G DATA Archives • Daily CyberSecurity

Projextor Malware Hides in Fake PDF and Recipe Apps

Projextor Electron malware fake PDF converter and recipe apps diagram showing injected scripts and desktop capture

Projextor Malware Hides in Fake PDF and Recipe Apps

Do Son August 21, 2026

G DATA details Projextor, an Electron malware hidden in working PDF and recipe apps that runs injected scripts and captures the desktop.

Stealthy New Remcos RAT Variant Evades Detection Using Innovative Staging Layers new Remcos RAT variant DonutLoader shellcode

Stealthy New Remcos RAT Variant Evades Detection Using Innovative Staging Layers

Do Son June 5, 2026

G Data uncovers a new Remcos RAT variant using DonutLoader shellcode and trusted LOLBins to bypass Windows security filters.

Attackers Are Weaponizing Foxit PDF Reader’s Reputation Foxit PDF Malware UltraVNC Hijack

Attackers Are Weaponizing Foxit PDF Reader’s Reputation

Do Son April 28, 2026

G DATA warns Foxit PDF users of a global malware campaign using fake installers and Danish passport decoys to deploy hidden UltraVNC remote access tools.

The Malware That Chats Back: Inside G DATA’s Real-Time Notepad Encounter with the “Kiss Loader” Author Kiss Loader Early Bird APC Injection

The Malware That Chats Back: Inside G DATA’s Real-Time Notepad Encounter with the “Kiss Loader” Author

Do Son March 31, 2026

G DATA analysts chat with a malware author via Notepad while analyzing "Kiss Loader," a new threat using Early Bird APC injection and VenomRAT. Read more!

PlugX Evolves: New “Meeting Invitation” Phishing Campaign Leverages Trusted Security Software Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

PlugX Evolves: New “Meeting Invitation” Phishing Campaign Leverages Trusted Security Software

Do Son March 4, 2026

LAB52 exposes a new China-aligned espionage campaign using fake meeting invitations and G DATA antivirus components to stealthily deploy the PlugX RAT.

The High Cost of ‘Free’: How PiviGames Became a Lovecraftian Malware Hub for HijackLoader and ACRStealer Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

The High Cost of ‘Free’: How PiviGames Became a Lovecraftian Malware Hub for HijackLoader and ACRStealer

Do Son March 3, 2026

G DATA reveals how pirated gaming site PiviGames distributes ACRStealer via "spaghetti code" HijackLoader and DLL sideloading, causing total account takeovers.

Next-Gen Stealer Arkanix Bypasses Chrome App-Bound Encryption Using C++ Process Injection Arkanix Stealer, App-Bound Encryption Bypass

Next-Gen Stealer Arkanix Bypasses Chrome App-Bound Encryption Using C++ Process Injection

Do Son December 2, 2025

G DATA exposed Arkanix, a fast-evolving C++ stealer. Its premium version uses process injection and Chrome Elevator to bypass Chrome App-Bound Encryption (ABE) and steal crypto wallets and Wi-Fi passwords.

BlockBlasters: When a Steam Game Turns Into a Malware Delivery Vehicle WAGO, vulnerability, industrial automation BlockBlasters, Steam malware Baxter Life2000 Ventilation System - CVE-2024-48966

WAGO, vulnerability, industrial automation BlockBlasters, Steam malware Baxter Life2000 Ventilation System - CVE-2024-48966

BlockBlasters: When a Steam Game Turns Into a Malware Delivery Vehicle

Do Son September 23, 2025

A Steam game, BlockBlasters, was compromised with malware in an update, which is stealing crypto and credentials from unsuspecting gamers.

Trojan Horse: A Fake PDF Editor Is Actually a Malware-Laden Backdoor PDF Editor, malware

Trojan Horse: A Fake PDF Editor Is Actually a Malware-Laden Backdoor

Do Son August 31, 2025

A new report reveals that the AppSuite PDF Editor is a Trojan horse that functions as a backdoor. Its developers even submitted it to AV vendors to get it whitelisted.

XMRig Cryptojacking Surges: New Campaign Uses LOLBAS, Steals Monero Undetected XMRig Cryptojacking, LOLBAS

XMRig Cryptojacking Surges: New Campaign Uses LOLBAS, Steals Monero Undetected

Do Son July 8, 2025

XMRig cryptojacking is surging, leveraging LOLBAS techniques, PowerShell, and Scheduled Tasks to mine Monero undetected, with a 45% rally in XMR price driving the attacks.

EvilConwi: Hackers Abuse Signed ConnectWise Installers to Launch Stealth Remote Access Attacks abuse

EvilConwi: Hackers Abuse Signed ConnectWise Installers to Launch Stealth Remote Access Attacks

Do Son June 24, 2025

Hackers are weaponizing legitimately signed ConnectWise ScreenConnect installers by using Authenticode stuffing to deploy malware and fake updates, leveraging social engineering.

Chihuahua Stealer Unleashed: Obfuscated PowerShell and AES-GCM Encryption Fuel This Advanced Data Theft Campaign Chihuahua Stealer, Infostealer

Chihuahua Stealer Unleashed: Obfuscated PowerShell and AES-GCM Encryption Fuel This Advanced Data Theft Campaign

Do Son May 14, 2025

Chihuahua Stealer uses stealthy PowerShell loaders, CNG AES-GCM encryption, and .NET memory injection to exfiltrate browser and crypto wallet data.