Malware – Page 45 – ADMIN.FOUNDATION

New PXA Stealer Malware Targets Banks, Uses Telegram to Exfiltrate Data

CyberProof researchers have detected a 10% surge in PXA Stealer attacks targeting financial institutions in Q1 2026. Learn…

·

CyberProof, cybersecurity, Infostealer, Malware, PXA Stealer, Security

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
GhostClaw AI Malware Targets macOS Users with Credential-Stealing Payloads

GhostClaw is a multi-stage macOS infostealer that now abuses both GitHub and AI-assisted development workflows to harvest credentials and deploy secondary payloads, significantly widening its potential victim base. Jamf Threat Labs has since expanded o…

·

AI, cyber security, Cyber Security News, macOS, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Suspected Hijacked Developer Accounts Spread npm Malware

Sonatype uncovers a sophisticated malware campaign using hijacked npm developer accounts to steal API keys and passwords. Is your dev environment at risk?

·

Cyber Attack, cybersecurity, Developer, Malware, npm, Security, Sonatype

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Torg Grabber Malware Shifts from Telegram Exfiltration to Encrypted REST API for C2

A fast-evolving information‑stealing malware dubbed “Torg Grabber” that has shifted from simple Telegram‑based exfiltration to a hardened, encrypted REST API command‑and‑control (C2) channel fronted by Cloudflare. The operation surfaced when a 747 KB 6…

·

cyber security, Cyber Security News, Malware, Telegram

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Fake Screenshot Lures Target Web3 Support Staff with Multi-Stage Malware Attack

Fake screenshot links are being used to quietly deploy a multi‑stage backdoor against Web3 customer support teams, in a campaign assessed to be linked to the Chinese financially motivated group APT‑Q‑27 (GoldenEyeDog). The operation abuses live chat wo…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Kiss Loader Malware Targets with Early Bird APC Injection in New Attack Campaign

A newly identified malware loader dubbed “Kiss Loader” is emerging as a potential threat, leveraging advanced process injection techniques and dynamic delivery infrastructure. The loader, still under active development at the time of discovery, demonst…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Fake npm Install Messages Conceal RAT Malware in New Open Source Supply Chain Attack

Fake npm install messages are the latest social engineering trick in the open source supply chain, with attackers abusing npm post‑install scripts to silently deploy a crypto‑stealing remote access trojan (RAT) in what ReversingLabs is calling the “Gho…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Fake VS Code Security Alerts on GitHub Spread Malware in Massive Phishing Attack

A large-scale phishing campaign is actively targeting developers on GitHub by abusing the platform’s Discussions feature to distribute fake Visual Studio Code (VS Code) security alerts. The campaign appears highly coordinated, with thousands of near-id…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Mirai Malware Evolves into Hundreds of Variants Driving Botnet Growth

Mirai malware evolves into hundreds of variants, driving botnet growth, including Aisuru and KimWolf, powering large-scale attacks, and increasing risks to vulnerable IoT devices worldwide.

·

Botnet, Cyber Attack, Cyber Crime, Cyber-Attacks, cybersecurity, DDOS, IoT, Kimwolf, Malware, Mirai, Security

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Obfuscated VBS and PNG Loaders Power New Open Directory Malware Campaign with RAT Payloads

A sophisticated, multi-stage delivery framework leveraging obfuscated Visual Basic Script (VBS) files, fileless PowerShell loaders, and payloads hidden within PNG images. The activity was initially detected by LevelBlue’s Managed Detection and Response…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

Category: Malware