Malware Archives • Page 5 of 125 • Daily CyberSecurity

Gafgyt Botnet Hijacks Langflow AI Servers for DDoS Attacks Gafgyt botnet Langflow DDoS attack infection chain diagram

Gafgyt Botnet Hijacks Langflow AI Servers for DDoS Attacks

Do Son July 22, 2026

At a Glance Malware family Gafgyt / BASHLITE variant (DDoS bot) Threat actor Unattributed; banner references handle...

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot framework cryptocurrency wallet theft infection chain diagram

OkoBot Framework Uses 20+ Modules to Steal Cryptocurrency Wallet Seed Phrases

Do Son July 22, 2026

At a Glance Malware family OkoBot framework (TookPS lineage; 20+ payloads and implants) Threat actor Unattributed; suspected...

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks

Do Son July 21, 2026

At a glance Malware family TELEPUZ Threat actor Unnamed; suspected solo developer or small team running a...

TuxBot v3 Evolution — an IoT Botnet Built With LLM Help TuxBot v3 Evolution IoT botnet C2 panel and cross-compilation build screen

TuxBot v3 Evolution — an IoT Botnet Built With LLM Help

Do Son July 21, 2026

At a glance Malware family TuxBot v3 Evolution (also tracked as Akiru) Threat actor Suspected link to...

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password

Do Son July 21, 2026

At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or...

LG Monitors Auto-Install Adware Through Windows Device Metadata LG monitor adware pop-up promoting McAfee on a Windows desktop via device metadata

LG monitor adware pop-up promoting McAfee on a Windows desktop via device metadata

LG Monitors Auto-Install Adware Through Windows Device Metadata

Do Son July 21, 2026

Owners of LG monitors recently discovered something unwelcome on their desktops. Their displays had silently triggered the...

HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars HOLLOWGRAPH malware using Microsoft Graph API abuse to hide command-and-control inside a Microsoft 365 calendar event dated 2050

HOLLOWGRAPH malware using Microsoft Graph API abuse to hide command-and-control inside a Microsoft 365 calendar event dated 2050

HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars

Do Son July 20, 2026

At a glance Malware family HOLLOWGRAPH, linked with high confidence to the Cavern backdoor framework Threat actor...

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords

Do Son July 20, 2026

At a Glance Field Detail Malware family CrashStealer (native C++ macOS infostealer) Threat actor Unattributed; part of...

LabubaRAT Poses as NVIDIA Software to Hand Operators Full Control of Windows Hosts Exploited VMware

LabubaRAT Poses as NVIDIA Software to Hand Operators Full Control of Windows Hosts

Do Son July 20, 2026

At a Glance Malware family LabubaRAT (previously undocumented) Threat actor Unattributed; no group named Targets Windows hosts;...

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins GoldPickaxe banking Trojan stealing biometric data and lock screen credentials from an Android phone

GoldPickaxe banking Trojan stealing biometric data and lock screen credentials from an Android phone

GoldPickaxe Banking Trojan Returns to Steal Faces and Bank Logins

Do Son July 17, 2026

At a glance Malware family GoldPickaxe (Android banking Trojan, GoldDigger suite) Threat actor GoldFactory (confirmed by Zimperium;...

RokRAT Malware Hides in Fake PDF Files to Spy on Academics APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

RokRAT Malware Hides in Fake PDF Files to Spy on Academics

Do Son July 17, 2026

At a glance Malware family RokRAT variant (x64) Threat actor Assessed highly likely APT37 (suspected, not confirmed)...

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users Fake GitHub repositories BoryptGrab infostealer attack chain diagram

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users

Do Son July 17, 2026

At a Glance Malware family BoryptGrab-lineage in-memory infostealer Threat actor Unattributed; financially motivated, likely Russian-speaking Targets Opportunistic...

Supply Chain Trojan Targets Software Developers Through Project Files Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Supply Chain Trojan Targets Software Developers Through Project Files

Do Son July 17, 2026

At a glance Malware family Multi-stage trojan (Doctor Web: Trojan.DownLoader49, BackDoor.Siggen2.5906, Trojan.BtcMine.3956) Threat actor Unknown; not attributed...

Albiriox Android Banking Trojan Spreads Through Fake UniCredit Rewards on Telegram Albiriox malware Android banking trojan spread via fake UniCredit banking rewards and Telegram bot

Albiriox malware Android banking trojan spread via fake UniCredit banking rewards and Telegram bot

Albiriox Android Banking Trojan Spreads Through Fake UniCredit Rewards on Telegram

Do Son July 16, 2026

At a Glance Malware family Albiriox (Android banking RAT, sold as Malware-as-a-Service), delivered by a UniCredit-branded dropper...

GigaWiper Backdoor Bundles Disk Wiping Malware and Fake Ransomware illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

illegal streaming networks complex criminal enterprises UAT-7290 China-nexus Espionage Adversarial Misuse of Generative AI

GigaWiper Backdoor Bundles Disk Wiping Malware and Fake Ransomware

Do Son July 16, 2026

At a glance Malware family GigaWiper (Golang backdoor; code ties to Crucio and FlockWiper) Threat actor Not...

Fake Braintree NuGet Package Skims Credit Cards and Steals Merchant API Keys Braintree NuGet typosquat credit card skimmer stealing payment data and merchant API keys

Braintree NuGet typosquat credit card skimmer stealing payment data and merchant API keys

Fake Braintree NuGet Package Skims Credit Cards and Steals Merchant API Keys

Do Son July 15, 2026

At a Glance Malware family Braintree.Net typosquat, a multi-stage .NET implant with a companion harvester (DependencyInjector.Core) Threat...

CrySome RAT Spread Through Fake Freight Rate Confirmation Phishing NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

CrySome RAT Spread Through Fake Freight Rate Confirmation Phishing

Do Son July 15, 2026

Malware family CrySome RAT, a .NET remote access trojan Threat actor Not named; no confirmed attribution Target...

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram

Do Son July 15, 2026

Malware family RedWing (Android spyware/RAT; suspected new variant of Oblivion) Threat actor Unnamed operators; suspected Russian-nexus, not...

GodDamn Ransomware Rebrands Beast and Uses a Malicious Signed Driver to Disable Defenses North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

GodDamn Ransomware Rebrands Beast and Uses a Malicious Signed Driver to Disable Defenses

Do Son July 15, 2026

At a Glance Malware family GodDamn ransomware (rebrand of Beast, formerly Monster) Threat actor Hyadina, a ransomware-as-a-service...

Node.js Backdoor Hides Its C2 on the TON Blockchain Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Node.js Backdoor Hides Its C2 on the TON Blockchain

Do Son July 15, 2026

At a glance Malware family Node.js backdoor (tracked as “TonRAT” by some researchers) Threat actor Unattributed; no...

Vidar Stealer Campaign Uses Factory-v3 Loader Diagram showing how a Vidar stealer campaign uses the Factory-v3 loader to infect systems.

Vidar Stealer Campaign Uses Factory-v3 Loader

Do Son July 13, 2026

In April 2026, security researchers uncovered a massive Vidar stealer campaign distributing data theft and cryptocurrency mining...

ScreenConnect AsyncRAT Campaign infrastructure and remote monitoring tools

ScreenConnect AsyncRAT Campaign Hides Inside Fake Freeware

Do Son July 13, 2026

At a Glance Malware Family: AsyncRAT Threat Actor: Unknown cybercriminals Target or Victims: Individual consumers and corporate...

Critical Alert 1 Active Exploit Detected Today