Latest Malware news

CoralRaider attacks use CDN cache to push info-stealer malware

A threat actor has been using a content delivery network cache to store information-stealing malware in an ongoing campaign targeting systems U.S., the U.K., Germany, and Japan.
- Bill Toulas
- April 23, 2024
- 05:27 PM
- 0
Hackers hijack antivirus updates to drop GuptiMiner malware

North Korean hackers have been exploiting the updating mechanism of the eScan antivirus to plant backdoors on big corporate networks and deliver cryptocurrency miners through GuptiMiner malware.
- Bill Toulas
- April 23, 2024
- 10:56 AM
- 0
GitLab affected by GitHub-style CDN flaw allowing malware hosting

BleepingComputer recently reported how a GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with Microsoft repositories, making the files appear trustworthy. It turns out, GitLab is also affected by this issue and could be abused in a similar fashion.
- Ax Sharma
- April 22, 2024
- 11:05 AM
- 0
Malware dev lures child exploiters into honeytrap to extort them

You rarely root for a cybercriminal, but a new malware campaign targeting child exploiters doesn't make you feel bad for the victims.
- Lawrence Abrams
- April 21, 2024
- 02:49 PM
- 2
GitHub comments abused to push malware via Microsoft repo URLs

A GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with a Microsoft repository, making the files appear trustworthy.
- Lawrence Abrams
- April 20, 2024
- 10:14 AM
- 1
Fake cheat lures gamers into spreading infostealer malware

A new info-stealing malware linked to Redline poses as a game cheat called 'Cheat Lab,' promising downloaders a free copy if they convince their friends to install it too.
- Bill Toulas
- April 18, 2024
- 08:46 PM
- 0
SoumniBot malware exploits Android bugs to evade detection

A new Android banking malware named 'SoumniBot' is using a less common obfuscation approach by exploiting weaknesses in the Android manifest extraction and parsing procedure.
- Bill Toulas
- April 17, 2024
- 05:38 PM
- 0
Moldovan charged for operating botnet used to push ransomware

The U.S. Justice Department charged Moldovan national Alexander Lefterov, the owner and operator of a large-scale botnet that infected thousands of computers across the United States.
- Sergiu Gatlan
- April 17, 2024
- 02:53 PM
- 0
Multiple botnets exploiting one-year-old TP-Link flaw to hack routers

At least six distinct botnet malware operations are hunting for TP-Link Archer AX21 (AX1800) routers vulnerable to a command injection security issue reported and addressed last year.
- Bill Toulas
- April 17, 2024
- 09:03 AM
- 3
New SteganoAmor attacks use steganography to target 320 orgs globally

A new campaign conducted by the TA558 hacking group is concealing malicious code inside images using steganography to deliver various malware tools onto targeted systems.
- Bill Toulas
- April 15, 2024
- 04:31 PM
- 0
Firebird RAT creator and seller arrested in the U.S. and Australia

A joint police operation between the Australian Federal Police (AFP) and the FBI has led to the arrest and charging of two individuals who are believed to be behind the development and distribution of the "Firebird" remote access trojan (RAT), later rebranded as "Hive."
- Bill Toulas
- April 13, 2024
- 10:17 AM
- 0
CISA makes its "Malware Next-Gen" analysis system publicly available

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a new version of "Malware Next-Gen," now allowing the public to submit malware samples for analysis by CISA.
- Bill Toulas
- April 11, 2024
- 06:27 PM
- 0
Apple: Mercenary spyware attacks target iPhone users in 92 countries

Apple has been notifying iPhone users in 92 countries about a "mercenary spyware attack" attempting to remotely compromise their device.
- Bill Toulas
- April 11, 2024
- 10:16 AM
- 2
Chrome Enterprise gets Premium security but you have to pay for it

Google has announced a new version of its browser for organizations, Chrome Enterprise Premium, which comes with extended security controls for a monthly fee per user.
- Ionut Ilascu
- April 10, 2024
- 03:52 PM
- 1
Malicious Visual Studio projects on GitHub push Keyzetsu malware

Threat actors are abusing GitHub automation features and malicious Visual Studio projects to push a new variant of the "Keyzetsu" clipboard-hijacking malware and steal cryptocurrency payments.
- Bill Toulas
- April 10, 2024
- 07:00 AM
- 0
Microsoft fixes two Windows zero-days exploited in malware attacks

Microsoft has fixed two actively exploited zero-day vulnerabilities during the April 2024 Patch Tuesday, although the company failed to initially tag them as such.
- Sergiu Gatlan
- April 09, 2024
- 06:06 PM
- 0
RUBYCARP hackers linked to 10-year-old cryptomining botnet

A Romanian botnet group named 'RUBYCARP' is leveraging known vulnerabilities and performing brute force attacks to breach corporate networks and compromise servers for financial gain.
- Bill Toulas
- April 09, 2024
- 11:30 AM
- 0
New Latrodectus malware replaces IcedID in network breaches

A relatively new malware called Latrodectus is believed to be an evolution of the IcedID loader, seen in malicious email campaigns since November 2023.
- Bill Toulas
- April 04, 2024
- 04:38 PM
- 0
Visa warns of new JSOutProx malware variant targeting financial orgs

Visa is warning about a spike in detections for a new version of the JsOutProx malware targeting financial institutions and their customers.
- Bill Toulas
- April 04, 2024
- 03:29 PM
- 0
DinodasRAT malware targets Linux servers in espionage campaign

Security researchers have observed Red Hat and Ubuntu systems being attacked by a Linux version of the DinodasRAT (also known as XDealer) that may have been operating since 2022.
- Bill Toulas
- March 31, 2024
- 10:35 AM
- 0