XLoader Malware Uses LuaJIT and Injection to Hide Credential Stealer
The loader hides the credential stealer inside an embedded LuaJIT interpreter and moves it into another Windows process through shared-section injection.
75
Country
Slovenia
- Mentions · 7d2
- Mentions · 30d3
- All mentions8
- First seenAug 15, 2026
- Last mentioned5d ago
Timeline
8 articles · newest firstXLoader Malware Uses LuaJIT and Injection to Hide Credential Stealer
The loader hides the credential stealer inside an embedded LuaJIT interpreter and moves it into another Windows process through shared-section injection.
75
The EU’s next chapter in AI is agentic
OpenAI says agentic ChatGPT and Codex tools already dominate EU enterprise use, but adoption remains uneven.
46
Cyber Security News
Microsoft's September Patch Tuesday fixes nearly 1,000 vulnerabilities; CISA warns two of the flaws are being actively exploited.
78
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
Slovenian casinos reopen after cyberattack knocked gaming systems offline
Slovenian gaming group Hit reopened six casinos after a cyberattack forced closures for roughly three days.
55
New Android malware relays bank cards to fraudsters while victims still hold them
Group-IB discovered WindRelay Android malware that streams NFC card data in real time, paired with SpyNote RAT, targeting Czechia, Slovakia, and Slovenia.
65
WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud
Group-IB details WindRelay, a new Android NFC relay malware paired with SpyNote RAT to relay card data live for contactless payment fraud and loans.
56
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
Appears with
- Microsoftvendor · 3
- Windowsproduct · 2
- XWormmalware · 2
- SpyNoteproduct · 2
- Agent Teslamalware · 2
- Remcosmalware · 2
- WindRelaymalware · 2
- SpyNotemalware · 2
- Hitvictim · 2
- WindRelayproduct · 2
- Morphisecorganization · 2
- Group-IBvendor · 2
- XLoadermalware · 2
- Check Point Researchorganization · 1
- Czechiavictim · 1
- Baylor Geneticsvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.