Keylogger Archives • Daily CyberSecurity

Velvet Chollima Leaves Backend Keys Inside Critical GitLab Dead-Drop Malware

Velvet Chollima GitLab Malware Tralert FX EV Certificate

Velvet Chollima Leaves Backend Keys Inside Critical GitLab Dead-Drop Malware

Do Son May 20, 2026

Velvet Chollima leaks its own backend infrastructure keys inside a malicious "Tralert FX" installer signed with a valid EV certificate.

Splunk Unmasks New Malware Campaign Pairing Ghost RAT with CloverPlus Adware Ghost RAT RDP Credential Theft

Splunk Unmasks New Malware Campaign Pairing Ghost RAT with CloverPlus Adware

Do Son April 22, 2026

Splunk STRT identifies a new campaign bundling Ghost RAT with CloverPlus adware to steal RDP credentials and monetize infections. Patch your systems now!

Inside the BRUSHWORM Malware Campaign Bridging Air-Gaps with USB “Sleeper” Cells Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Inside the BRUSHWORM Malware Campaign Bridging Air-Gaps with USB “Sleeper” Cells

Do Son April 2, 2026

Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER: AI-aided malware using USB drives to steal data from air-gapped financial networks. Update your defenses!

HoneyMyte Evolved: Spies Use Pixeldrain & CoolClient for Real-Time Surveillance HoneyMyte Espionage CoolClient Backdoor

HoneyMyte Evolved: Spies Use Pixeldrain & CoolClient for Real-Time Surveillance

Do Son January 28, 2026

HoneyMyte (Mustang Panda) shifts to real-time surveillance using updated CoolClient. New 2025 campaign uses Pixeldrain for stealthy exfiltration.

Keylogger Found Harvesting Credentials on Top US Bank’s Employee Store Bank Employee Store Breach Sansec Keylogger

Keylogger Found Harvesting Credentials on Top US Bank’s Employee Store

Do Son January 17, 2026

Sansec uncovers a keylogger on a major US bank's employee portal. 200,000 staff at risk of credential theft via hidden "side door" malware.

Phantom Stealer Targets Russian Finance with ISO Phishing, Deploying Keyloggers and Crypto-Wallet Theft Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Phantom Stealer Targets Russian Finance with ISO Phishing, Deploying Keyloggers and Crypto-Wallet Theft

Do Son December 16, 2025

Operation MoneyMount-ISO targets Russian financial institutions with a Phantom Stealer info-stealer hidden in an ISO file. The malware steals crypto wallets, browser data, and uses a keylogger. It has a SelfDestruct function for evasion.

Evolved ClayRat Spyware Gains Self-Defense, Using Accessibility Abuse to Block Uninstallation and Steal Keys Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Android zero day flaw June 2026 security bulletin RuTaxi Trojan Android Banking Malware Pixel 9 zero-click exploit, Dolby UDC vulnerability CVE-2025-54957 NexusRoute Android RAT, India E-Challan Phishing ClayRat Self-Defense, Android Accessibility Abuse Android Trojan, AntiDot Android Malware "BadPack"

Evolved ClayRat Spyware Gains Self-Defense, Using Accessibility Abuse to Block Uninstallation and Steal Keys

Do Son December 9, 2025

Evolved ClayRat spyware uses Accessibility Services to install a keylogger and lockscreen bypass. It leverages self-defense (blocking uninstallation) and screen recording for comprehensive surveillance.

TinkyWinkey: A Stealthy New Keylogger Is Hunting for Credentials on Windows TinkyWinkey Keylogger, Windows malware

TinkyWinkey: A Stealthy New Keylogger Is Hunting for Credentials on Windows

Do Son September 2, 2025

A new report reveals TinkyWinkey, a stealthy Windows keylogger that uses low-level APIs and DLL injection to steal credentials and sensitive data from victims.

PS1Bot Malware Campaign Unleashes Modular PowerShell Framework with Stealthy New Tricks ahost.exe DLL Sideloading Signed Application Abuse PS1Bot, malware ransomware attacks bill

ahost.exe DLL Sideloading Signed Application Abuse PS1Bot, malware ransomware attacks bill

PS1Bot Malware Campaign Unleashes Modular PowerShell Framework with Stealthy New Tricks

Do Son August 14, 2025

A new report from Cisco Talos details PS1Bot, a modular PowerShell-based malware campaign using malvertising to steal data and maintain stealthy persistence.

CoinDCX Engineer Arrested in $44M Crypto Heist: Moonlighting on Work Laptop Linked to Breach Elderly lottery fraud scam DOJ wire fraud conspiracy ALPHV BlackCat, Insider Threat Nefilim ransomware Artem Stryzhak guilty plea, Volodymyr Tymoshchuk $11M reward CoinDCX, Employee Arrest Operation PowerOFF Cybercrime, Self-Promotion Hacking

Elderly lottery fraud scam DOJ wire fraud conspiracy ALPHV BlackCat, Insider Threat Nefilim ransomware Artem Stryzhak guilty plea, Volodymyr Tymoshchuk $11M reward CoinDCX, Employee Arrest Operation PowerOFF Cybercrime, Self-Promotion Hacking

CoinDCX Engineer Arrested in $44M Crypto Heist: Moonlighting on Work Laptop Linked to Breach

Do Son August 1, 2025

A CoinDCX software engineer, Rahul Agarwal, has been arrested in connection with a $44M crypto heist after an internal probe linked the breach to his compromised work laptop.

4 Open-Source Packages Infect 56,000+ Downloads with Stealthy Spyware Open Source Spyware, Supply Chain Surveillance

4 Open-Source Packages Infect 56,000+ Downloads with Stealthy Spyware

Do Son July 25, 2025

Four open-source packages on npm and PyPI (56k+ downloads) are secretly deploying sophisticated spyware, performing webcam surveillance, keylogging, and credential theft.

Snake Keylogger Exploits Geopolitical Tensions with Oil-Themed Spearphishing Campaign snake

Snake Keylogger Exploits Geopolitical Tensions with Oil-Themed Spearphishing Campaign

Do Son June 30, 2025

A new Snake Keylogger campaign exploits an undocumented DLL sideloading technique via jsadebugd.exe to target energy and logistics sectors with fake oil deals.

Keylogger in Microsoft Exchange Server Breaches Government Agencies Worldwide Microsoft Exchange Server Keylogger

Keylogger in Microsoft Exchange Server Breaches Government Agencies Worldwide

Do Son May 20, 2024

The attackers exploited a known flaw in Microsoft Exchange Server, known as ProxyShell, to inject the keylogger into the server’s main page