Search: “cli”

91 items

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 200 Exploit / PoC 95 Malware 91 AI tools & infra 45 Industry 36 Ransomware 32 Data breach 32 Tools 28 AI safety & security 26 Threat actor 23 Policy & legal 23 Model release 19 AI industry 11 Phishing & fraud 9

SeverityAll critical 241 high 166 medium 119 low 72 info 93

16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.

OpenSourceMalware discovered a typosquatting campaign on August 15, 2026, tracked as StubMaker, publishing 16 malicious RubyGems packages (e.g., ubnuler, brumdler, brundlef) that imitate popular Ruby dependencies. The gems use the extconf.rb install hook to fetch a 22 MB Rust-based loader from GitHub, which launches a Go-based stealer ("wincfg") containing a DLL that bypasses Chromium's app-bound encryption to extract browser credentials, payment cards, crypto wallets and seed phrases, and Telegram Desktop data. Stolen data is uploaded as a password-protected ZIP to Gofile, with the download link sent over plain HTTP. The same actor also deployed 37 typosquatted npm packages delivering the identical loader and infostealer, and abused RubyGems' namespace reuse to republish malicious versions of yanked gems.

The Hacker NewsAug 21, 05:44 UTC · 26d agoMalware in the wild

Hackers abused React Native CLI flaw to deploy Rust malware before public disclosure

Security AffairsFeb 3, 15:41 UTC · Feb 3, 2026Malware in the wildCVE-2025-119531

Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

The Hacker NewsJul 20, 09:07 UTC · Jul 20, 2026Malware

What is UserAssist and how to use it in IR activities?

Kaspersky SecurelistJul 14, 10:00 UTC · Jul 14, 2025Malware

Russian cybercriminal used jailbroken Gemini CLI to rebuild botnet infrastructure in six minutes

Help Net SecurityJul 16, 00:00 UTC · Jul 16, 2026Malware

Experts found allegedly intentional backdoors in C

Security AffairsJul 10, 12:57 UTC · Jul 10, 2020Malware

Fake Gemini and Claude Code Sites Spread Infostealers

Infosecurity MagazineMay 22, 11:30 UTC · May 22, 2026Malware

Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads

Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.

HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.

Cyber Security Newsupdated Sep 15, 11:51 UTC · 1d agofirst Sep 15, 06:56 UTC · 1d agoMalware in the wild 7 sources

New HalluSquatting Attack Could Trick AI Coding Assistants Into Installing Botnet Malware

The Hacker NewsJul 8, 15:19 UTC · Jul 8, 2026Malware

⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More

The Hacker NewsApr 28, 07:38 UTC · Apr 28, 2026Malware CVE-2025-20333 CVE-2025-20362 CVE-2026-40372+20 CVEs1

Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware

The Hacker NewsFeb 6, 08:40 UTC · Feb 6, 2026Malware

ThreatsDay Bulletin: 0-Days, LinkedIn Spies, Crypto Crimes, IoT Flaws and New Malware Waves

The Hacker NewsNov 21, 06:45 UTC · Nov 21, 2025Malware CVE-2025-61757 CVE-2025-11243

Shai

Kaspersky SecurelistSep 25, 10:00 UTC · Sep 25, 2025Malware

Malicious Nx Packages in ‘s1ngularity’ Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

The Hacker NewsSep 6, 11:31 UTC · Sep 6, 2025Malware

Hillstone Networks launches StoneOS 5.5R11 to enhance threat protection

Help Net SecurityAug 27, 00:00 UTC · Aug 27, 2024Malware

Vulnerable Docker Installations Are A Playhouse for Malware Attacks

Security AffairsMay 6, 10:02 UTC · May 6, 2022Malware

Pro-Ukraine ‘Protestware’ Pushes Antiwar Ads, Geo-Targeted Malware

Krebs on SecurityMar 17, 23:44 UTC · Mar 17, 2022Malware

WINTRIAGE: THE TRIAGE TOOL FOR WINDOWS DFIRERS

Security AffairsMar 18, 12:58 UTC · Mar 18, 2021Malware

Official Monero Site Hacked to Distribute Cryptocurrency Stealing Malware

The Hacker NewsNov 20, 08:58 UTC · Nov 20, 2019Malware

Monero Project website has been compromised to deliver a coin stealer

Security AffairsNov 20, 07:31 UTC · Nov 20, 2019Malware

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

The Hacker NewsAug 4, 05:21 UTC · Aug 4, 2026Malware1

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2026Malware

Hackers can use 9 of the most popular AI tools to assemble massive botnets

Ars Technica · SecurityJul 8, 07:00 UTC · Jul 8, 2026Malware

Friday Squid Blogging: Another Squid

Schneier on SecurityMay 29, 21:05 UTC · May 29, 2026Malware1

Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR

Help Net SecurityMar 15, 00:00 UTC · Mar 15, 2026Malware in the wildCVE-2026-21262 CVE-2026-261271

N. Korean Hackers Used Job Lures, Cloud Account Access, and Malware to Steal Millions in Crypto

The Hacker NewsAug 10, 12:09 UTC · Aug 10, 2025Malware

PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments

The Hacker NewsJun 15, 00:00 UTC · Jun 15, 2025Malware1

Dero miner spreads inside containerized Linux environments

Kaspersky SecurelistMay 21, 10:00 UTC · May 21, 2025Malware

Agile Approach to Mass Cloud Credential Harvesting and Crypto Mining Sprints Ahead

The Hacker NewsAug 23, 11:52 UTC · Aug 23, 2023Malware

Multi-Vector Miner+Tsunami Botnet with SSH Lateral Movement

Security AffairsDec 2, 08:54 UTC · Dec 2, 2020Malware CVE-2020-14882

Monero Project site compromised, served malware-infected binaries

Help Net SecurityMay 28, 09:46 UTC · May 28, 2020Malware

US Government Exposes North Korean Malware

Schneier on SecurityMay 15, 00:00 UTC · May 15, 2020Malware

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.

GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.

The Hacker NewsSep 3, 10:36 UTC · 13d agoMalware in the wild1