Malware Analysis

The Python Predator: PXA Stealer Surges 10% as it Targets Global Finance and Crypto in 2026

• Malware

The Python Predator: PXA Stealer Surges 10% as it Targets Global Finance and Crypto in 2026

Do Son April 6, 2026 0

Following the high-profile takedowns of major players like Lumma and RedLine in 2025, CyberProof MDR analysts have...

Read More Read more about The Python Predator: PXA Stealer Surges 10% as it Targets Global Finance and Crypto in 2026

The Malware That Chats Back: Inside G DATA’s Real-Time Notepad Encounter with the “Kiss Loader” Author

• Malware

The Malware That Chats Back: Inside G DATA’s Real-Time Notepad Encounter with the “Kiss Loader” Author

Do Son March 31, 2026 0

While analyzing a new piece of malware dubbed “Kiss Loader,” G DATA Security Center found themselves in...

Read More Read more about The Malware That Chats Back: Inside G DATA’s Real-Time Notepad Encounter with the “Kiss Loader” Author

The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations

• Malware

The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations

Do Son March 31, 2026 0

Cybersecurity researchers at Securonix have detailed the curtain on a sophisticated new threat campaign dubbed FAUX#ELEVATE. The...

Read More Read more about The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations

The “Gentlemen” Ransomware Toolkit and the Lethal z1.bat Pre-Encryption Weapon

• Malware

The “Gentlemen” Ransomware Toolkit and the Lethal z1.bat Pre-Encryption Weapon

Do Son March 30, 2026 0

Researchers have uncovered a “structured, maintained operational toolkit” belonging to an affiliate of TheGentlemen ransomware-as-a-service (RaaS) group....

Read More Read more about The “Gentlemen” Ransomware Toolkit and the Lethal z1.bat Pre-Encryption Weapon

Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

• Malware

Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

Do Son March 30, 2026 0

The landscape of Linux-based threats is shifting. While historically under-documented compared to Windows counterparts, a new report...

Read More Read more about Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

Beyond the Hook: Unmasking SnappyClient, the HijackLoader-Linked Stealth Stealer Targeting Crypto

• Malware

Beyond the Hook: Unmasking SnappyClient, the HijackLoader-Linked Stealth Stealer Targeting Crypto

Do Son March 25, 2026 0

Security researchers at Zscaler ThreatLabz have unmasked a sophisticated new command-and-control (C2) framework implant they’ve dubbed SnappyClient....

Read More Read more about Beyond the Hook: Unmasking SnappyClient, the HijackLoader-Linked Stealth Stealer Targeting Crypto

VoidStealer Debuts Novel Debugger Bypass for Chrome and Edge Encryption

• Malware

VoidStealer Debuts Novel Debugger Bypass for Chrome and Edge Encryption

Do Son March 25, 2026 0

Researchers at Gen Threat Labs, led by Threat Researcher Vojtěch Krejsa, have identified VoidStealer—the first infostealer observed...

Read More Read more about VoidStealer Debuts Novel Debugger Bypass for Chrome and Edge Encryption

‘Speagle’ Malware Hijacks Security Software to Steal Missile Secrets

• Malware

‘Speagle’ Malware Hijacks Security Software to Steal Missile Secrets

Do Son March 23, 2026 0

In a sophisticated display of “parasitic” engineering, a mysterious new threat has been discovered living within the...

Read More Read more about ‘Speagle’ Malware Hijacks Security Software to Steal Missile Secrets

New “StoatWaffle” Malware Emerges in North Korean “Contagious Interview” Campaign

• Malware

New “StoatWaffle” Malware Emerges in North Korean “Contagious Interview” Campaign

Do Son March 23, 2026 0

A new modular malware threat has been identified in the wild, signaling a shift in tactics for...

Read More Read more about New “StoatWaffle” Malware Emerges in North Korean “Contagious Interview” Campaign

Weaponizing gcc: Inside the Stealthy ‘Hex’ Botnet’s On-Host Compilation Strategy

• Malware

Weaponizing gcc: Inside the Stealthy ‘Hex’ Botnet’s On-Host Compilation Strategy

Do Son March 21, 2026 0

Security researchers at Hunt Intelligence have exposed a growing 15-node botnet operation that utilizes a unique “on-host...

Read More Read more about Weaponizing gcc: Inside the Stealthy ‘Hex’ Botnet’s On-Host Compilation Strategy

The Typosquatting Trap: Fake Telegram Portal Delivers Stealthy Memory-Resident Malware

• Malware

The Typosquatting Trap: Fake Telegram Portal Delivers Stealthy Memory-Resident Malware

Do Son March 20, 2026 0

Cybersecurity researchers have uncovered a deceptive campaign that uses a typosquatted website to impersonate the official Telegram...

Read More Read more about The Typosquatting Trap: Fake Telegram Portal Delivers Stealthy Memory-Resident Malware

The Judicial Decoy: Sophisticated Rust RAT Infiltrates Argentina’s Federal Courts

• Malware

The Judicial Decoy: Sophisticated Rust RAT Infiltrates Argentina’s Federal Courts

Do Son March 19, 2026 0

A highly sophisticated, multi-stage cyber infection chain has been uncovered targeting the heart of Argentina’s legal infrastructure....

Read More Read more about The Judicial Decoy: Sophisticated Rust RAT Infiltrates Argentina’s Federal Courts

The End of the Static Era: Trellix Uncovers Fully Fileless Remcos RAT Campaign

• Malware

The End of the Static Era: Trellix Uncovers Fully Fileless Remcos RAT Campaign

Do Son March 16, 2026 0

In the ever-evolving arms race between hackers and defenders, the “static” era is officially over. A new...

Read More Read more about The End of the Static Era: Trellix Uncovers Fully Fileless Remcos RAT Campaign

Gaslighting Android: How the ‘Digital Lutera’ Attack Uses LSPosed to Bypass UPI SIM-Binding

• Malware

Gaslighting Android: How the ‘Digital Lutera’ Attack Uses LSPosed to Bypass UPI SIM-Binding

Do Son March 12, 2026 0

According to a critical new report from CloudSEK, threat actors have moved beyond simple app modifications to...

Read More Read more about Gaslighting Android: How the ‘Digital Lutera’ Attack Uses LSPosed to Bypass UPI SIM-Binding

Malicious npm Package “pino-sdk-v2” Caught Harvesting Secrets

• Malware

Malicious npm Package “pino-sdk-v2” Caught Harvesting Secrets

Do Son March 11, 2026 0

In the modern development landscape, supply chain attacks remain one of the most effective ways for threat...

Read More Read more about Malicious npm Package “pino-sdk-v2” Caught Harvesting Secrets

Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX

• Cyber Security
• Malware

Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX

Do Son March 10, 2026 0

Following recent regional escalations, researchers have identified a sharp increase in activity from Chinese-nexus APT (Advanced Persistent...

Read More Read more about Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX

CVE-2026-0866: Malformed ZIP Headers Allow Malware to Slip Past EDR Scanners

• Vulnerability Report

CVE-2026-0866: Malformed ZIP Headers Allow Malware to Slip Past EDR Scanners

Do Son March 10, 2026 0

A newly detailed vulnerability, CVE-2026-0866, is highlighting a fundamental blind spot in how many Antivirus (AV) and...

Read More Read more about CVE-2026-0866: Malformed ZIP Headers Allow Malware to Slip Past EDR Scanners

Malicious “Hex Visualizer” Chrome Extension Targeting imToken Users

• Cybercriminals

Malicious “Hex Visualizer” Chrome Extension Targeting imToken Users

Do Son March 10, 2026 0

In a sophisticated blend of deceptive branding and technical trickery, Socket’s Threat Research Team has uncovered a...

Read More Read more about Malicious “Hex Visualizer” Chrome Extension Targeting imToken Users

The ‘Contagious Interview’ Trap: How a Web3 CEO Unmasked North Korean Stealth Malware

• Cybercriminals

The ‘Contagious Interview’ Trap: How a Web3 CEO Unmasked North Korean Stealth Malware

Do Son March 10, 2026 0

It started with a routine direct message on LinkedIn: a recruiter named “Nazar” pitching a role at...

Read More Read more about The ‘Contagious Interview’ Trap: How a Web3 CEO Unmasked North Korean Stealth Malware

Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor

• Cyber Security
• Malware

Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor

Do Son March 9, 2026 0

Cybersecurity investigators at Cisco Talos have pulled back the curtain on a relentless espionage campaign targeting critical...

Read More Read more about Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor

Polygon Powered: Vietnamese Operator Deploys 16 Generations of LuaJIT Malware via GitHub

• Malware

Polygon Powered: Vietnamese Operator Deploys 16 Generations of LuaJIT Malware via GitHub

Do Son March 9, 2026 0

Security researchers have uncovered a massive, year-long cyber campaign orchestrated by a Vietnamese-speaking operator who has turned...

Read More Read more about Polygon Powered: Vietnamese Operator Deploys 16 Generations of LuaJIT Malware via GitHub

BadPaw and MeowMeow: Russian Cyber Offensive Targets Ukraine with Novel Malware Duo

• Cyber Security
• Malware

BadPaw and MeowMeow: Russian Cyber Offensive Targets Ukraine with Novel Malware Duo

Do Son March 5, 2026 0

Cybersecurity investigators at ClearSky Team have uncovered a targeted Russian cyber campaign against Ukraine utilizing two novel...

Read More Read more about BadPaw and MeowMeow: Russian Cyber Offensive Targets Ukraine with Novel Malware Duo