A convincing fake CCleaner website delivers a multi-stage malware attack that installs a spyware extension inside Chrome.
Tag: MALWARE
Kimsuky Brings AI Closer to Its Malware and Phishing Operations
North Korean cyber-espionage group Kimsuky appears to be moving beyond occasional use of public AI services by assembling a local artificial intelligence…
Hackers Hide Malware Infrastructure on Polygon Blockchain and Trick Users Into Running It With ClickFix
Hackers are using the Polygon blockchain to keep parts of a malware operation out of plain sight. The campaign, tracked as ErrTraffic, turns hacked…
Chinese-speaking Hacking Group Attacking Users With Fake DeepSeek Page to Deliver Malware
Chinese-speaking cybercriminals are using fake software pages that imitate popular artificial intelligence tools to infect Windows users with remote…
ErrTraffic Combines WordPress Hacks, Blockchain C2 and Rotating Malware Domains in One Delivery Network
An active ErrTraffic malware-as-a-service campaign that combines compromised WordPress sites, ClickFix lures, Polygon blockchain smart contracts and…
Kimwolf v7: An Evolution of the Kimwolf Botnet
Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing.
GitHub Expands Supply Chain Malware Detection From npm to 8 Package Registries
GitHub has expanded its malware detection capabilities beyond npm, providing developers with broader protection against malicious open-source packages.…
Fake The Odyssey Downloads Are Hiding Password-Stealing Malware
Fake downloads of The Odyssey are spreading Lumma Stealer malware capable of stealing passwords, cookies, payment data, and cryptocurrency information.
Google Play Apps Use Stealth Loaders to Deliver Anatsa Banking Malware
Android users are facing a fresh reminder that a familiar app-store listing can hide a financial threat. Researchers have observed malicious loaders on…
Meccha Chameleon Vulnerability Allowed Malware to Spread Through Steam Workshop Maps
A security vulnerability in the game Meccha Chameleon enabled malicious custom maps stored on Steam Workshop to infect users with malware. The…
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development
North Korea’s state hackers are no longer content to type prompts into public chatbots. One of the country’s main espionage groups has begun running…
Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge
Global malware activity climbed sharply over the past week, with remote access trojans (RATs), information stealers, and loaders all posting significant…
Android Banking Droppers Surge as Malware Operators Change Packaging Tactics
Android banking malware operators are increasingly relying on dropper-based packaging to evade mobile app-store controls, shifting how threats are…
GitHub Expands Dependabot Malware Alerts to Detect Malicious Packages Across 8 Ecosystems
GitHub has expanded its Dependabot malware alerts beyond npm, enabling the detection of malicious dependencies across various package ecosystems,…
Fake Solidity Pro Extensions Turn Trusted Developer Tooling Into Credential-Stealing Malware
Malicious “Solidity Pro” extensions are abusing the trust developers place in VS Code and Open VSX tooling, evolving from delayed payload droppers into…
Go-Based macOS Malware Steals Crypto and Secrets
A macOS malware variant has been detected stealing crypto, passwords and more
GitHub Dependabot malware alerts now cover eight ecosystems
GitHub has flagged npm malware since March 2026. Anyone pulling in a bad PyPI, Maven, RubyGems, NuGet, Go, crates.io, or PHP Composer package has had no…
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 109
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter…
Malvertising Campaign Uses Fake Crypto Websites to Build Malware Directly in Browser Memory
A major malvertising campaign targets crypto investors and traders with fake Solana, Luno and TradingView sites offering to install malicious JavaScript…
Malware Abuses Windows Hello for Business Key to Authenticate Microsoft Entra ID
A newly demonstrated technique shows how malware in a compromised Windows user session can abuse Windows Hello for Business (WHFB) cryptographic keys to…