malware
Hackers infect Android car head units with proxy botnet malware
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. [...]
Malware Hijacks Android Car Head Units
Researchers have identified new Android malware that hijacks car head units by exploiting their official update mechanisms. The malware installs proxy software, turning vehicles into nodes for the BADBOX botnet, primarily for ad fraud and to provide anonymized internet connections. This marks the first documented instance of malware specifically targeting car head units through their native update channels.
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware. The post Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight appeared first on SecurityWeek.
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
Attackers are increasingly targeting the software development lifecycle (SDLC) supply chain by compromising developer tools, CI/CD pipelines, and open-source packages. Recent attacks like the ChainDrop npm worm demonstrate sophisticated methods to steal credentials, backdoor developer environments, and propagate malware. Securing the SDLC requires a shift from reactive code scanning to strict execution control and continuous visibility across developer endpoints, build pipelines, and cloud runtimes.
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Researchers have identified 14 malicious npm packages disguised as calendar and streak utilities that deliver a sophisticated Linux backdoor known as RedC2 4.0. These packages, once imported, stealthily execute a Linux implant that communicates with a command-and-control server for post-exploitation activities. The RedC2 framework, marketed as a cross-platform toolkit, features AI-assisted capabilities for orchestrating complex intrusions using natural language commands.
New SynkLoader malware pushed in Microsoft Teams phishing campaign
A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
A new malware family targeting Android-based car head units has been discovered, exploiting built-in firmware updaters for distribution. This malware, attributed to the MoYu Group, aims to facilitate ad fraud and establish a proxy botnet. Researchers noted this is the first documented case of malware specifically designed for car head units with a tailored infection chain.
In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug
Other noteworthy stories that might have slipped under the radar: Threema DDoS attack, Evooo1Bot Linux botnet, Crypto4A secures top-tier NIST certification. The post In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused Bug appeared first on SecurityWeek.
Malware injected into popular Rust packages to steal developer credentials
Malicious actors have compromised several widely-used Rust packages, including arrayref, internment, and append-only-vec, by injecting malware into their build scripts. These poisoned packages, disguised as legitimate updates, were designed to steal developers' credentials. The attack leveraged a typosquatted dependency, proc-macro1, which fetched malware from a remote server during the compilation process. The compromised packages were quickly removed from the registry, but their popularity raises concerns about the potential impact on developers.
New Agent Tesla Malware Variant Boosts Evasion Capabilities
An Agent Tesla v4 malware campaign used novel emoji-based code obfuscation to evade detection, KnowBe4 has revealed
Attackers impersonate popular AI brands to spread malware
Attackers are impersonating popular AI brands like Perplexity, Claude, ChatGPT, and Copilot to spread information stealers, backdoors, malicious browser extensions, and other malware, according to Sophos. Overview of MDR cases with AI involvement (Source: Sophos) Sophos X-Ops reviewed 12 months of managed detection and response cases, covering July 2, 2025 through June 29, 2026. Of 86 cases initia
Hackers abuse FTP server banners to deliver new Windows malware
Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. [...]
The invisible passenger in your car
Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It's delivered through legitimate software for DoFun head units.
CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities
CISA has issued a directive for immediate patching of critical vulnerabilities affecting TrueConf software. The Head Mare hacktivist group is actively exploiting these flaws to distribute the PhantomCore malware. Organizations using TrueConf are urged to apply the necessary updates to prevent further compromise.
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Malicious versions of three popular Rust crates were briefly available on crates.io, a package repository, after a compromised maintainer account published them. These releases contained a build script that, during compilation, would download and execute a remote payload. The affected crates were quickly removed, and there is no evidence of widespread use, but developers are advised to check their systems and pin to older, safe versions of the affected libraries.
China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware
Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign to penetrate Central Asian governments.
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
Manic Android malware combines banking fraud and spyware, using a Bluetooth relay to steal data even when devices are offline. ThreatFabric’s Mobile Threat Intelligence team has identified a new Android malware, dubbed Manic, which has been active in the wild since at least February 2026. The researchers state that the malware is still under development […]
Hackers poison arrayref Rust crate to push infostealer malware
Hackers compromised the maintainer account for the popular Rust crate `arrayref`, injecting malware that executes during the compilation process on developers' systems. This supply-chain attack also affected two other crates, `append-only-vec` and `internment`, within a short timeframe. The malware, disguised as a dependency, attempts to steal credentials from browsers and establish persistence across various operating systems.
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More
This week's cybersecurity landscape features several significant threats, including the abuse of legitimate signed drivers for kernel operations, a large-scale cyber espionage campaign by an Iran-based group targeting universities, and malware utilizing DLL sideloading. Additionally, advancements in AI safety are being explored by OpenAI and Google, while a new service, Kriminal AI, offers unfiltered AI responses, raising concerns about misuse. Apple is also modifying its App Tracking Transparency feature in Germany following regulatory scrutiny.
CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
Executive Summary ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to escalate to SYSTEM. A public PoC was released on August 12, 2026, and Microsoft assigned the CVE on August 14, and no patch is available yet. Qualys VMDR provides detection […]
'Grandoreiro' Malware Resurfaces With Mexico Campaign
The banking Trojan, post-law enforcement takedown, is sprucing itself up with features that make detection and analysis harder.
Grok chat duped into swallowing injected instructions
A spoonful of encryption helps the malware go down
Your Mac already has a built-in firewall. Here’s how to get more from it
Malwarebytes Firewall gives you a clearer, more intuitive way to manage your Mac's inbuilt firewall.
New Manic Android malware can exfiltrate data through nearby devices
A new Android malware named Manic targeting users in multiple European countries has a fallback data exfiltration mechanism that uses nearby infected devices. [...]
StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network
StopAndProtect turned nearly 2,000 hacked WordPress sites into a criminal network for malware delivery, data theft, surveillance and ransomware. Check Point Research uncovered a cybercrime operation, dubbed StopAndProtect, that has turned thousands of hacked WordPress websites into a shared platform for malware delivery, data theft, surveillance and ransomware. The operation is a good reminder tha
AI agent suggested installing a malware package. Engineer almost took its advice
Fortunately, the company had a policy of checking source code on GitHub first
MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra
eSentire uncovered a malware campaign combining ClickFix lures with ErrTraffic and Cruciferra
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool (RAT) families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. SilkParasite, first discovered in late 2025, is assessed to be a
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. "The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software
Hunting MacSync Stealer infrastructure through behavioral pivots
MacSync Stealer, a macOS information stealer, has been observed using rapidly changing infrastructure for its operations. Microsoft Defender Experts identified persistent behavioral patterns, such as specific request characteristics and upload methods, that allow for tracking the malware's activity even as its command-and-control domains rotate. These durable pivots enable defenders to investigate payload delivery, data collection, staging, and exfiltration.
New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
Evooo1Bot is a Mirai-based Linux botnet that hijacks routers and IoT devices for DDoS attacks, credential theft and criminal proxy services. Fortinet’s FortiGuard Labs disclosed Evooo1Bot in mid-August, a previously undocumented Linux botnet that’s been active since July 2026. The bot borrows Mirai‘s DDoS engine but adds encrypted command-and-control communications, an SSH brute-force scanner, a [
Cavern C2 Framework Evolves With DNS and Google Apps Script
Researchers have identified new components in the Cavern command-and-control framework, which is being used by Iranian nation-state actors. The framework now leverages DNS and Google Apps Script to disguise its malicious traffic as legitimate activity. This evolution aims to enhance its stealth capabilities in ongoing attacks targeting entities in Israel.
Linux Botnet Evooo1Bot Expands Mirai Capabilities Well Beyond DDoS
The botnet adds exploitation modules, credential theft, and reverse SOCKS relays to turn compromised devices into persistent attacker infrastructure.
Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities
Learn how Tenable One Cloud Exposure helps you unmask the sophisticated tactics of cybercrime group Storm-0501, which carries out Azure-based cloud ransomware campaigns. Tenable One Cloud Exposure uses AI-powered threat stories to expose Storm-0501 TTPs, backed by precision-engineered threat detection alerts. Key takeaways Storm-0501 demonstrates that cloud-first ransomware groups have shifted fro
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 110
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet CISA, FBI and Partners Warn Organizations of […]
New AmnesiaStealer macOS malware hijacks browser sessions via remote control
A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. [...]
Crooks Buy Expired Domains for Malware Delivery, Other Threats Detailed
Cybercriminals are exploiting expired domain names to distribute malware, a tactic highlighted in a recent security newsletter. The newsletter also covers a range of other threats including zero-day exploits in macOS and GeoServer, a data leak affecting Chess.com users, and attacks targeting Adobe Commerce and SharePoint.
Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: GitHub Dependabot malware alerts now cover eight ecosystems GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates.io, or PHP Composer package has had no such warning, because GitHub’s malware detection only ever watched one ecosystem. That ch
Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware
Attackers are buying expired domains to exploit their reputation, traffic and DNS history, using them for malware delivery, scams and C2 infrastructure. Every day, roughly 65,000 domain names that once belonged to someone else get re-registered by a new owner. Infoblox Threat Intel calls these dropcatch domains, and in the first half of 2026 they […]
New Evooo1Bot Linux botnet turns routers into traffic relay nodes
A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. [...]
New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies
Evooo1Bot is a newly observed botnet based on the Mirai framework but equipped with advanced features, turning edge devices into persistent proxies
Android Malware Steals Payment Card Data via NFC
Researchers have identified a new Android malware called WindRelay that can intercept payment card information transmitted via NFC while the card is still in the user's possession. This malware operates in conjunction with the SpyNote trojan, granting attackers remote control over infected devices. The attack typically begins with a social engineering tactic where a fraudster impersonates a bank representative.
AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions
The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies. The post AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions appeared first on SecurityWeek.
New Mirai variant adds stealth capabilities to notorious botnet code
Beyond Mirai’s usual functions, the new code features include encrypted communications with command-and-control servers and a “sniffer” that looks for default access credentials.
The Model Is the Malware | What Four Agentic Intrusions Tell Defenders
OpenAI, Anthropic and Meta disclosed agents reaching external systems. The tools didn't matter, and that changes the playbook for investigating intrusions.
Multi-Functional Linux Botnet “Evooo1Bot”
FortiGuard Labs analyzes Evooo1Bot, a modular Linux botnet targeting internet-facing devices with DDoS, SSH attacks, CVE exploits, and SOCKS relays
New Android malware lets criminals use your bank card in real time
Social engineering, a Remote Access Trojan (RAT), and NFC relay malware walk up to an ATM. It's no joke. Together, they can empty your bank account.
Using Gemma4 with Ollama - Testing File Hash Analysis and Recommendations with AI, (Wed, Aug 12th)
In the past few weeks, I have been using Gemma4 as a Large Language Model (LLM) to see how useful it can be to analyze some of the malware hashes uploaded to the DShield sensor over the past 30 days and figure out how its recommendation can be considered useful about the activity my DShield sensor is collecting and tracking. The model I use for this testing is gemma4:e4b [2] using two sites to com
Malware Crypting Services Aid Threat Actors in Evading Detection
Malware crypting services are evolving beyond simple payload modification to offer comprehensive malware enablement. These services help threat actors bypass security software, complicate analysis, and maintain malware functionality even after detection. A competitive market exists, primarily focused on Windows payloads, with providers advertising on various underground and social platforms.
Android malware combo takes out loans and relays victims' credit cards
A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to attackers in real time. [...]
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
The Lazarus Group, a North Korean state-sponsored hacking collective, has been linked to a sophisticated cyber espionage campaign dubbed Operation Dream Job. This campaign leverages a recently patched Windows zero-day vulnerability (CVE-2026-68820) to escalate privileges and deploy a new backdoor named Troy. The group targets defense and aerospace companies in France, Germany, Brazil, and India by impersonating recruiters on platforms like LinkedIn and offering fake job opportunities.
WindRelay Malware Pairs With SpyNote RAT in Live-Call Scam
New WindRelay NFC malware paired with SpyNote RAT let a fraudster clone a card mid-call
737 Chrome Extensions Caught Routing User Traffic Through Proxies
Researchers discovered 737 Chrome extensions, primarily targeting Russian-speaking users, that were secretly routing browser traffic through proxy servers. These extensions, which accumulated over 75,000 installations, were designed to bypass blocked services while potentially intercepting user data. Many of these extensions also impersonated legitimate services.
Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day
Lazarus malware used post-quantum key exchange to protect delivery of a Windows zero-day exploit
Lazarus hackers pair fake job offers with Windows zero-day exploit
The North Korea-linked Lazarus group is using fake job offers, trojanized PDF software and a Windows zero-day in attacks aimed primarily at the defense sector, Check Point researchers have found. The activity is part of Operation Dream Job, a long-running campaign in which attackers pose as recruiters and lure targets with job opportunities at well-known companies. One of the decoy documents uncov
Ready-made $500 kit puts a crypto scam within anyone’s reach
A seller on a cybercrime forum is offering a ready-made scam kit for $500, complete with an admin panel that tracks victims, checks their crypto wallets for value, and inflates fake balances to squeeze out more money, Malwarebytes found. Researchers discovered the scam project on May 16 and described it as an example of how social engineering, phishing, and financial fraud can be combined into a s
Kimwolf botnet rebuilt to survive takedowns, researchers say
Months after police seized its servers and arrested an alleged operator, the Kimwolf botnet is running code that disguises attacks as Chrome traffic and fetches its orders from the Ethereum blockchain. The post Kimwolf botnet rebuilt to survive takedowns, researchers say appeared first on CyberScoop.
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145, which is a subgroup within Sandworm (aka APT44,
Cisco Warns of Seven ClamAV Flaws, Two With Public PoCs
Cisco warns that seven ClamAV flaws affect Secure Endpoint Connector products, with two having public PoCs that could enable remote DoS attacks. Cisco warned that seven ClamAV vulnerabilities affect its Secure Endpoint Connector on Windows, macOS and Linux. ClamAV is an open-source antivirus engine widely used to scan files and emails for malware. The company […]
Gym rat asks AI agent to book him a class, it hacks a waitlist API to bump him up the list
What wouldst thou ask of the monkey's paw?