People who buy low-cost Android phones from online marketplaces may be carrying malware that was placed on the device before it reached them, Bitdefender…
Tag: MALWARE
WhatsApp-Delivered Malware Injects Into Windows Task Scheduler to Run as SYSTEM
A WhatsApp-delivered financial-document lure is being used to deploy a sophisticated Windows malware chain that injects code into the Task Scheduler…
Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
Midnight Mimosa, an Android malware campaign embedded in firmware that monetizes compromised smartphones through advertising fraud and residential proxy…
Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites
A Casbaneiro banking trojan campaign in August 2026 that targeted Latin American users via phishing emails and malicious PDFs disguised as invoices and…
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 118
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter…
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7…
Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countries
Bitdefender finds Midnight Mimosa, preinstalled Android malware on cheap MediaTek phones that fakes ad clicks, drops apps and builds a proxy botnet.…
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
Russia-aligned UAC-0099 has steadily upgraded its MATCHBOIL downloader since 2024
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI…
CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
CastleStealer, an emerging C#-based information stealer, has added browser protection bypass and remote shell features that give its operators a wider…
Android Phones Found With Malware Already Installed Before Purchase
Bitdefender uncovered Midnight Mimosa malware preinstalled on low-cost Android phones, enabling hidden ad fraud and raising device supply-chain security…
FBI seizes domains linked to China-nexus botnet
The infrastructure supported an international hacking campaign that targeted critical infrastructure, including a South Carolina-based power company.
Midnight Mimosa Malware on Budget Android
Security researchers have identified a widespread malware campaign dubbed Midnight Mimosa that targets users of budget Android smartphones across more…
Russian-Aligned Spies Upgrade MATCHBOIL Malware Targeting Ukraine
The Russian-aligned cyber espionage group UAC-0099 has continued developing the MATCHBOIL malware for use in attacks against Ukrainian companies involved…
Hackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware
A newly identified supply-chain campaign is abusing Terraform provider workflows to infect developer systems with malware built for macOS, Linux, and…
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Noteworthy stories that might have slipped under the radar: Tensorlake npm SDK compromised, Empire Market co-founder gets 40 years, exposed NVIDIA GPU…
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer, a C# information stealer first publicly identified in April 2026, has expanded its capabilities beyond credential theft. New samples…
Poetry-powered botnet, Flock hits a roadblock, Outlook blocks risky installers
Botnet takes orders from a poem https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/ Flock’s warrantless tracking hits a roadblock…
VirusTotal Adds Scanning for Public IPv4 Space to Expose C2 Servers and Malware Infrastructure
VirusTotal has added daily scanning of the public IPv4 space, giving security teams a new way to find command-and-control (C2) servers and track malware…
MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloads
MATCHBOIL, a C# malware downloader linked to UAC-0099, uses command-and-control (C2) servers hidden behind Cloudflare to deliver backdoor payloads. Its…