-
A Linux variant of the BambooToken backdoor uses MQTT as its command-and-control channel, enabling operators to profile compromised hosts, execute shell commands, and transfer files through broker-mediated topics. Analysis of a statically linked x86-64…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated npm supply-chain campaign has been linked to 10 malicious JavaScript packages that collectively recorded millions of downloads while bypassing npm’s lifecycle-script protections. The operation centers on a counterfeit package named inde…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
FamousSparrow is targeting Latin American governments with SparroWocky, a new C++ backdoor that exfiltrates files, takes screenshots and evades security tools.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly uncovered EtherHiding campaign has turned the Polygon blockchain into a resilient command-and-control mechanism, allowing operators to rotate malware infrastructure without modifying the payload deployed on victim systems. The operation, active…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Researchers have identified a new Android banking Trojan called RatHat that utilizes artificial intelligence to automate device compromise and steal financial credentials, PINs, and one-time passcodes. Zimperium’s zLabs researchers analyzed this malwar…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, P…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, P…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A suspected supply-chain compromise involving Brevo has exposed visitors and WordPress administrators across more than 100,000 websites to malware. Attackers allegedly abused Brevo-hosted JavaScript assets, signup forms, unsubscribe pages and chat widg…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
AI-powered malware is beginning to erode one of endpoint security’s oldest assumptions: that malicious code will remain stable long enough to identify, fingerprint, and block. A new class of threats uses large language models during execution to rewrit…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
