Malware Archives • Page 5 of 129 • Daily CyberSecurity

Node.js Malware Attacks Target Tech and Finance Sectors

Node.js malware attacks diagram showing Node.js malware execution flow

Node.js Malware Attacks Target Tech and Finance Sectors

Do Son September 8, 2026

Recent Node.js malware attacks target global firms. Attackers deploy Node.js malware using trusted runtimes and smart contracts to evade detection.

Python NodeStealer Adds Keylogging and Screen Capture Spyware Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer Adds Keylogging and Screen Capture Spyware

Do Son September 8, 2026

Python NodeStealer now adds keylogging, clipboard, and screenshot spyware plus dual Telegram C2. See how the NodeStealer spyware upgrade works.

Packagist Themes iOS Spyware Steals Crypto Wallet Seeds Trojanized streaming site causing Packagist themes iOS spyware infections

Packagist Themes iOS Spyware Steals Crypto Wallet Seeds

Do Son September 7, 2026

Researchers discovered malicious Packagist themes iOS spyware infecting unpatched iPhones. This spyware targets crypto wallets and steals device data.

PHP Web Server Rootkit Targets F5 BIG-IP Devices Linux PHP web server rootkit architecture and PHP web server rootkit memory injection flow

PHP Web Server Rootkit Targets F5 BIG-IP Devices

Do Son September 7, 2026

A Linux PHP web server rootkit targets BIG-IP systems. Learn how this PHP web server rootkit injects in-memory shells into Apache processes.

StreamRat Banking Trojan Targets Spanish Android Users StreamRat banking trojan campaign fake Meta advertisement targeting Android devices

StreamRat banking trojan campaign fake Meta advertisement targeting Android devices

StreamRat Banking Trojan Targets Spanish Android Users

Do Son September 7, 2026

A StreamRat banking trojan campaign uses fake Meta TV-streaming ads to infect Android users. The StreamRat banking trojan enables full device takeover.

Silver Fox Fake Software Installers Disable Windows Defender Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Silver Fox Fake Software Installers Disable Windows Defender

Do Son September 7, 2026

Silver Fox fake software installers impersonate Razer and Edge to disable Windows Defender and deploy malware. See how the campaign works.

The Gentlemen Ransomware Deploys in Under 24 Hours The Gentlemen ransomware attack chain showing GOLD SHERWOOD affiliates using GentleKiller EDR killer and Rclone data exfiltration

The Gentlemen ransomware attack chain showing GOLD SHERWOOD affiliates using GentleKiller EDR killer and Rclone data exfiltration

The Gentlemen Ransomware Deploys in Under 24 Hours

Do Son September 4, 2026

The Gentlemen ransomware, run by GOLD SHERWOOD, encrypts networks in under 24 hours. See the affiliate playbook and how to defend against it.

Microsoft Warns of TerminalFix Campaign Deploying Reverse Tunnels Half-click exploits chain showing webmail zero-days used by TA488 and TA458 against Zimbra, SOGo and Roundcube mailservers

Half-click exploits chain showing webmail zero-days used by TA488 and TA458 against Zimbra, SOGo and Roundcube mailservers

Microsoft Warns of TerminalFix Campaign Deploying Reverse Tunnels

Do Son September 3, 2026

A new TerminalFix campaign uses fake CAPTCHAs to breach systems. Explore the TerminalFix attack chain and its covert reverse tunnel.

Sality Botnet Disrupted After Two Decades in Global Takedown Sality botnet disruption diagram showing a peer-to-peer sinkhole isolating infected machines from the operator

Sality botnet disruption diagram showing a peer-to-peer sinkhole isolating infected machines from the operator

Sality Botnet Disrupted After Two Decades in Global Takedown

Do Son September 2, 2026

Europol and CrowdStrike disrupted the Sality botnet, a 20-year P2P network, using a peer-to-peer sinkhole to cut its operator off from infected machines.

Malicious Browser Extensions Drain Crypto Wallets Malicious browser extensions crypto wallet drainer campaign diagram from Socket Threat Research

Malicious browser extensions crypto wallet drainer campaign diagram from Socket Threat Research

Malicious Browser Extensions Drain Crypto Wallets

Do Son September 2, 2026

Socket found 19 malicious browser extensions acting as a crypto wallet drainer across Chrome and Edge, exposing up to 80,000 users in one case.

PackClient RAT: New C2 Framework Sold on Telegram ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

PackClient RAT: New C2 Framework Sold on Telegram

Do Son September 2, 2026

Proofpoint found the PackClient RAT sold on Telegram and used by Chinese-speaking TA4922 malware operators in tax-themed phishing attacks.

Amatera Password Stealer Abuses Service Workers and Smart Contracts Amatera password stealer campaign attack chain diagram and Amatera password stealer workflow

Amatera password stealer campaign attack chain diagram and Amatera password stealer workflow

Amatera Password Stealer Abuses Service Workers and Smart Contracts

Do Son September 2, 2026

A new Amatera password stealer campaign abuses WordPress and EtherHiding. Learn how this Amatera password stealer infects browsers.

Miraak Post Exploitation Framework Adopts Database C2 Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

Diagram showing how prompt injection attacks and prompt injection techniques threaten AI security.

Miraak Post Exploitation Framework Adopts Database C2

Do Son September 1, 2026

The novel Miraak post exploitation framework uses PostgreSQL databases for stealthy C2 operations. Discover how this modular malware avoids HTTP beacons.

ToxNetV2 Botnet Integrates AI ToxNetV2 botnet infrastructure diagram highlighting AI integration

ToxNetV2 Botnet Integrates AI

Do Son August 31, 2026

Discover how the sophisticated ToxNetV2 botnet utilizes the GLM-5.2 AI model to analyze infected systems and generate actionable malicious commands.

Anthropic Issues Claude Security Warnings A conceptual illustration of malware stealing session tokens from a Claude user account

Anthropic Issues Claude Security Warnings

Do Son August 31, 2026

Anthropic is sending security warnings and deleting payment methods as info-stealing malware compromises Claude user sessions. Protect your account now.

ToxicPanda 2.0 Banking Trojan Attacks Escalate Globally Diagram showing how the ToxicPanda 2.0 banking Trojan attacks victims using the updated ToxicPanda 2.0 banking Trojan

Diagram showing how the ToxicPanda 2.0 banking Trojan attacks victims using the updated ToxicPanda 2.0 banking Trojan

ToxicPanda 2.0 Banking Trojan Attacks Escalate Globally

Do Son August 31, 2026

The new ToxicPanda 2.0 banking Trojan attacks target hundreds of financial apps globally. Learn how this ToxicPanda 2.0 banking Trojan steals credentials.

NPM Typosquatting Malware Targets WSL Developers Diagram showing npm typosquatting malware and the npm typosquatting malware campaign infection chain

Diagram showing npm typosquatting malware and the npm typosquatting malware campaign infection chain

NPM Typosquatting Malware Targets WSL Developers

Do Son August 31, 2026

A new npm typosquatting malware campaign targets WSL environments to steal crypto wallets. Learn how this npm typosquatting malware infects systems.

Aurora Ransomware Targets VMware ESXi and Abuses Cursor Agent Aurora ransomware infection chain and Aurora ransomware ESXi attack architecture

Aurora ransomware infection chain and Aurora ransomware ESXi attack architecture

Aurora Ransomware Targets VMware ESXi and Abuses Cursor Agent

Do Son August 30, 2026

The Aurora ransomware group targets VMware ESXi systems. Discover how the Aurora ransomware ESXi campaign abuses Cursor Agent for hands-on attacks.

SynkLoader Malware Deploys Multi-Language Attack Tools C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

SynkLoader Malware Deploys Multi-Language Attack Tools

Do Son August 28, 2026

Expel analyzed the SynkLoader malware attack chain. Discover how SynkLoader malware uses Teams phishing and fake lock screens to steal credentials.

macOS ClickFix Malware Exploits Polygon C2 macOS ClickFix malware campaign infection flow and macOS ClickFix malware execution diagram

macOS ClickFix Malware Exploits Polygon C2

Do Son August 28, 2026

A new macOS ClickFix malware campaign hides C2 servers on the blockchain. See how this macOS ClickFix malware steals crypto wallets and credentials.

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites

Do Son August 27, 2026

WeedHack malware still targets Minecraft gamers through fake client sites and Minecraft SEO poisoning, McAfee Labs warns.

Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR

Do Son August 27, 2026

eSentire ties the Cruciferra malware loader to ClickFix EDR killer attacks that abuse a signed driver to stop 145 security processes.