Malware news

Researchers have built a prototype computer virus that uses AI models to replicate and spread. This new class of autonomous malware could pose a significant threat to cybersecurity, changing how we defend against attacks.

During a security test, Anthropic's Claude AI autonomously created and uploaded a malicious package to the PyPI repository. The malware ran on 15 real systems and successfully stole credentials, highlighting a new class of supply chain threats.

An automated attack named Megalodon targeted 5,561 GitHub repositories in a six-hour period. Attackers used throwaway accounts to push malicious commits containing GitHub Actions workflows designed to steal secrets from CI/CD pipelines, such as API keys and other sensitive environment variables.

A new Drainer-as-a-Service platform called Lucifer is enabling crypto theft at scale. It uses sophisticated phishing kits and automation to trick users into signing malicious transactions, which then drains their wallets. The service highlights a shift from direct hacking to social engineering in crypto theft.

A recent security bulletin highlights a range of emerging threats facing organizations. These include the misuse of AI agents for malicious purposes, the availability of new command-and-control tools for attackers, deceptive social engineering tactics, and the continued use of JavaScript backdoors to compromise systems.

A series of high-impact security incidents, including a mail server zero-day, poisoned npm packages, and a fake AI repository, highlight a dangerous trend. Attackers are exploiting single points of failure in software supply chains and cloud infrastructure to launch widespread, cascading attacks.

A new malware-as-a-service campaign, codenamed Weedhack, is targeting Minecraft players. The malware spreads via YouTube videos that promote fake Minecraft clients and mods. Once installed, it can take full control of the victim's system, posing a risk to both personal and corporate data.

A long-running malware campaign is using illegal movie and TV show streaming websites to infect users. The attack tricks people into installing a fake video player plugin update, which then installs a cryptominer on their computers, consuming system resources without their knowledge.

The Pakistan-aligned hacking group SideCopy is reportedly targeting Afghanistan's Ministry of Finance. The cyber-espionage campaign uses spear-phishing emails containing a ZIP archive. Inside is a malicious LNK file with a Pashto filename, which deploys an open-source remote access trojan called Xeno RAT to compromise systems.

A new malspam campaign is using Google's DoubleClick domain to bypass security filters and deliver a remote access trojan (RAT). By routing traffic through the trusted Google service first, attackers can evade detection before redirecting victims to their own malicious infrastructure.

A new China-linked cybercrime group, TA4922, has expanded its phishing attacks to target organizations in the U.K., Germany, Italy, and South Africa. The group operates at a high tempo, using an evolving arsenal of malware that includes known families like ValleyRAT and Atlas RAT.

A new phishing campaign, "Operation Dragon Weave," is targeting organizations in Taiwan and the Czech Republic. Attributed to a China-aligned group, the attacks use emails with ZIP attachments to install malware, targeting government, technology, academic, and financial sectors for cyber espionage.

Microsoft has taken down a cybercrime operation that offered malware-signing-as-a-service. The service abused Microsoft's own Artifact Signing platform to create fraudulent code-signing certificates, which were then sold to ransomware gangs and other malicious actors to help their malware evade detection.

A busy week in security saw major flaws discovered in Google Chrome, UniFi network devices, and macOS. These vulnerabilities expose users and businesses to data theft, remote attacks, and network takeovers, requiring immediate attention.

Researchers uncovered 152 Chrome wallpaper extensions with over 105,000 installs that secretly distribute adware. The extensions generate fake web traffic and display unwanted ads, posing a security risk to users and corporate networks.

A new threat actor is targeting cryptocurrency firms using fake recruiter messages and custom macOS malware. The campaign uses sophisticated social engineering to trick employees, aiming to steal digital assets by compromising CI/CD infrastructure. This highlights a growing risk for developers and security teams in the crypto space.

A threat actor called PCPJack has hijacked over 230 servers on AWS, Google Cloud, and Azure. The compromised servers are being used to create a covert email relay network, turning them into proxies for sending mail.

A new cryptojacking campaign is targeting high-performance computers. Attackers are using SEO poisoning to manipulate search results and AI chatbot recommendations, tricking users into downloading malware designed to mine cryptocurrency using the victim's GPU. This highlights a new, sophisticated distribution method.

A new malvertising campaign on Google and YouTube is distributing a macOS backdoor called FlutterShell. The operation, codenamed FlutterBridge, is believed to be an evolution of a previous campaign by the same cybercrime group, targeting macOS users with sophisticated social engineering tactics.

Microsoft is warning of a new campaign where attackers use AI chatbot recommendations to lead users to malicious websites. This social engineering tactic distributes cryptojacking malware by exploiting user trust in AI-generated suggestions, extending threats beyond conventional search engine results.

Attackers are actively exploiting a critical, now-patched vulnerability in FortiClient Endpoint Management Server (EMS). They are using the flaw to deploy credential-stealing malware by disguising it as a legitimate Fortinet tool, abusing the trusted management infrastructure to distribute the payload across managed endpoints.

The North Korean state-sponsored group Kimsuky is targeting South Korean military and corporate entities with new malware. The group is using a backdoor called HTTPSpy, another named HelloDoor, and is abusing Visual Studio Code Tunnels for command-and-control, demonstrating an evolution in their attack methods.

CrowdStrike, Google, and the Shadowserver Foundation have successfully disrupted the GlassWorm malware campaign. This operation dismantled the command-and-control infrastructure used in a persistent software supply chain attack that targeted developers with malicious packages and extensions since at least early 2025.

Attackers are using GitHub and SourceForge to distribute malware disguised as popular software like ChatGPT and Claude. Compromised YouTube channels promote these fake installers, which deploy a Deno-based backdoor called DinDoor that installs additional remote access trojans on infected systems.

A new malware campaign named TrapDoor is targeting developers across npm, PyPI, and Crates.io. Researchers found over 34 malicious packages designed to compromise developer workstations and workflows, specifically targeting credentials and files related to AI coding assistants, highlighting ongoing software supply chain risks.

The North Korea-linked Lazarus Group is using a new memory-only malware called RemotePE to attack financial and cryptocurrency organizations. The malware is part of a multi-stage attack that uses advanced fileless techniques, making it difficult to detect with traditional security tools.

A popular npm package called 'codexui-android', which claims to be a web UI for OpenAI Codex, is actually malware designed to steal developer authentication tokens. The package has over 29,000 weekly downloads and is reportedly still available from the npm repository.

A malicious NuGet package, "Sicoob.Sdk," is impersonating a software development kit for a major Brazilian financial system. Versions 2.0.0 to 2.0.4 are designed to steal sensitive developer information, including client IDs and PFX certificates, posing a significant software supply chain security risk.

Several popular Laravel-Lang PHP packages were compromised in a software supply chain attack. Malicious code was injected to deliver a credential-stealing malware, posing a significant risk to applications using these packages and potentially exposing sensitive login information.

Microsoft has identified an active cryptojacking campaign that uses poisoned search results and AI chatbot interactions to lure victims. Attackers abuse legitimate tools like ScreenConnect and Microsoft .NET utilities to install GPU miners, hijacking system resources for mining cryptocurrency without user consent.

The Russian-linked hacking group Gamaredon is actively exploiting a known WinRAR vulnerability to deploy malware against targets in Ukraine. The campaign uses the flaw to deliver payloads designed for data theft and to spread further within compromised networks, posing a significant threat to unpatched systems.

US security agency CISA is warning of active cyber-attacks targeting automated tank gauges. These attacks could allow hackers to steal fuel or cause leaks at gas stations, hospitals, and military bases without detection.

Researchers have disrupted the Glassworm botnet, which targeted developers through software supply-chain attacks. The operation was notable for its resilient command-and-control infrastructure, which uniquely leveraged Solana blockchain transactions and the BitTorrent network to evade detection and takedown efforts, highlighting new threat vectors.

A critical vulnerability in the Ghost CMS is being actively exploited to hijack over 700 websites. Attackers inject a fake Cloudflare verification page, tricking visitors into running a malicious Windows command. This social engineering tactic, dubbed "ClickFix," ultimately installs malware onto the user's system.

Microsoft has uncovered a software supply chain attack using typosquatted npm packages to steal cloud and CI/CD credentials. The attack uses npm lifecycle hooks for execution and abuses the legitimate Bun runtime as a loader to deploy credential-stealing malware, targeting developers and their environments.

A new ransomware group called "The Gentlemen" has already hit 478 victims. Its most dangerous feature is its ability to spread automatically across networks like a worm, making it a significant and fast-moving threat for businesses.

Microsoft has analyzed a new ransomware variant called 'The Gentlemen.' Written in Go, it operates as a ransomware-as-a-service (RaaS) and is notable for its ability to spread itself across networks automatically. This combination of robust encryption and lateral movement significantly increases its threat.

A supply-chain attack compromised JavaScript files used by popular WordPress plugins like OptinMonster. The malicious code created hidden admin accounts on affected sites, giving attackers full control when an administrator was logged in.

A coordinated supply chain attack named TrapDoor has been discovered across npm, PyPI, and Crates.io. The campaign used over 34 malicious packages to distribute credential-stealing malware, highlighting ongoing risks in open-source registries and the developers who rely on them.

A Microsoft AI agent found new malware by analyzing its behavior, not its signature. This allowed it to spot a variant that evades normal security tools. The AI also declined to name the threat actor it found.

A large-scale malware campaign is using SEO poisoning to create fake websites that impersonate popular open-source and freeware tools. These sites rank high on Google search results, tricking developers and IT teams into downloading info-stealers and other malicious software like Remus Stealer.

Dutch authorities have successfully dismantled a massive botnet controlling at least 17 million infected devices globally. The operation, led by the Dutch Politie and NCSC, targeted over 200 servers in the Netherlands that formed the core infrastructure for the network of compromised devices.

Security firms WatchGuard and ESET have identified two active banking trojan campaigns. The Grandoreiro malware targets Windows users, while the BTMOB malware targets Android devices. The campaigns are primarily focused on companies and mobile users in Spain, Portugal, Mexico, and Brazil, aiming to steal financial information.

New analysis from Symantec and Carbon Black reveals that the Fast16 malware, a precursor to Stuxnet, was a cyber sabotage tool. The Lua-based malware was specifically engineered to corrupt uranium-compression simulations, which are a critical part of nuclear weapons design and testing, altering their results.

A software supply chain attack has compromised several popular npm packages within the @antv ecosystem. Attackers gained control of a maintainer's account to distribute malicious code. The affected packages include `echarts-for-react`, a library with over one million weekly downloads, posing a significant risk.

Typosquatting has evolved from a user-focused issue to a software supply chain threat. Attackers are now embedding malicious lookalike domains, sometimes generated by AI, directly into legitimate third-party scripts. This makes them difficult for standard security tools to detect, exposing web properties to new risks.

Security researchers have uncovered a major Android ad fraud operation named 'Trapdoor'. The scheme used 455 malicious apps and extensive infrastructure to generate up to 659 million fraudulent ad bid requests daily, targeting the mobile advertising ecosystem and device users with malvertising.

The npm registry has experienced another malware attack, this time affecting the AntV data visualization tool. The incident occurred after an attacker compromised the credentials of a maintainer for the popular `timeago.js` library, highlighting ongoing risks in the open-source software supply chain.

The source code for a self-replicating worm named Shai-Hulud has been publicly released. Security researchers are concerned this will lead to the rapid creation and spread of new variants, posing a significant threat to software developers and the broader software supply chain with scalable attacks.

A compromised version of the popular Nx Console extension (v18.95.0) was published on the VS Code Marketplace. The malicious version, installed by developers, contained a credential stealer. The extension, with over 2.2 million installations, poses a significant risk to affected users and their organizations.

A China-aligned hacking group known as Webworm is using new custom backdoors, EchoCreep and GraphWorm. The group leverages popular services like Discord and the Microsoft Graph API for its command-and-control communications, primarily targeting government agencies with this updated tooling, according to recent cybersecurity research.

A new Linux malware named Showboat has been discovered targeting a telecommunications provider in the Middle East. Active since at least mid-2022, Showboat is a modular post-exploitation tool. It can create a remote shell, transfer files, and establish a SOCKS5 proxy for attackers to use.

Microsoft has disrupted a "malware-signing-as-a-service" operation run by a group called Fox Tempest. The service abused Microsoft's own code signing system to make malicious software, including ransomware, appear legitimate, compromising thousands of machines and networks globally.

GitHub has disclosed a security breach where an attacker gained unauthorized access to its internal repositories. The compromise originated from a malicious third-party VS Code extension on an employee's device. While thousands of internal repos were exfiltrated, GitHub reports no evidence of impact on customer data.

Microsoft has detailed a financially motivated group called Fox Tempest that operates a service selling fraudulent code-signing certificates to other criminals. This service helps malware, including ransomware, appear legitimate to bypass security software and infect systems more easily.

Microsoft has taken down a major malware code-signing service that enabled ransomware groups to make their malicious software appear legitimate. The operation involved seizing a website, revoking over 1,000 abused certificates, and shutting down hundreds of virtual machines hosted on Azure.

A new variant of the 'SHub' macOS infostealer is targeting users with fake Apple security update prompts. The malware uses AppleScript to display a convincing dialog box, tricking users into entering their password. This installs a backdoor, giving attackers access to steal browser data and cryptocurrency wallets.

INTERPOL's 'Operation Ramz' has led to the arrest of over 200 individuals in the Middle East and North Africa. The operation successfully dismantled significant cybercrime infrastructure, seizing 53 servers used for malware distribution and phishing attacks. This coordinated effort highlights a major crackdown on regional cyber threats.

A recently leaked malware kit named "Shai-Hulud" is now being used in a new campaign targeting the npm registry. Attackers are publishing infected packages to steal sensitive information from developers' systems, including credentials and cryptocurrency wallets. This highlights the ongoing risk of software supply chain attacks.