There have been allegations of spyware targeting two prominent Serbian figures, raising new concerns about digital surveillance in advance of the…
Tag: MALWARE
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.
StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs
The seller behind StealC has returned with Stadia, a Windows remote access trojan that combines password theft with hidden desktop control. Advertised on…
Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware
Public proof-of-concept code for two critical PHP vulnerabilities is now available, and attackers have tried to use the flaws to deploy botnet malware.…
StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown
StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted infostealer into a platform for persistent endpoint…
12 Malware Analysis Tools: The 2026 Buyer’s Verdict Guide
Malware analysis tooling spans a spectrum the acronyms hide: interactive sandboxes where analysts click alongside the malware, evasion-hardened hypervisor…
Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web Shells and Malware
A critical flaw in Citrix NetScaler ADC and NetScaler Gateway is being used to run commands on exposed appliances, install web shells and deliver malware.…
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai…
Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability…
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new…
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The…
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and…
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker used a contributor’s GitHub account to replace the download archives on five existing releases of OVHcloud’s command-line tool on Monday,…
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that’s being used to distribute malware such as Legion…
SEO Poisoning Campaign Delivers New Armorsteal Malware
IntroductionIn September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package…
OVHcloud CLI Packages on GitHub Were Replaced With Secret-Stealing Malware
Attackers replaced the binary releases of OVHcloud’s open-source CLI tool on GitHub with malicious builds designed to harvest secrets from developer…
North Korean Hackers Use Post-Quantum Encryption to Hide New Malware From Security Tools
North Korean-linked Lazarus hackers are using post-quantum cryptography in a malware delivery chain designed to conceal later-stage payloads from security…
Hackers Planted Malware on Japanese Cloud Servers, Forcing the Provider to Shut Down Its Service
Hackers planted malware in customer server environments at Japan’s Onamae.com Desktop Cloud, prompting the provider to begin shutting down servers across…
New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks
A newly identified Android banking Trojan called Hirudo takes an unusual route to financial fraud: it tries to remove a victim’s genuine banking app and…
Researchers Identify Spyware Attacks Targeting Two Serbian Opposition Figures
There have been allegations of spyware targeting two prominent Serbian figures, raising new concerns about digital surveillance in advance of the…