Diagram of Brazilian KREMLIN banking malware showing how KREMLIN banking malware installs malicious browser extensions

KREMLIN Banking Malware Targets Brazilian Banks

Do Son September 21, 2026

Learn how Brazilian KREMLIN banking malware steals credentials using fake browser extensions. Elastic Security Labs details the KREMLIN banking malware.

Mantax Otax Android Malware: Spyware Meets Ransomware Mantax Otax Android malware infection screen

Mantax Otax Android Malware: Spyware Meets Ransomware

Do Son September 17, 2026

Zimperium zLabs discovered Mantax Otax Android malware, a fierce Indonesian mobile ransomware integrating spyware to hijack, record, and extort victims.

SloppyRAT Malware Analyzed in Ransomware Attacks Gryxa toolkit AI-built malware diagram showing RMM abuse and crypto credential theft across 324 hosts

Gryxa toolkit AI-built malware diagram showing RMM abuse and crypto credential theft across 324 hosts

SloppyRAT Malware Analyzed in Ransomware Attacks

Do Son September 16, 2026

Discover how the new SloppyRAT malware uses a ClickFix infection chain to establish remote access for ransomware attacks, evading detection.

Vwork Android Malware Clones Apps in Gigabud Attacks Vwork Android malware diagram showing the Gigabud Vwork Android malware attack chain

Vwork Android Malware Clones Apps in Gigabud Attacks

Do Son September 16, 2026

Group-IB uncovered how the Gigabud Vwork Android malware chain clones apps. Discover how Vwork Android malware evades bank detection.

Casbaneiro Banking Trojan Hits Latin American Banks Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Diagram of the Casbaneiro banking trojan and Casbaneiro banking trojan campaign architecture

Casbaneiro Banking Trojan Hits Latin American Banks

Do Son September 16, 2026

A new Casbaneiro banking trojan campaign hits Latin America. Learn how the Casbaneiro banking trojan evades detection and targets bank logins.

Cyclops Blink Malware Returns to Target Network Appliances Sophos CTU researchers discovered a new 64-bit Linux variant of the Cyclops Blink malware targeting Cisco FMC devices, featuring advanced network scanning.

Sophos CTU researchers discovered a new 64-bit Linux variant of the Cyclops Blink malware targeting Cisco FMC devices, featuring advanced network scanning.

Cyclops Blink Malware Returns to Target Network Appliances

Do Son September 14, 2026

Sophos CTU researchers discovered a new 64-bit Linux variant of the Cyclops Blink malware targeting Cisco FMC devices, featuring advanced network scanning.

PivotC2 FortiGate RAT Drives Firewall Compromises Diagram of the PivotC2 FortiGate RAT infection chain following CVE-2025-25249 exploitation

Diagram of the PivotC2 FortiGate RAT infection chain following CVE-2025-25249 exploitation

PivotC2 FortiGate RAT Drives Firewall Compromises

Do Son September 14, 2026

Discover how the PivotC2 FortiGate RAT uses CVE-2025-25249 exploitation to harvest credentials and tunnel traffic across corporate network environments.

Unit 42 Exposes OfferLoader Malware Campaign OfferLoader malware diagram showing the OfferLoader malware campaign infection flow

Unit 42 Exposes OfferLoader Malware Campaign

Do Son September 14, 2026

Unit 42 uncovered a large OfferLoader malware campaign distributing backdoors. Discover how OfferLoader malware abuses YouTube to compromise endpoints.

ClearFake WebDAV Infection Chain Targets Systems Globally Half-click exploits chain showing webmail zero-days used by TA488 and TA458 against Zimbra, SOGo and Roundcube mailservers

Half-click exploits chain showing webmail zero-days used by TA488 and TA458 against Zimbra, SOGo and Roundcube mailservers

ClearFake WebDAV Infection Chain Targets Systems Globally

Do Son September 11, 2026

A ClearFake WebDAV infection chain deployed Amatera malware. See how the ClearFake WebDAV infection chain drops crypto stealers on targets.

MacSync macOS Stealer Spreads via ClickFix Lures MacSync macOS stealer architecture and MacSync macOS stealer ClickFix lures diagram

MacSync macOS Stealer Spreads via ClickFix Lures

Do Son September 11, 2026

The MacSync macOS stealer targets Apple users worldwide. See how MacSync macOS stealer ClickFix lures evade Gatekeeper to steal sensitive credentials.

ClickFix Browser Attack Steals Crypto via Google Sheets ClickFix browser attack diagram showing Google Sheets C2 injecting a crypto web skimmer into Chrome

ClickFix browser attack diagram showing Google Sheets C2 injecting a crypto web skimmer into Chrome

ClickFix Browser Attack Steals Crypto via Google Sheets

Do Son September 9, 2026

A ClickFix browser attack uses Google Sheets C2 to inject a crypto web skimmer into Chrome. See how Cisco Talos traced the theft.

Redis Cryptomining Botnet Hijacks 3,562 Servers for Monero Liquid Network hack diagram showing Bitcoin transfer and white hat bounty negotiation

Liquid Network hack diagram showing Bitcoin transfer and white hat bounty negotiation

Redis Cryptomining Botnet Hijacks 3,562 Servers for Monero

Do Son September 9, 2026

A Redis cryptomining botnet used a rogue replication attack to hijack 3,562 servers for Monero mining. See how the campaign worked.

Pegasus Spyware Hits Serbian Student Activist via Zero-Click iMessage Pegasus spyware zero-click iMessage infection on a Serbian student activist iPhone, part of the largest documented surveillance wave in Serbia

Pegasus spyware zero-click iMessage infection on a Serbian student activist iPhone, part of the largest documented surveillance wave in Serbia

Pegasus Spyware Hits Serbian Student Activist via Zero-Click iMessage

Do Son September 8, 2026

Pegasus spyware infected a Serbian activist through a zero-click iMessage exploit, part of Serbia's largest spyware wave. Update iOS now.