Midnight Mimosa is the name given to a malware campaign primarily running preinstalled on low-cost Android devices.
Tag: MALWARE
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
A campaign in July 2026 using a trojanized Terraform provider to deploy cross-platform malware against developer environments. The operation delivers…
Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data
Warden Stealer as a rapidly growing malware-as-a-service operation targeting data stored by AI assistants and coding agents, including Claude, Codex,…
Malicious PDF Reader With 10,000+ Installs on Google Play Delivers Anatsa Banking Trojan
A malicious Android PDF reader distributed through Google Play has recorded more than 10,000 installs while serving as an installer for the Anatsa banking…
MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2
MATCHBOIL’s evolution from a basic C# downloader into a more evasive implant supporting recurring command-and-control communication. Operated by UAC-0099,…
Midnight Blizzard Targets Hotel Wi-Fi: Malware and Phishing Put Travelers at Risk
Midnight Blizzard is abusing hotel Wi-Fi captive portals to deliver malware and steal credentials from travelers, putting corporate devices and accounts…
FBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive Data
The FBI and international cybersecurity agencies have warned about hackers linked to the Chinese government who use automated vulnerability scanning,…
Low-cost Android phones ship with residential proxy malware
A malware campaign dubbed ‘Midnight Mimosa’ has been discovered on low-cost Android smartphones that ship with malicious software embedded in their…
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
IntroductionIn July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and…
Venezuelan Cartel’s Malware Honcho Nabbed for ATM Jackpotting
The first cybercriminal to ever make the FBI’s “10 Most Wanted Fugitives” list allegedly infused Tren de Aragua’s violent criminal operations with cash.
DarkSword iOS Exploit Platform Uses Coruna Malware to Steal Crypto Wallet Recovery Phrases
DarkSword operators are using Coruna malware to steal cryptocurrency wallet recovery phrases from iPhones, turning browser exploits into a ready-to-use…
Russian Spies Give ‘MatchBoil’ Malware a Stealthy Facelift
Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations.
FakeGit malware campaign returns with 17,610 malicious GitHub repos
More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push…
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large…
Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers
Quoth the LLM, ‘More and more’
PoeLLM malware infects exposed AI servers in cryptomining attacks
A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads. […]
MALFEX npm Campaign Uses Three Malware Delivery Chains
A long-running malware campaign on the npm registry is using malicious JavaScript packages to compromise Windows systems with remote-access malware,…
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
More than 3,400 servers have been compromised by malware that hides its infrastructure coordinates in a poem.
Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones
Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on.
Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain
Hackers are targeting hotels with fake guest complaints and negative reviews that lead staff to malware disguised as photographic evidence. The campaign…