Malware

Malware

Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes…

Malware

Hackers backdoor Linux servers using trojanized CWP web server

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]

Malware

CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services…

Zero-day

Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog…

Malware

Vercel rolls out new protection against stolen session cookie attacks

Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. [...]

Malware

NIKKE PC game launcher hacked to spread remote access, data-stealing malware

The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game's PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency…

Malware

Google, Partners Disrupt 1.3 Million-Device-Strong XCPE Botnet

Google alleges that Android device manufacturer Videostrong ran the operation, which infected set-top boxes and IoT devices with a backdoor to create infrastructure for criminal activity.

Malware

China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a…

Malware

SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware

ESET Research analyzes a DNS hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method

Malware

Fake-download campaign uses trojanized installers to deliver monetization payloads

Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer…

Malware

Google dismantles botnet secretly running on 1.3 million Android TV boxes

Google has cut ties with the company behind the botnet campaign.

Malware

cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes

An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and…

Malware

Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused…

Malware

Gorbag: Orcs at the border harvesting intelligence from Ukraine

ESET researchers uncover Gorbag, a Russia-aligned group using simple infostealers to harvest data from Ukrainian organizations near the front line

Malware

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case…

Malware

Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user's Internet connection…

Malware

AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028

National Cyber Security Centre expects attacks on critical facilities such as power stations, airports and hospitalsAI-powered malicious software is “highly likely” to be used in hacking attacks against the UK’s power…

Malware

Max-severity bug in widely used OT programming tool exploited to deliver Linux malware

Your industrial IoT gateway isn't exposed to the internet, right? RIGHT?!

Malware

Cops bust botnet of 1.3M infected Android TV boxes

Videostrong accused of shipping devices with a backdoor baked in

Malware

⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More

Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause…

Malware

Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access

A botnet of more than 1.3 million Android devices, mostly TV set-top boxes, lost control of its servers in late October in a takedown led by Google. Google says it is highly confident that device maker Videostrong…

Malware

New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value…

Malware

NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted…

Malware

Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.

Malware

Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

Named Volta-Autodoxer, the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.

Malware

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it.

Malware

Anthropic VS code extension on Cursor backdoored for nearly 12 hours

It's still unknown how attackers got access to Anthropic's verified Cursor account.

Malware

Devs Hit by Trojanized Claude Code Extension for Cursor

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

Malware

A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards

Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.

Malware

Amatera: How the prolific infostealer works and spreads

The malware that topped ESET’s infostealer detections in Latin America in the first half of 2026 is an example of how cybercrime has professionalized