Do Son Mozilla's Firefox Add-ons now auto-detects malicious crypto wallet extensions, enhancing user security and preventing theft.
malware
Crocodilus, a rapidly evolving Android banking trojan, now targets global users, stealing crypto seed phrases and bypassing defenses.
Socket uncovers malicious RubyGems impersonating Fastlane plugins, stealing sensitive CI/CD data by rerouting Telegram API calls. Beware of fastlane-plugin-telegram-proxy!
Sysdig uncovers a campaign exploiting misconfigured Open WebUI instances to deploy AI-assisted cryptominers and infostealers, showcasing new threat vectors.
Wordfence uncovers a sophisticated WordPress malware disguised as a legitimate plugin, stealing admin credentials & enabling remote code execution.
Socket discovers 4 malicious npm packages designed to drain crypto wallets on BSC & Ethereum, downloaded over 2,100 times.
A new npm supply chain attack, "xlsx-to-json-lh," uses typosquatting to enable remote code execution, silently awaiting a "kill switch" to delete project directories.
A sophisticated malware campaign targets Korean Internet cafés with Gh0st RAT and CoinMiner, hijacking systems for crypto mining. ASEC urges immediate action.
Intrinsec exposes BtHoster, a bulletproof hosting provider behind widespread scanning and malware, revealing its network of shell companies and evasion tactics.
A new ransomware strain, Lyrix, targets Windows systems with strong encryption, anti-analysis, and data destruction techniques. Learn how to protect your data.
The DOJ, with international partners, seized four domains providing crypting services to cybercriminals, hindering malware attacks in a global operation.
A sophisticated PyPI supply chain attack, "cappership," steals Solana private keys by monkey-patching, leveraging transitive dependencies and blockchain exfiltration.
Threat actors are exploiting AI hype with fake software installers, delivering CyberLock ransomware, Lucky_Gh0$t, and the destructive Numero malware.
APT41 is exploiting Google Calendar as a covert C2 channel in the TOUGHPROGRESS cyberespionage campaign, targeting government entities with stealthy malware.
A new global malware campaign delivers PureHVNC RAT via fake job offers and complex, multi-stage obfuscation, making detection extremely difficult.
Zanubis, a sophisticated Android malware, exploits Accessibility Services to steal banking data, intercept 2FA codes, and lock devices.
A malware campaign is hijacking WordPress sites with fake Java update pop-ups, tricking visitors into downloading malicious executables.
A new campaign by UNC6032 uses fake AI video generator sites and social media ads to distribute a malware cocktail including STARKVEIL.
New campaigns by Silent Werewolf leverage custom C# loaders and advanced delivery to target entities in Russia and Moldova for cyber-espionage.
Katz Stealer, a new MaaS infostealer, targets browsers, crypto wallets, and Discord using advanced evasion and UAC bypass techniques.
The Catena malware loader is using trojanized app installers (QQBrowser, LetsVPN) to deploy the memory-resident Winos v4.0 RAT.
Mimo (Hezb) is exploiting an unauthenticated RCE (CVE-2025-32432) in Craft CMS to deploy webshells, cryptominers, and proxyware. Patch now!