Malware-as-a-Service Archives • Daily CyberSecurity

Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data

Warden Stealer Rust infostealer stealing AI coding agent tokens, browser passwords and crypto wallet data

Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data

Do Son October 12, 2026

Warden Stealer, a fast-growing Rust infostealer, steals AI agent tokens, browser data, and crypto while bundling its own loader and clipper.

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites

Do Son August 27, 2026

WeedHack malware still targets Minecraft gamers through fake client sites and Minecraft SEO poisoning, McAfee Labs warns.

Insikt Group Finds Four New Golden Chickens Malware Families Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages

Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages

Insikt Group Finds Four New Golden Chickens Malware Families

Do Son July 28, 2026

Insikt Group found four new Golden Chickens malware families, including ChonkyChicken malware, TinyEgg, and a modular plugin variant with ClickFix lures.

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads

Do Son July 27, 2026

Malwarebytes finds fake games spreading Amatera Stealer through RenPy Loader, MSBuild abuse, and EtherHiding C2. See the infection chain and defenses.

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors

Do Son July 27, 2026

Proofpoint details the Cruciferra crypter service that cloaks RATs and infostealers using BYOVD EDR tampering and 90+ custom encryption routines.

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains

Do Son July 24, 2026

Microsoft warns of rising ACR Stealer attacks using ClickFix lures to steal browser credentials and tokens from enterprises. Two chains detailed.

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims Trojanized streaming site causing Packagist themes iOS spyware infections

Trojanized streaming site causing Packagist themes iOS spyware infections

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims

Do Son July 23, 2026

Varonis Threat Labs analyzed Dolphin X stealer, a forum-sold RAT with 300+ credential targets and an AI Profiler that ranks victims for operators.

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android malware panel sold as malware-as-a-service on Telegram with banking overlays

RedWing Android Malware Rents Out Spyware and Bank Theft on Telegram

Do Son July 15, 2026

RedWing Android malware is a rental spyware sold as malware-as-a-service on Telegram. It steals banking logins, intercepts 2FA, and hijacks phones.

ErrTraffic Malware Spreads ClickFix Lures via Hacked WordPress Sites Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

ErrTraffic Malware Spreads ClickFix Lures via Hacked WordPress Sites

Do Son June 22, 2026

ErrTraffic malware powers ClickFix attacks on hacked WordPress sites, using EtherHiding on the blockchain to hide its C2 and spread infostealers.

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader SilabRAT malware SnappyClient, HijackLoader, Malware-as-a-Service

SilabRAT malware SnappyClient, HijackLoader, Malware-as-a-Service

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader

Do Son June 17, 2026

SilabRAT malware, aka SnappyClient, is a $5K/month MaaS RAT flagged as HijackLoader. It uses HVNC and cracks crypto wallets, per Group-IB.

In-Memory Financial Theft: Inside Banana RAT’s Operator-Driven Attacks on Brazilian Banks Banana RAT Banking Trojan SHADOW-WATER-063 MaaS

In-Memory Financial Theft: Inside Banana RAT’s Operator-Driven Attacks on Brazilian Banks

Do Son May 25, 2026

TrendAI exposes Banana RAT, a fileless banking trojan by SHADOW-WATER-063 that uses in-memory execution and fake UI overlays to hijack Pix-QR transfers.

Malware-as-a-Service Exposed: Cisco Talos Unmasks Developer Behind Prolific “BadIIS” Web Server Toolkit BadIIS Malware as a Service

Malware-as-a-Service Exposed: Cisco Talos Unmasks Developer Behind Prolific “BadIIS” Web Server Toolkit

Do Son May 22, 2026

Cisco Talos exposes a commodity BadIIS variant sold as a service by dev "lwxat," featuring automated builders for traffic hijacking and reverse proxying.

FBI and Indonesian Authorities Dismantle Prolific “W3LL” Phishing Empire W3LL Phishing Kit MFA Bypass Takedown

FBI and Indonesian Authorities Dismantle Prolific “W3LL” Phishing Empire

Do Son April 15, 2026

The FBI and Indonesia dismantle W3LL, a $20M phishing kit that bypassed MFA and hijacked live sessions. Learn about the takedown of this MaaS powerhouse.

JUMPSEC Unmasks Iranian ‘Muddy Water’ Using Russian ‘CastleRAT’ Malware Muddy Water CastleRAT HVNC Browser Hijacking

JUMPSEC Unmasks Iranian ‘Muddy Water’ Using Russian ‘CastleRAT’ Malware

Do Son April 15, 2026

Iranian state actor Muddy Water adopts CastleRAT and ChainShell to hijack browsers and bypass MFA invisibly. A professional-grade shift in APT strategy.

New ClickFix Campaign Unveiled: Modular NodeJS Malware Targets Windows Users Node.js Infostealer ClickFix Campaign

New ClickFix Campaign Unveiled: Modular NodeJS Malware Targets Windows Users

Do Son April 10, 2026

Netskope uncovers a Node.js-based ClickFix campaign using gRPC over Tor for stealthy crypto theft. A leaked file exposed their entire MaaS backend.

RedLine Infostealer Kingpin Extradited to U.S. to Face Federal Charges RedLine Infostealer Operation Magnus

RedLine Infostealer Kingpin Extradited to U.S. to Face Federal Charges

Do Son March 27, 2026

RedLine architect Hambardzum Minasyan is extradited to the U.S. to face 50 years in prison for his role in the global malware empire and Operation Magnus.

Inside MioLab, the Professional MaaS Hijacking macOS and Hardware Wallets OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

Inside MioLab, the Professional MaaS Hijacking macOS and Hardware Wallets

Do Son March 27, 2026

LevelBlue uncovers MioLab (Nova), a premium macOS MaaS targeting crypto wallets, Keychains, and Apple Notes. Protect your BIP39 seeds and Mac today.

The Cyber Nexus: Iranian Group ‘Muddy Water’ Caught Deploying Russian ‘Tsundere’ Botnet via EtherHiding Tsundere Botnet Muddy Water

The Cyber Nexus: Iranian Group ‘Muddy Water’ Caught Deploying Russian ‘Tsundere’ Botnet via EtherHiding

Do Son March 18, 2026

eSentire TRU reveals Iranian group Muddy Water deploying the Russian-linked Tsundere botnet, utilizing Ethereum smart contracts for stealthy C2 communication.

From Chat App to Dark Web: How Telegram Became the New Hub for Cybercrime CVE-2024-22394

From Chat App to Dark Web: How Telegram Became the New Hub for Cybercrime

Do Son March 3, 2026

Cyfirma reveals how Telegram has replaced the dark web as the ultimate digital black market, making tools like malware and data theft available to anyone.

The AI Evolution of Mobile Malware: SURXRAT V5 Combines Surveillance, Ransomware, and LLMs SURXRAT V5 AI-Assisted Android Malware

The AI Evolution of Mobile Malware: SURXRAT V5 Combines Surveillance, Ransomware, and LLMs

Do Son February 25, 2026

Cyble Research unmasks SURXRAT V5, a professionalized Android RAT experimenting with AI-assisted modules and hybrid monetization via Firebase infrastructure.

The Startup Stealer: How AI and Discord Powered the Arkanix MaaS Operation Arkanix Stealer Malware-as-a-Service (MaaS)

The Startup Stealer: How AI and Discord Powered the Arkanix MaaS Operation

Do Son February 23, 2026

Kaspersky exposes Arkanix Stealer, a fast-moving MaaS operation leveraging Discord, tiered subscriptions, and AI-assisted development for quick data theft.

The Fake IT Threat: “TrustConnect” Malware-as-a-Service Masquerades as Legitimate RMM Software TrustConnect Malware Fake RMM MaaS

The Fake IT Threat: “TrustConnect” Malware-as-a-Service Masquerades as Legitimate RMM Software

Do Son February 23, 2026

Proofpoint exposes TrustConnect, a new Malware-as-a-Service masquerading as an IT tool. The AI-assisted fake RMM software replaces dismantled threats.