Malware – Page 3 – ADMIN.FOUNDATION

Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data

Warden Stealer as a rapidly growing malware-as-a-service operation targeting data stored by AI assistants and coding agents, including Claude, Codex, Grok, and Cursor. The Rust-based infostealer is among the first malware families observed systematical…

·

AI, cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2

MATCHBOIL’s evolution from a basic C# downloader into a more evasive implant supporting recurring command-and-control communication. Operated by UAC-0099, the malware now incorporates sandbox checks, commercial .NET obfuscation, deceptive interfaces, a…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones

Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on.

·

Adfraud, Android, bitdefender, cybersecurity, Malware, MediaTek, Midnight Mimosa, Privacy, Proxyware, Security

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware

A threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secret…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Hackers Target Hotels With Fake Guest Complaints to Deploy Blockchain-Based RAT Malware

Hackers are targeting hotels with fabricated guest complaints and negative reviews to distribute EtherRAT and TONResolver, two malware families that abuse public blockchains to locate their command-and-control infrastructure. The activity appears to ex…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion

A cryptocurrency mining campaign dubbed PoeLLM has compromised more than 3,400 servers by targeting exposed AI infrastructure and other internet-facing applications. Active since April 2026, the operation combines vulnerability exploitation, cryptocurr…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
100+ Ukrainian Websites Hacked to Install Lunex Stealer with ClickFix Lure

Over 100 hacked Ukrainian websites used fake Cloudflare checks to install Lunex Stealer and steal browser passwords, tokens and cryptocurrency wallets.

·

Cyber Attack, cybersecurity, Infostealer, Lunex Stealer, Malware, Security, Ukraine

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Partisan Zmiy Malware Campaign Uses Telegram and DNS Tunneling to Target Healthcare Networks

A prolonged Partisan Zmiy intrusion into a medical organization, exposing an updated malware toolkit that combined Telegram command channels, DNS tunneling, and scheduled payload execution. Investigators joined the response in December 2025 and traced …

·

cyber security, Cyber Security News, Malware, Telegram

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes

ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command ex…

·

cyber security, Cyber Security News, IoT, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor

Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes.

·

backdoor, ClingSTUN, Cyber Attack, FortiGuard, IoT, Linux, Malware, Security, STUN, vulnerability

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

Category: Malware