Malware

Malware

Amatera: How the prolific infostealer works and spreads

The malware that topped ESET’s infostealer detections in Latin America in the first half of 2026 is an example of how cybercrime has professionalized

Ransomware

External Teams Chats Anchor 15-Minute Malware Delivery

Mail bombing is getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.

Malware

'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants

The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.

Malware

Worm armed 42 GitHub repos by hiding a payload too big to fail

Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search

Malware

Trust Is Not What It Seems — and Fraudsters Are Counting on It

Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.

APT & Nation-state

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm

Malware

What are self-replicating ‘AI worms’, and why is Anthropic worried about them?

The tech company says successful AI worms need more capability on less powerful devices, but current trends make that feasible by the end of the yearWarnings about what artificial intelligence might do in the future –…

APT & Nation-state

AI-Powered Espionage Campaign Targets Government Linux Infrastructure

Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.

Malware

Targeted ads delivered 0-click exploits to install mercenary malware

The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads.

Malware

2026-017: Critical Vulnerability in Cisco Secure Email Gateway

On 14 October 2026, Cisco published a security advisory addressing a critical vulnerability affecting the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. This vulnerability could allow an…

Malware

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware.

Malware

MATCHBOIL: New tricks, same old evil intentions

ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026

Malware

Blinder Tunnel Campaign Targets Iraqi Infrastructure

Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.

Ransomware

Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

The EtherRAT malware family was first reported by Sysdig back in December 2025. At that time, the initial access vector was exploitation of CVE-2025-55182 (React2Shell) targeting Linux servers. In March 2026, a Windows…

Ransomware

Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Overview Bumblebee malware has been an initial access tool used by threat actors since late 2021. In 2023 the malware was first reported as using SEO poisoning as a delivery mechanism. Recently in May of 2025 Cyjax…

Ransomware

KongTuke FileFix Leads to New Interlock RAT Variant

Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware, a shift from the previously…