Do Son Beware of fake Binance ads! This multi-stage malware campaign uses Facebook to trick crypto users, stealing credentials and sensitive data. Stay safe with our tips.
Malware
New infrastructure linked to Israeli spyware firm Candiru has been uncovered, exposing active surveillance clusters in Hungary and Saudi Arabia, with malware targeting Windows devices.
CERT-UA uncovers a new UAC-0099 campaign targeting Ukraine's defense sector. The group uses a toolkit of MATCHBOIL, MATCHWOK, and DRAGSTARE malware for reconnaissance and data exfiltration.
McAfee uncovers a new Android malware campaign targeting Indian users. The malware impersonates major banks to steal financial data and silently mines Monero in the background.
Cleafy uncovers PlayPraetor, a Chinese-speaking MaaS Android RAT that has infected 11,000+ devices, using real-time control via Accessibility Services to conduct on-device fraud.
SentinelLABS and Beazley expose PXA Stealer, a Python-based infostealer campaign targeting 62 countries with stealthy DLL sideloading, decoy files, and Telegram-based data exfiltration.
ThreatLabz reveals the evolution of Raspberry Robin malware, now featuring stronger encryption, complex obfuscation, and a new privilege escalation exploit to bypass detection.
APT37, a North Korea-linked group, is using a new RoKRAT backdoor to target South Korea. The malware uses stealthy LNK files and steganography to evade detection.
eSentire exposes Interlock, a new ransomware group using multi-stage payloads and the ClickFix social engineering technique to deploy ransomware and backdoors via compromised websites.
Gen Digital has released a free decryptor for FunkSec ransomware, allowing victims to recover files. The group appears dormant, with no new victims since March 2025.
Sophos uncovers a new infection chain for GOLD BLADE's RedLoader malware, combining LNK files, WebDAV, and DLL sideloading to bypass defenses and deploy payloads stealthily.
Elastic Security Labs exposes NOVABLIGHT, a NodeJS-based infostealer-botnet MaaS disguised as an "educational tool," actively distributed via Telegram and targeting victims with fake game installers.
Trend Micro reports Gunra ransomware has expanded to Linux, employing 100 parallel encryption threads, partial encryption, and stealthy keystore methods to target global enterprises.
Trellix uncovers 0bj3ctivityStealer, a sophisticated info-stealer using phishing, custom PowerShell, and steganography to evade detection and exfiltrate sensitive data.
Cyfirma reveals Raven Stealer, a new, lightweight MaaS infostealer built in Delphi/C++, using reflective process hollowing and Telegram bots for stealthy data exfiltration from browsers.
Cyble uncovers RedHook, a new Android banking trojan targeting Vietnamese users with sophisticated phishing, remote access, screen capture, and keylogging for full device takeover.
Netskope uncovers XWorm 6.0, a new variant using VBScript droppers, AMSI bypass, and critical process marking to evade detection and force system reboots if terminated.
A new stealthy campaign uses Windows LNK files to deploy the REMCOS backdoor via multi-stage PowerShell commands, bypassing antivirus and gaining full system control.
eSentire unveils Cyber Stealer, a new infostealer-botnet hybrid offered as a service, fusing data theft, remote control, crypto mining, and DDoS attacks into one scalable toolkit.
Hybrid Analysis reveals SHUYAL, a new stealthy infostealer that harvests browser credentials, system data, and screenshots, exfiltrating it all via a Telegram bot.
Cisco Talos reveals "Chaos," a new RaaS operation likely formed by former BlackSuit members, using vishing and Quick Assist to conduct big-game hunting and double extortion campaigns.
Aqua Security's Nautilus team discovered Koske, an advanced Linux cryptojacker likely crafted by AI, hiding in panda images and using rootkits for stealthy operations.