Do Son ASEC exposed a SteamCleaner malware clone signed with a valid certificate. It installs a Node.js RCE backdoor via InnoSetup, evades sandboxes, and is suspected of running Proxyware for profit.
proxyware
A new report reveals that malicious YouTube video downloader sites are tricking users into installing Proxyware, a type of malware that hijacks network bandwidth.
Mimo (Hezb) is exploiting an unauthenticated RCE (CVE-2025-32432) in Craft CMS to deploy webshells, cryptominers, and proxyware. Patch now!