Malware Archives • Page 4 of 124 • Daily CyberSecurity

GigaWiper Backdoor Bundles Disk Wiping Malware and Fake Ransomware illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

GigaWiper Backdoor Bundles Disk Wiping Malware and Fake Ransomware

Do Son July 16, 2026

At a glance Malware family GigaWiper (Golang backdoor; code ties to Crucio and FlockWiper) Threat actor Not...

Fake Braintree NuGet Package Skims Credit Cards and Steals Merchant API Keys Braintree NuGet typosquat credit card skimmer stealing payment data and merchant API keys

Braintree NuGet typosquat credit card skimmer stealing payment data and merchant API keys

Fake Braintree NuGet Package Skims Credit Cards and Steals Merchant API Keys

Do Son July 15, 2026

At a Glance Malware family Braintree.Net typosquat, a multi-stage .NET implant with a companion harvester (DependencyInjector.Core) Threat...

CrySome RAT Spread Through Fake Freight Rate Confirmation Phishing NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

CrySome RAT Spread Through Fake Freight Rate Confirmation Phishing

Do Son July 15, 2026

Malware family CrySome RAT, a .NET remote access trojan Threat actor Not named; no confirmed attribution Target...

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram

Do Son July 15, 2026

Malware family RedWing (Android spyware/RAT; suspected new variant of Oblivion) Threat actor Unnamed operators; suspected Russian-nexus, not...

GodDamn Ransomware Rebrands Beast and Uses a Malicious Signed Driver to Disable Defenses North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

GodDamn Ransomware Rebrands Beast and Uses a Malicious Signed Driver to Disable Defenses

Do Son July 15, 2026

At a Glance Malware family GodDamn ransomware (rebrand of Beast, formerly Monster) Threat actor Hyadina, a ransomware-as-a-service...

Node.js Backdoor Hides Its C2 on the TON Blockchain Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Node.js Backdoor Hides Its C2 on the TON Blockchain

Do Son July 15, 2026

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no...

Vidar Stealer Campaign Uses Factory-v3 Loader Diagram showing how a Vidar stealer campaign uses the Factory-v3 loader to infect systems.

Vidar Stealer Campaign Uses Factory-v3 Loader

Do Son July 13, 2026

In April 2026, security researchers uncovered a massive Vidar stealer campaign distributing data theft and cryptocurrency mining...

ScreenConnect AsyncRAT Campaign infrastructure and remote monitoring tools

ScreenConnect AsyncRAT Campaign Hides Inside Fake Freeware

Do Son July 13, 2026

At a Glance Malware Family: AsyncRAT Threat Actor: Unknown cybercriminals Target or Victims: Individual consumers and corporate...

Mycelium Framework: First AI-as-a-Service Botnet TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Mycelium Framework: First AI-as-a-Service Botnet

Do Son July 13, 2026

At a Glance Malware Family: Mycelium Framework Threat Actor: Unknown (suspected underground developer) Targets or Victims: Enterprise...

PamStealer macOS Malware Poses as Maccy to Steal Passwords PamStealer macOS malware delivering a Rust infostealer through a fake Maccy clipboard app

PamStealer macOS malware delivering a Rust infostealer through a fake Maccy clipboard app

PamStealer macOS Malware Poses as Maccy to Steal Passwords

Do Son July 10, 2026

Malware family PamStealer (Rust-based macOS infostealer) Threat actor Not attributed by Jamf Targets Apple Silicon Mac users;...

JADEPUFFER Marks the First AI-Driven Agentic Ransomware Attack JADEPUFFER agentic ransomware attack chain diagram from Langflow RCE to database extortion

JADEPUFFER agentic ransomware attack chain diagram from Langflow RCE to database extortion

JADEPUFFER Marks the First AI-Driven Agentic Ransomware Attack

Do Son July 10, 2026

At a Glance Malware family JADEPUFFER (agentic ransomware) Threat actor Unnamed operator; Sysdig assesses an autonomous AI...

Hidden LG Monitor Adware: Stop Unwanted Pop-ups Now LG monitor adware warning showing unwanted McAfee pop-ups and bloatware installation

Hidden LG Monitor Adware: Stop Unwanted Pop-ups Now

Do Son July 9, 2026

Hidden LG Monitor Adware Sparks Outrage Typically, intrusive pop-up advertisements originate from pre-installed adware or deliberately downloaded...

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging backdoor malicious Chrome extension PowerShell Windows infection chain diagram

Native Messaging Backdoor Turns a Chrome Extension Into a Windows Threat

Do Son July 8, 2026

At a Glance Malware type Native Messaging backdoor with a malicious Chrome extension Threat actor Unattributed Targets...

Veil#Drop Malware Uses Blogspot to Deliver PureLog Stealer China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

Veil#Drop Malware Uses Blogspot to Deliver PureLog Stealer

Do Son July 8, 2026

Malware family PureLog Stealer (delivered by the Veil#Drop framework) Threat actor Not attributed by Securonix Targets Windows...

RustDuck Botnet: A Two-Stage DDoS Threat Shifting From C to Rust RustDuck botnet two-stage DDoS malware loader core architecture analysis diagram

RustDuck botnet two-stage DDoS malware loader core architecture analysis diagram

RustDuck Botnet: A Two-Stage DDoS Threat Shifting From C to Rust

Do Son July 7, 2026

At a Glance Malware family RustDuck Threat actor Unattributed Targets / victims IoT devices, web apps, and...

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users

ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks

Do Son July 6, 2026

At a glance Details Malware family ValleyRAT (Remote Access Trojan) Threat actor Often linked to SilverFox; attribution...

Ousaban Banking Trojan Targets Spain and Portugal Ousaban banking trojan infection chain diagram showing malware delivery methods.

Ousaban Banking Trojan Targets Spain and Portugal

Do Son July 6, 2026

At a glance: Malware Family: Ousaban Threat Actor: Unknown (Suspected Latin American origin) Targets/Victims: Banking customers in...

Silent Swap Crypto Clipper Hides in Google Notes Extension Diagram showing the Silent Swap crypto clipper and Google Notes extension infection chain

Diagram showing the Silent Swap crypto clipper and Google Notes extension infection chain

Silent Swap Crypto Clipper Hides in Google Notes Extension

Do Son July 3, 2026

Unsigned software installers are distributing a dangerous new malware strain that quietly intercepts digital currency transactions. Security...

Glitch SPY Android RAT Spreads Through a Fake Polish Rental App Glitch SPY Android RAT distributed through a fake Polish rental app abusing Accessibility Service

Glitch SPY Android RAT distributed through a fake Polish rental app abusing Accessibility Service

Glitch SPY Android RAT Spreads Through a Fake Polish Rental App

Do Son July 3, 2026

At a glance Malware family Glitch SPY (Android RAT and builder platform) Threat actor Unattributed; operator unidentified...

Fake Perplexity AI Extension Hijacks Browser Search and Logs Keystrokes North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Fake Perplexity AI Extension Hijacks Browser Search and Logs Keystrokes

Do Son July 2, 2026

At a glance Malware Malicious browser extension / search hijacker (“Search for perplexity ai”) Threat actor Not...

TONResolver Malware Hides Its C2 in the TON Blockchain to Hit Hotel Partners TONResolver malware infection chain using a TON blockchain dead drop resolver against Booking.com hotel partners