Malware analysis, reverse engineering findings, and detection guidance.
56 items
A SANS Internet Storm Center lab report documents an observed Atomic macOS Stealer infection chain: a ClickFix lure at getmacouscloud[.]com directs users to paste a command into Terminal, which runs a base64-encoded dropper. The report provides network and file indicators for defenders.
Unit 42 observed XCSSET v40 spreading through infected Xcode projects from April 2026, with a second wave and new modules in May. Activity focused on developers in South Asia and added Chrome-hijacking and Telegram-trojanising capabilities.
Bitsight researcher Pedro Falé linked H96 streaming boxes to Fengwo Group infrastructure that alternated between residential proxying and ad fraud. Bitsight observed approximately 38,000 devices and estimated ad-fraud revenue near $50,000 per day.
Threat actors are posting fake technical support threads on Steam discussion forums linking to ClickFix malware, which executes XMRig cryptocurrency miners on victim systems. The attack exploits the high trust and technical audience of Steam's community to achieve broad distribution among gamers.
Dolphin X, a new remote access trojan, incorporates machine learning to profile and rank infected hosts by value, enabling attackers to concentrate resources on high-yield targets. This represents a meaningful shift toward data-driven targeting in commodity malware.
ClickLock is a new macOS information-stealer that terminates all visible processes to coerce users into entering their system login password, bypassing normal user friction and capturing credentials before defenders can respond.
Researchers discovered TuxBot v3 Evolution, an IoT botnet framework apparently developed with LLM assistance, revealing that while AI can generate functional malware code, poor operational security by developers (ignoring safety disclaimers) remains a limiting factor in threat sophistication.
A previously undocumented Rust-based remote access trojan uses NVIDIA software masquerading as a social engineering vector to establish persistent hands-on access to Windows systems. The malware's use of a compiled language and legitimate vendor branding suggests a sophisticated threat actor.
A new macOS information stealer called CrashStealer uses Apple-notarised droppers to evade Gatekeeper protections. Written in native C++ rather than scripting languages, it validates victim credentials locally before exfiltration.
The Gentlemen ransomware operation has scaled through an affiliate recruitment model, enabling rapid growth and diversified targeting across multiple sectors. This represents a maturing threat group adopting proven operational patterns from established ransomware families.
Latvia's state-owned forestry company LVM was struck by a financially-motivated ransomware attack from a foreign threat group and remains in recovery weeks later, indicating either significant infrastructure complexity or data exfiltration complications that extend remediation timelines.
JadePuffer ransomware was deployed and operated autonomously by an LLM agent, marking the first documented case of a fully AI-driven ransomware campaign. This represents a significant escalation in attack automation where threat actors delegate operational decisions to language models rather than manual execution.
Google and partners have disrupted NetNut, a residential proxy network exploiting approximately 2 million compromised Android devices, IoT boxes, and smart TVs. The takedown removes a significant infrastructure-as-a-service operation that enabled credential stuffing, ad fraud, and content scraping at scale.
US federal law enforcement seized NetNut, an Israeli residential proxy service operated by publicly-traded Alarum Technologies, following security research linking it to the Popa botnet comprising at least two million compromised devices. The action represents significant progress in disrupting a major abuse infrastructure that enabled attackers to mask malicious traffic through residential IP addresses.
A malicious Chrome extension masquerading as the Perplexity AI search engine intercepted all user searches and address bar input, routing them through an attacker-controlled server before delivering results. Google removed the extension after Microsoft's responsible disclosure, but the attack demonstrates how supply chain compromises in browser extension marketplaces can enable large-scale data harvesting.
A previously undocumented loader malware called SharkLoader has been observed in a campaign tracked as StrikeShark, delivering Cobalt Strike Beacon to diplomatic organisations in Indonesia and government networks in Taiwan. The campaign represents a targeted operation against sensitive government infrastructure using commodity post-exploitation tools.
ESET participated in a coordinated international operation that successfully disrupted the Amadey botnet and Stealc infostealer malware families. The operation demonstrates the effectiveness of multi-agency collaboration in dismantling active malware infrastructure at scale.
AryStinger, a previously undocumented botnet, has compromised over 4,000 outdated D-Link routers worldwide to operate as proxy infrastructure for malicious traffic. The campaign highlights the security debt posed by end-of-life networking equipment still deployed in production environments.
A new ransomware family named Prinz Eugen prioritises recently modified files for encryption and omits ransom notes, suggesting operators are optimising for speed and evasion. This behaviour pattern indicates a maturing threat actor focused on minimising forensic artefacts.
Law enforcement conducted a coordinated international operation against the SocGholish botnet, a distribution mechanism linked to Russia-based cybercrime group Evil Corp. The disruption degrades Evil Corp's ability to deliver secondary payloads and conduct follow-on attacks against compromised networks.
Popa, a multi-year Android botnet compromising millions of consumer TV boxes, has been attributed to NetNut, a residential proxy service operated by publicly-traded Israeli firm Alarum Technologies. The botnet facilitates advertising fraud, account takeovers, and mass data scraping under commercial cover.
Gentlemen ransomware-as-a-service is actively developing and maintaining multiple EDR killer tools to help affiliates disable endpoint defences during attacks. This represents a shift towards commoditised EDR bypass capabilities within the RaaS ecosystem.
Attackers are increasingly deploying infostealers to harvest credentials at scale, using stolen login details as the primary entry vector for ransomware and other operations rather than relying on exploits. This trend indicates defenders must prioritise credential hygiene and detection of infostealer activity.
A China-linked botnet called JDY has expanded to compromise over 1,500 small office, home office, and IoT devices, operating as a centralised scanner for discovering and mapping exposed internet-facing services. This represents a significant reconnaissance infrastructure used by state-sponsored actors to identify targets at scale.
NFCShare Android malware variants are being distributed as fake updates for legitimate banking applications hosted on GitHub repositories. This attack exploits developer trust in source code platforms and user expectations of app updates, bypassing traditional mobile security controls.
A new Gafgyt botnet variant called C0XMO is actively targeting DD-WRT router firmware vulnerabilities to establish a botnet capable of spreading to multiple device architectures. This represents an evolution in router-targeting malware with potential for rapid propagation across heterogeneous IoT environments.
A previously unidentified threat actor is distributing NetSupport RAT, a legitimate remote access tool repurposed for malicious purposes. This represents an active malware campaign using RAT tooling for post-compromise control.
Dutch law enforcement and the NCSC successfully dismantled a botnet commanding at least 17 million infected devices across multiple platforms, with over 200 command-and-control servers operating from the Netherlands. This represents a significant disruption to a large-scale criminal infrastructure, though the source and purpose of the botnet remain unclear from available details.
Threat actors are abusing ChatGPT's legitimate content-sharing feature to host convincing fake OpenAI outage pages that redirect users to download malware masquerading as the official ChatGPT desktop client. This exploits user trust in OpenAI's infrastructure and takes advantage of the feature's legitimacy to bypass security filters.
A phishing campaign is distributing ACR Stealer through fake Claude AI pages. This represents an active social engineering threat targeting users seeking legitimate AI tools.
Canadian authorities arrested a 23-year-old suspected operator of Kimwolf, an IoT botnet that compromised millions of devices for large-scale DDoS attacks. The arrest and cross-border charges signal coordinated enforcement against botnet operators who target journalists and security researchers.
Ukrainian cyberpolice and U.S. law enforcement identified and disrupted an infostealer malware operation run by an 18-year-old from Odesa who had compromised approximately 28,000 user accounts from a California-based online retailer. The case demonstrates effective international law enforcement coordination against financially-motivated cybercriminals operating from Eastern Europe.
Symantec and Carbon Black have analysed the Lua-based Fast16 malware, a pre-Stuxnet cyber sabotage tool designed to corrupt uranium-compression simulations used in nuclear weapons design. The discovery provides historical evidence of advanced persistent threat capabilities targeting critical infrastructure simulation environments.
Russian state-sponsored group Turla has rebuilt its Kazuar backdoor into a modular peer-to-peer botnet designed for stealth and persistent command-and-control. This represents a significant operational upgrade that complicates detection and attribution for defenders.
VECT 2.0 ransomware contains a critical implementation flaw in nonce handling that causes it to permanently destroy files above a certain size rather than encrypt them. This unintended behaviour converts the malware into a data wiper, eliminating ransom recovery options and increasing damage to victims.
Researchers discovered a Lua-based malware framework dating to 2005 that targeted engineering software for cyber sabotage, predating Stuxnet by several years and suggesting a deeper operational history of state-sponsored infrastructure attacks.
Threat actor UNC6692 is using Microsoft Teams to socially engineer targets into executing a custom malware suite called Snow, which comprises a browser extension, tunneler, and backdoor. This represents a shift toward trusted communication platforms as malware delivery vectors, complicating detection and increasing organisational risk.
Custom malware called Firestarter persists on Cisco Firepower and ASA devices even after security patches and firmware updates, indicating attackers have achieved privileged compromise that survives standard remediation procedures.
Trigona ransomware operators have developed a custom command-line exfiltration utility to speed up data theft from compromised networks. This represents a shift toward operationalised tooling that reduces dwell time and increases the volume of data stolen per attack.
26 fraudulent cryptocurrency wallet apps mimicking Metamask, Coinbase, Trust Wallet, and OneKey were distributed through Apple's App Store in China, designed to harvest seed phrases and drain user funds. This represents a significant supply chain compromise of a trusted platform targeting high-value assets.
Payouts King ransomware operators are deploying QEMU virtual machines as covert execution containers, using reverse SSH tunnels to maintain hidden command channels that bypass endpoint detection and response tools. This represents a maturation of VM-based evasion tactics in ransomware operations.
ZionSiphon is a newly discovered malware family purpose-built for operational technology environments, specifically engineered to disrupt water treatment and desalination plants. This represents a shift toward adversary-developed sabotage tools for critical infrastructure rather than repurposed IT malware.
CrystalRAT is a new malware-as-a-service offering combining remote access, data theft, keylogging, and clipboard hijacking, distributed via Telegram. The bundling of multiple attack capabilities into a single commodity service lowers the barrier to entry for financially motivated threat actors.
A new iOS exploit kit called Coruna reuses and updates kernel exploits originally deployed in Operation Triangulation three years ago, indicating that sophisticated threat actors are recycling proven attack code rather than developing entirely new exploits.
Hambardzum Minasyan, an Armenian national allegedly involved in developing and administering the RedLine infostealer, has been extradited to the United States. This arrest represents a significant enforcement action against a malware-as-a-service operation that has compromised thousands of organisations globally.
Attackers are deploying payment skimmers that abuse WebRTC data channels to receive malicious payloads and exfiltrate stolen card data, successfully circumventing Content Security Policy controls that block traditional HTTP-based exfiltration vectors.
Torg Grabber is a new infostealer malware targeting 850 browser extensions, predominantly cryptocurrency wallets, to exfiltrate private keys and sensitive account credentials. This represents a significant threat to the crypto ecosystem given the direct targeting of wallet software.
VoidStealer malware has developed a novel technique to bypass Chrome's Application-Bound Encryption (ABE) by leveraging debugger access to extract the browser's master encryption key. This enables attackers to decrypt sensitive stored data including passwords and payment information without user interaction.
Over 100 GitHub repositories are distributing BoryptGrab Stealer, a malware targeting browser and cryptocurrency wallet data, posing significant risks to users.
Ransomware operators are using a combination of legitimate Windows tools and the ClickFix technique to deploy DonutLoader malware and CastleRAT backdoors, posing a significant threat to systems.
The QuickLens Chrome extension was removed after being compromised to push malware aimed at stealing cryptocurrency from users. The attack highlights vulnerabilities in third-party browser extensions and the risks of crypto-related phishing.
North Korean hackers, APT37, are using newly discovered malware to breach air-gapped networks by leveraging removable drives and conducting covert surveillance.
UK retailer Co-op shut down parts of its IT infrastructure after detecting unauthorized access, becoming the second major British retailer hit by cyberattack in weeks following Marks & Spencer.
UK retail giant Marks & Spencer suffered a significant cyberattack that disrupted contactless payments, click-and-collect services, and online ordering, attributed to the DragonForce ransomware operation working with Scattered Spider affiliates.
FBI, CISA, and MS-ISAC warn that the Medusa ransomware-as-a-service operation has impacted over 300 organizations across critical infrastructure sectors since 2021.
A joint advisory warns that the Ghost (Cring) ransomware group, operating from China, has compromised organizations across 70 countries by exploiting known vulnerabilities in internet-facing services.