Malware Archives • Page 4 of 125 • Daily CyberSecurity

GenieLocker Ransomware Targets Russian Manufacturers on Windows, Linux, and ESXi GenieLocker ransomware by Toy Ghouls targeting Russian manufacturing on Windows Linux ESXi

GenieLocker ransomware by Toy Ghouls targeting Russian manufacturing on Windows Linux ESXi

GenieLocker Ransomware Targets Russian Manufacturers on Windows, Linux, and ESXi

Do Son August 5, 2026

At a glance Field Detail Malware family GenieLocker (PE builds for Windows; ELF builds for Linux and...

npm Supply Chain Attack Hijacks Keyv and Spreads Shai-Hulud Malware npm supply chain attack on keyv and cacheable packages spreading Shai-Hulud malware credential stealer to CI/CD pipelines

npm supply chain attack on keyv and cacheable packages spreading Shai-Hulud malware credential stealer to CI/CD pipelines

npm Supply Chain Attack Hijacks Keyv and Spreads Shai-Hulud Malware

Do Son August 4, 2026

At a glance Malware family Shai-Hulud variant (“Mini Shai-Hulud”) Threat actor Unattributed; linked to the Shai-Hulud lineage...

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays

Do Son August 4, 2026

At a glance Malware family Dysphoria (jackskid/fbot-derived IoT botnet) Threat actor Unattributed; run as a commercial DDoS-for-hire...

npm supply chain attack delivering a cross-platform RAT via malicious npm packages targeting Alibaba developers

npm Supply Chain Attack Delivers a Cross-Platform RAT to Alibaba Developers

Do Son August 3, 2026

At a glance Malware family Unnamed cross-platform RAT (final payload “aone-cli”) Threat actor Unattributed; suspected Chinese-speaking actor...

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices

Do Son August 3, 2026

At a glance Malware family Tengu (Mirai-derived IoT botnet) Threat actor Unattributed; no operator named Target Internet-facing...

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers

Do Son August 3, 2026

At a glance Malware family CastleLoader (loader); payloads include CastleStealer, NetSupport RAT, Lobshot, and NeedleStealer Threat actor...

SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks SonicWall SMA exploit chain diagram showing wsproxy bypass leading to INC Ransomware root access

SonicWall SMA exploit chain diagram showing wsproxy bypass leading to INC Ransomware root access

SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks

Do Son August 3, 2026

Malware family ROOTRUN, KNUCKLEBALL, Suo5, ORANGETAIL Threat actor UTA0533 (pre-disclosure cluster, suspected link to INC Ransomware); INC...

Copybara Android RAT Spreads Through N26 Vishing Scam in Italy Copybara Android RAT delivered through N26 vishing and Fake Control 1.0 phishing panel

Copybara Android RAT delivered through N26 vishing and Fake Control 1.0 phishing panel

Copybara Android RAT Spreads Through N26 Vishing Scam in Italy

Do Son July 30, 2026

At a glance Malware family Copybara (Android RAT) Operators Not attributed; kit uses Portuguese-language identifiers Targets N26...

TrickBot Variant Hides C2 Traffic Inside Malformed DNS Queries FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

TrickBot Variant Hides C2 Traffic Inside Malformed DNS Queries

Do Son July 29, 2026

At a Glance Malware family TrickBot (modular Windows banking trojan and loader) Threat actor Not attributed by...

Lampion Malware Campaign Targets Portugal With Fake Payment Receipts C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

Lampion Malware Campaign Targets Portugal With Fake Payment Receipts

Do Son July 29, 2026

At a Glance Malware family Lampion, a Brazilian banking trojan from the ChePro lineage Threat actor No...

Chaos Ransomware Uses msaRAT to Hide C2 Traffic Inside Chrome msaRAT malware used by the Chaos ransomware group to route C2 traffic through a headless Chrome browser session

msaRAT malware used by the Chaos ransomware group to route C2 traffic through a headless Chrome browser session

Chaos Ransomware Uses msaRAT to Hide C2 Traffic Inside Chrome

Do Son July 29, 2026

At a glance Malware family msaRAT, a Rust remote access trojan Threat actor Chaos ransomware group (confirmed...

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads

Do Son July 27, 2026

Attackers are hiding malware inside fake game and software installers. Malwarebytes Labs calls the threat RenPy Loader....

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors

Do Son July 27, 2026

A single crypter is now hiding malware for many unrelated criminal crews at once. Proofpoint researchers call...

NadMesh Botnet Targets AI Services and Cloud Environments NadMesh botnet targeting cloud systems and presenting an AI infrastructure threat.

NadMesh botnet targeting cloud systems and presenting an AI infrastructure threat.

NadMesh Botnet Targets AI Services and Cloud Environments

Do Son July 24, 2026

The NadMesh botnet recently emerged as a significant danger to modern cloud networks. Researchers observed this Go-based...

TAG-150 Attack Chain Deploys DenoRAT Malware Head Mare TrueConf attack PhantomCore backdoor diagram

TAG-150 Attack Chain Deploys DenoRAT Malware

Do Son July 24, 2026

A recent cyberattack targeted a financial institution using a ClickFix social engineering lure. This incident revealed an...

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains

Do Son July 24, 2026

At a glance Malware family ACR Stealer (infostealer; linked to a rebrand of Amatera Stealer) Threat actor...

GST Phishing Campaign Distributes Remcos RAT Malware DPRK IT Workers, APT38 Crypto Forfeiture

GST Phishing Campaign Distributes Remcos RAT Malware

Do Son July 23, 2026

Seqrite Labs recently identified a malware distribution campaign that abused the credibility of government institutions to increase...

Spirals Ransomware Encrypts a South Asian IT Network in Under 24 Hours Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals Ransomware Encrypts a South Asian IT Network in Under 24 Hours

Do Son July 22, 2026

At a glance Malware family Spirals (new Rust-based ransomware, named by its operators) Threat actor Unknown. No...

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files FSB Center 16 targeting vulnerable routers across critical infrastructure via weak SNMP

TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files

Do Son July 22, 2026

A global phishing campaign hides a low-detection Lua loader inside fake .ttf font files to drop Remcos,...

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor

Do Son July 22, 2026

At a Glance Actor or group Unnamed China-linked espionage group (per Symantec’s 2022 attribution) Activity type Suspected...

Gafgyt Botnet Hijacks Langflow AI Servers for DDoS Attacks Gafgyt botnet Langflow DDoS attack infection chain diagram

Gafgyt Botnet Hijacks Langflow AI Servers for DDoS Attacks

Do Son July 22, 2026

At a Glance Malware family Gafgyt / BASHLITE variant (DDoS bot) Threat actor Unattributed; banner references handle...

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases

Do Son July 22, 2026

At a Glance Malware family OkoBot framework (TookPS lineage; 20+ payloads and implants) Threat actor Unattributed; suspected...