Do Son A new report reveals Maranhão Stealer, a new malware targeting the gaming community through pirated software and cheats. It steals crypto, credentials, and data.
Malware
A new ransomware group, Yurei, is using open-source malware to attack businesses in Asia and Africa. The group is using a double-extortion model to pressure victims.
IBM X-Force reveals new findings on Hive0154, a China-aligned threat actor using an upgraded Toneshell backdoor and a new USB worm to target organizations.
Trend Micro reveals a new global malware campaign, EvilAI, that impersonates productivity and AI tools to infiltrate organizations and steal data.
A new Go-based remote access trojan, ZynorRAT, is targeting Linux and Windows. Its unique command and control is managed entirely through a Telegram bot.
Apple has issued new spyware alerts to French officials, journalists, and activists. These warnings are often tied to highly sophisticated, zero-click attacks.
A new report reveals a Chinese APT group compromised a Philippine military company with a fileless malware framework called EggStreme, which uses DLL sideloading for stealth.
AhnLab has uncovered BlackNevas, a new ransomware group with strong encryption. The group is attacking businesses and critical infrastructure across the globe.
A new report reveals a ToneShell backdoor from Mustang Panda. The malware targets Myanmar and uses anti-analysis tricks to evade detection.
Zscaler has uncovered kkRAT, a new malware targeting Chinese-speaking users. The RAT steals crypto, hijacks clipboards, and uses RMM tools for covert, long-term control.
A new report reveals CyberVolk ransomware, a pro-Russian strain that encrypts data with an unrecoverable flaw. Its decryption key is useless, making recovery impossible.
A new macOS backdoor, ChillyHell, bypassed Apple's notarization process for years, remaining undetected while being used for espionage and brute-force attacks.
A new malicious Chrome extension, "Madgicx Plus," is targeting Meta advertisers. It promises AI ad optimization but hijacks accounts and steals credentials.
A new Linux botnet, Luno, combines cryptomining and modular DDoS attacks. It's a "self-healing" threat that targets gaming platforms and disguises itself as legitimate processes.
A new report reveals GONEPOSTAL, a backdoor by Russia's APT28 that hides in Outlook macros and uses email itself as a covert command-and-control channel for espionage.
A new malware strain is targeting exposed Docker APIs, evolving from a cryptominer into a stealthy botnet that blocks ports to "own" a victim's system for exclusive use.
A new report reveals North Korea's APT37 is using Rust-based malware called Rustonotto, marking a shift toward modern languages and multi-platform attacks.
A new Android banking trojan, RatOn, merges overlay fraud with NFC relay attacks, automated money transfers, and crypto wallet theft, posing a new threat to users.
A new phishing campaign is spreading MostereRAT, a sophisticated RAT that uses a Chinese scripting language and advanced evasion to bypass antivirus and EDR solutions.
Salat Stealer, a new Go-based MaaS, is hijacking browsers and crypto wallets. The malware is sold by Russian-speaking operators on the dark web.
A new report reveals a supply chain attack on Ethereum. Four malicious npm packages impersonating Flashbots were used to steal private keys and mnemonic seeds from developers.
A new report reveals TAG-150, a sophisticated new threat actor with evolving malware and a resilient multi-tiered infrastructure, including a new RAT called CastleRAT.