Malware Analysis

ResokerRAT Uses Telegram to Hijack Your PC and Disable Your Security Keys

• Malware

ResokerRAT Uses Telegram to Hijack Your PC and Disable Your Security Keys

Do Son April 6, 2026 0

Researchers unmask ResokerRAT, a stealthy Trojan using Telegram to spy on systems and block security tools like Task Manager. Is your PC calling home?

The Python Predator: PXA Stealer Surges 10% as it Targets Global Finance and Crypto in 2026

• Malware

The Python Predator: PXA Stealer Surges 10% as it Targets Global Finance and Crypto in 2026

Do Son April 6, 2026 0

PXA Stealer activity surges in Q1 2026, targeting global finance. Learn how this Python-based malware uses Telegram and LOLBins to hijack crypto and banking data.

The Malware That Chats Back: Inside G DATA’s Real-Time Notepad Encounter with the “Kiss Loader” Author

• Malware

The Malware That Chats Back: Inside G DATA’s Real-Time Notepad Encounter with the “Kiss Loader” Author

Do Son March 31, 2026 0

G DATA analysts chat with a malware author via Notepad while analyzing "Kiss Loader," a new threat using Early Bird APC injection and VenomRAT. Read more!

The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations

• Malware

The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations

Do Son March 31, 2026 0

Securonix uncovers FAUX#ELEVATE, a 25-second attack using 10MB "inflated" VBScripts to steal credentials and mine crypto in French corporate environments.

The “Gentlemen” Ransomware Toolkit and the Lethal z1.bat Pre-Encryption Weapon

• Malware

The “Gentlemen” Ransomware Toolkit and the Lethal z1.bat Pre-Encryption Weapon

Do Son March 30, 2026 0

Hunt.io uncovers a Gentlemen ransomware toolkit on a bulletproof host. Learn how the z1.bat script destroys defenses and backups before encryption.

Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

• Malware

Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

Do Son March 30, 2026 0

Morphisec uncovers Pay2Key’s Linux evolution. This dual-arch ransomware disables SELinux and AppArmor to encrypt x64/ARM64 servers. Secure your infra today!

Beyond the Hook: Unmasking SnappyClient, the HijackLoader-Linked Stealth Stealer Targeting Crypto

• Malware

Beyond the Hook: Unmasking SnappyClient, the HijackLoader-Linked Stealth Stealer Targeting Crypto

Do Son March 25, 2026 0

Zscaler ThreatLabz unmasks SnappyClient, a C++ C2 framework linked to HijackLoader. It uses AMSI bypass and Heaven’s Gate to steal crypto and gain remote access.

VoidStealer Debuts Novel Debugger Bypass for Chrome and Edge Encryption

• Malware

VoidStealer Debuts Novel Debugger Bypass for Chrome and Edge Encryption

Do Son March 25, 2026 0

Gen Threat Labs uncovers VoidStealer, the first malware using a debugger-based bypass to extract Chrome and Edge encryption keys via hardware breakpoints.

‘Speagle’ Malware Hijacks Security Software to Steal Missile Secrets

• Malware

‘Speagle’ Malware Hijacks Security Software to Steal Missile Secrets

Do Son March 23, 2026 0

Researchers reveal Infostealer.Speagle, a "parasitic" malware hijacking Cobra DocGuard infrastructure to mask the theft of sensitive ballistic missile data.

New “StoatWaffle” Malware Emerges in North Korean “Contagious Interview” Campaign

• Malware

New “StoatWaffle” Malware Emerges in North Korean “Contagious Interview” Campaign

Do Son March 23, 2026 0

Researchers uncovered StoatWaffle, a new Node.js malware by North Korean hackers targeting developers via malicious VSCode repositories to steal data.

Weaponizing gcc: Inside the Stealthy ‘Hex’ Botnet’s On-Host Compilation Strategy

• Malware

Weaponizing gcc: Inside the Stealthy ‘Hex’ Botnet’s On-Host Compilation Strategy

Do Son March 21, 2026 0

Hunt Intelligence uncovers the "Hex" botnet, a stealthy campaign using stolen SSH credentials and on-host compilation to evade traditional binary scanners.

The Typosquatting Trap: Fake Telegram Portal Delivers Stealthy Memory-Resident Malware

• Malware

The Typosquatting Trap: Fake Telegram Portal Delivers Stealthy Memory-Resident Malware

Do Son March 20, 2026 0

Researchers uncover a fake Telegram site distributing stealthy, memory-resident malware that bypasses Windows Defender. Always verify your download URLs.

The Judicial Decoy: Sophisticated Rust RAT Infiltrates Argentina’s Federal Courts

• Malware

The Judicial Decoy: Sophisticated Rust RAT Infiltrates Argentina’s Federal Courts

Do Son March 19, 2026 0

Lat61 Threat Intelligence uncovers a stealthy Rust RAT targeting Argentina's legal sector via weaponized judicial PDFs. Learn about its evasion tactics.

The End of the Static Era: Trellix Uncovers Fully Fileless Remcos RAT Campaign

• Malware

The End of the Static Era: Trellix Uncovers Fully Fileless Remcos RAT Campaign

Do Son March 16, 2026 0

Trellix uncovers a stealthy, fileless Remcos RAT campaign utilizing process hollowing to execute entirely in memory and evade traditional security.

Gaslighting Android: How the ‘Digital Lutera’ Attack Uses LSPosed to Bypass UPI SIM-Binding

• Malware

Gaslighting Android: How the ‘Digital Lutera’ Attack Uses LSPosed to Bypass UPI SIM-Binding

Do Son March 12, 2026 0

CloudSEK reveals how attackers use LSPosed and the "Digital Lutera" module to bypass Android UPI SIM-binding, gaslighting payment apps for remote fraud.

Malicious npm Package “pino-sdk-v2” Caught Harvesting Secrets

• Malware

Malicious npm Package “pino-sdk-v2” Caught Harvesting Secrets

Do Son March 11, 2026 0

SafeDep uncovers pino-sdk-v2, a malicious npm package impersonating the pino logger to silently steal .env secrets and exfiltrate them via Discord.

Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX

• Cyber Security
• Malware

Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX

Do Son March 10, 2026 0

Chinese APTs like Camaro Dragon are targeting Qatar with PlugX malware and Cobalt Strike, weaponizing Middle East tensions for cyberespionage.

CVE-2026-0866: Malformed ZIP Headers Allow Malware to Slip Past EDR Scanners

• Vulnerability Report

CVE-2026-0866: Malformed ZIP Headers Allow Malware to Slip Past EDR Scanners

Do Son March 10, 2026 0

Discover how attackers use shadow archives (CVE-2026-0866) to bypass AV and EDR by malforming ZIP metadata, keeping malware hidden but executable.

Malicious “Hex Visualizer” Chrome Extension Targeting imToken Users

• Cybercriminals

Malicious “Hex Visualizer” Chrome Extension Targeting imToken Users

Do Son March 10, 2026 0

Socket researchers uncover "ImToken Chromophore," a malicious Chrome extension using fake branding and homoglyphs to steal crypto wallet seed phrases.

The ‘Contagious Interview’ Trap: How a Web3 CEO Unmasked North Korean Stealth Malware

• Cybercriminals

The ‘Contagious Interview’ Trap: How a Web3 CEO Unmasked North Korean Stealth Malware

Do Son March 10, 2026 0

A fake LinkedIn recruiter and a poisoned GitHub repo: See how a CEO uncovered the North Korean "Contagious Interview" malware targeting Web3 developers.

Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor

• Cyber Security
• Malware

Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor

Do Son March 9, 2026 0

Cisco Talos exposes UAT-9244, a China-linked APT targeting South American telecoms with stealthy malware like the BitTorrent-based PeerTime and TernDoor.

Polygon Powered: Vietnamese Operator Deploys 16 Generations of LuaJIT Malware via GitHub

• Malware

Polygon Powered: Vietnamese Operator Deploys 16 Generations of LuaJIT Malware via GitHub

Do Son March 9, 2026 0

Researchers uncover a massive campaign by a Vietnamese operator using GitHub and Polygon blockchain smart contracts to distribute the StealC infostealer.