malware Archives • Daily CyberSecurity

MacSync macOS Stealer Spreads via ClickFix Lures MacSync macOS stealer architecture and MacSync macOS stealer ClickFix lures diagram

MacSync macOS Stealer Spreads via ClickFix Lures

Do Son September 11, 2026

At a glance Security researchers at Seqrite APT Team uncovered an evasive malware campaign targeting Apple enterprise...

Trojanized fake macOS installers used in Contagious Interview campaign

Trojanized Fake macOS Installers Spread OtterCookie Backdoor

Do Son September 9, 2026

At a glance Field Details Actor or Group Suspected DPRK-affiliated operators (Contagious Interview cluster) Activity Type Malware...

Node.js Malware Attacks Target Tech and Finance Sectors Node.js malware attacks diagram showing Node.js malware execution flow

Node.js Malware Attacks Target Tech and Finance Sectors

Do Son September 8, 2026

At a Glance Malware family: Multiple families including ModeloRAT, EtherRAT, AsukaStealer, and C2Looper Threat actor: Suspected initial...

Packagist Themes iOS Spyware Steals Crypto Wallet Seeds Trojanized streaming site causing Packagist themes iOS spyware infections

Packagist Themes iOS Spyware Steals Crypto Wallet Seeds

Do Son September 7, 2026

At a Glance Malware family: FUNNULL-hosted iOS spyware Threat actor: Suspected Vietnamese-operated group Targets or victims: Mobile...

Mirage Kitten Malware Targets Aviation and Fintech Sectors Mirage Kitten malware campaign delivering NodeRabbit

Mirage Kitten Malware Targets Aviation and Fintech Sectors

Do Son September 7, 2026

At a Glance Actor or group Allegedly Mirage Kitten (UNC1549, Smoke Sandstorm) Activity type Cyberespionage and remote...

StreamRat Banking Trojan Targets Spanish Android Users StreamRat banking trojan campaign fake Meta advertisement targeting Android devices

StreamRat banking trojan campaign fake Meta advertisement targeting Android devices

StreamRat Banking Trojan Targets Spanish Android Users

Do Son September 7, 2026

At a Glance Malware family: StreamRat Threat actor: Suspected Spanish-speaking developer using Mirax infrastructure Target or victims:...

BraZetsu Malware Framework Powers Initial Access Sales BraZetsu malware framework and BraZetsu malware framework operations diagram

BraZetsu Malware Framework Powers Initial Access Sales

Do Son September 4, 2026

At a glance Actor or group: Exilware Activity type: Initial Access Broker (IAB) malware, reconnaissance Targets or...

Microsoft Warns of TerminalFix Campaign Deploying Reverse Tunnels Half-click exploits chain showing webmail zero-days used by TA488 and TA458 against Zimbra, SOGo and Roundcube mailservers

Half-click exploits chain showing webmail zero-days used by TA488 and TA458 against Zimbra, SOGo and Roundcube mailservers

Microsoft Warns of TerminalFix Campaign Deploying Reverse Tunnels

Do Son September 3, 2026

At a glance Category Details Campaign / Family TerminalFix (ClickFix variant) Threat Actor Unattributed (Tracked across ongoing...

Russian National Indicted in Freelance Malware Scheme A Russian national indicted for malware targeting freelance workers

Russian National Indicted in Freelance Malware Scheme

Do Son September 3, 2026

At a Glance Actor Searzhudin Tamirlanovich Aktulaev Activity Type Malware distribution, wire fraud, identity theft Targets Users...

Virtualizor Hit By BGP Hijack Attack A graphic showing BGP routing hijacking redirecting a server update to a malicious source

Virtualizor Hit By BGP Hijack Attack

Do Son September 2, 2026

The server management panel Virtualizor recently suffered a devastating supply chain attack. Hackers maliciously manipulated Border Gateway...

Dark Caracal Deploys New GoCaracal Malware Framework Diagram showing the Dark Caracal GoCaracal malware attack chain and GoCaracal malware framework

Diagram showing the Dark Caracal GoCaracal malware attack chain and GoCaracal malware framework

Dark Caracal Deploys New GoCaracal Malware Framework

Do Son September 1, 2026

At a Glance Category Details Threat Actor Dark Caracal (suspected connection to Lebanese GDGS) Activity Type Cyberespionage,...

ToxNetV2 Botnet Integrates AI ToxNetV2 botnet infrastructure diagram highlighting AI integration

ToxNetV2 Botnet Integrates AI

Do Son August 31, 2026

Language models are steadily infiltrating tools where AI responses directly dictate the functionality of malicious programs. Security...

ValleyRAT Backdoor Spread via Signed Chinese Adware ValleyRAT backdoor adware campaign infection chain diagram

ValleyRAT Backdoor Spread via Signed Chinese Adware

Do Son August 31, 2026

At a Glance Actor or group: Silver Fox Activity type: Backdoor delivery, spyware, DLL sideloading Targets or...

Anthropic Issues Claude Security Warnings A conceptual illustration of malware stealing session tokens from a Claude user account

Anthropic Issues Claude Security Warnings

Do Son August 31, 2026

According to recent information shared by users on Reddit, Anthropic recently initiated emergency security protocols. The company...

UAT-10147 Deploys SPECTRE Cross-Platform Implant Diagram showing how the UAT-10147 SPECTRE cross-platform implant bypasses EDR systems

UAT-10147 Deploys SPECTRE Cross-Platform Implant

Do Son August 31, 2026

At a glance Factor Details Actor or Group UAT-10147 (Suspected Chinese-speaking group) Activity Type SEO fraud monetization,...

Kimsuky Spear Phishing Abuses Remote Control Tools Kimsuky spear phishing campaigns abusing remote control tools

Kimsuky Spear Phishing Abuses Remote Control Tools

Do Son August 31, 2026

At a glance Actor / Group Kimsuky (suspected North Korea-linked threat actor) Activity Type Spear phishing, email...

SynkLoader Malware Deploys Multi-Language Attack Tools C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

SynkLoader Malware Deploys Multi-Language Attack Tools

Do Son August 28, 2026

At a glance Factor Details Malware Family SynkLoader Threat Actor Suspected initial access broker or ransomware affiliate...

Fake AI PoCs Flood Exploit Repositories in 2026 Fake AI PoCs and malicious code found in GitHub exploit repositories.

Fake AI PoCs Flood Exploit Repositories in 2026

Do Son August 25, 2026

The cybersecurity landscape is currently facing a massive influx of fake AI PoCs polluting public code sharing...

Sakura Internet Breach Exposes 1.36 Million Customer Accounts Sakura Internet data breach 1.36 million customer accounts Japan cloud provider

Sakura Internet data breach 1.36 million customer accounts Japan cloud provider

Sakura Internet Breach Exposes 1.36 Million Customer Accounts

Do Son August 21, 2026

Japanese cloud computing and data center services provider Sakura Internet recently issued a security advisory disclosing that...

Evooo1Bot Linux Botnet Employs SOCKS Relays and DDoS Evooo1Bot Linux botnet architecture and Evooo1Bot Linux botnet analysis diagram

Evooo1Bot Linux Botnet Employs SOCKS Relays and DDoS

Do Son August 20, 2026

At a glance Malware family: Evooo1Bot Threat actor: Unknown Target or victims: Internet-facing devices, routers, firewalls, and...

Abyssos Modular RAT: Zscaler ThreatLabz Analysis

A diagram showing the Abyssos modular RAT infection chain and C2 communication

Abyssos Modular RAT: Zscaler ThreatLabz Analysis

Do Son August 18, 2026

At a glance Malware family: Abyssos Threat actor: Unknown Target or victims: Windows endpoints Delivery vector: Under...

Kimwolf Botnet Malware Upgrades DDoS and C2 Defenses C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

Kimwolf Botnet Malware Upgrades DDoS and C2 Defenses

Do Son August 17, 2026

At a glance Malware family: Kimwolf (also tracked as AISURU) Threat actor: Unknown (Operators manage both Linux...

Critical Alert 4 Active Exploits Detected Today