-
Open VSX has removed three extension identifiers from its malicious-extension list after the legitimate projects they impersonated began reclaiming their names. The move restores publishing access for the affected maintainers but highlights a supply-ch…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
SynkLoader, a newly identified modular malware framework that combines Python, C#, C++, PowerShell, and memory-resident payloads to evade endpoint detection. Delivered through Microsoft Teams phishing, the operation uses a convincing fake Windows lock …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
AmnesiaStealer, a multi-stage macOS infostealer written in Rust that moves beyond conventional credential theft by giving attackers covert, interactive control over a victim’s authenticated Chromium browser sessions. The malware is being distributed th…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A multi-stage Android malware campaign that abuses the firmware-update mechanism of Android-based automotive head units to deploy ad-fraud tooling and enroll vehicles into a residential proxy botnet. The activity, discovered in June 2026, is the first …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A business email compromise campaign is using emoji-filled JScript to conceal an Agent Tesla v4 infostealer designed to steal browser, email, and messaging credentials. The operation pairs a convincing bank-payment lure with a fileless execution chain …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Head Mare APT group has been linked to a supply chain compromise involving unpatched TrueConf Server instances, which enabled the delivery of PhantomCore malware to video conference participants. Kaspersky researchers identified this activity while…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly discovered Android malware family called Manic, which combines banking fraud functions with advanced spyware and remote device control capabilities. The operation’s active infrastructure dates back to February 2026, with early wrappers an…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Threat actors are pairing fake CAPTCHA verification pages with a commercial malware loader capable of disabling endpoint defenses, creating a high-impact infection chain that begins with a victim manually executing a malicious PowerShell command. In la…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A supply-chain campaign targeting OpenClaw has shown how threat actors can turn autonomous AI agents into persuasive malware-delivery intermediaries. Rather than relying only on exploit code, attackers poisoned the ClawHub skill registry with seemingly…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Aeternum operators are abusing Polygon smart contracts as a decentralized dead-drop resolver, allowing malware to retrieve and rotate command-and-control (C2) domains without depending on conventional attacker-owned servers. The approach turns a public…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
