ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Operant AI”

39 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI safety & security 135Industry 105AI industry 87Threat actor 79Exploit / PoC 54Tools 54Policy & legal 48Malware 46Vulnerability 40Phishing & fraud 29Research 28Data breach 24Advisory 21AI research 21
SeverityAllcritical 33high 173medium 150low 5info 462

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackers · 7d agoMalware in the wild1

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.

ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.

The Hacker News · 15d agoMalware in the wild

Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.

SOCRadar's Threat Research Unit reports active exploitation of CVE-2025-25249, a CVSS 9.8 heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, via crafted CAPWAP requests to UDP port 5246, compromising at least 178 of 30,000 targeted internet-exposed FortiGate devices since July 2026. The campaign deploys PivotC2, a Node.js RAT that provides interactive shells, SOCKS5/HTTP proxying, port forwarding, network scanning, and automated configuration harvesting that decrypts stored FortiGate credentials, including VPN pre-shared keys, SSL-VPN credentials, and LDAP secrets. Russian-language artifacts, AD enumeration, browser credential theft, RDP enablement, and exfiltration of Exchange .pst files to Wasabi S3 point to a Russian-speaking, financially motivated group; two US organizations confirmed full-network intrusions. Fixes include FortiOS 7.6.4/7.4.9/7.2.12/7.0.18+ and FortiSwitchManager 7.2.7/7.0.6+, plus blocking CAPWAP on internet-facing interfaces.

GBHackers · 7d agoMalware in the wildCVE-2025-252492

BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory

Group-IB details BraZetsu, a modular Python Windows malware that monetizes compromised-host access through the Infected Marketplace for initial access brokers.

Group-IB attributes BraZetsu to the Exilware threat actor, believed to be native Portuguese speakers targeting Iberian and Latin American e-commerce, financial, industrial, and law enforcement victims. The framework, first observed in early May 2026, uses generative AI for data triage and target prioritization, steals browser histories and digital certificates, and hunts Brazilian CNAB financial remittance files. Access to compromised hosts is sold on the Infected Marketplace from roughly $5.80, letting buyers remotely deploy secondary payloads over WebSocket-linked infrastructure. Some samples evaded detection on VirusTotal; delivery likely uses VBS loaders from a domain also used to distribute the Ousaban banking trojan.

The Hacker News · 13d agoMalware in the wild

HBO Max Reddit Account Hijacked to Spread PasteSwitch ClickFix Malware

Hijacked HBO Max verified Reddit account ran 108 ClickFix malvertising ads delivering AMOS and Amatera stealers plus crypto clippers to macOS and Windows users.

Threat actors hijacked HBO Max's verified Reddit account (u/hbomax) to run 108 malicious ClickFix ads over 48 hours in a campaign tracked as PasteSwitch, researched by Hudson Rock and ADAMnetworks. macOS victims were served curl | zsh chains deploying MacSync and Atomic macOS Stealer (AMOS), which harvest browser credentials, Telegram data, Apple Notes, and macOS passwords, while fake Ledger, Trezor, and Exodus apps targeted BIP39 seed phrases. Windows users received an InstallFix chain using an MP3/HTA polyglot with mshta and PowerShell, scheduled-task persistence, AMSI disabling, and in-memory Amatera Stealer that hid C2 traffic (77.91.65.13:443) behind a facebook.com TLS SNI. AnimateClipper and ZigClipper components swapped copied crypto wallet addresses and used Binance Smart Chain contracts as mutable C2 dead drops; Reddit paused the ads and the initial access path remains undisclosed.

GBHackersupdated · 1d agofirst · 1d agoMalware 7 sources

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI

Trend Micro found 14 trojanized npm calendar utilities delivering RedC2 4.0, an AI-powered cross-platform backdoor sold for $99.99.

Trend Micro's TrendAI identified 14 functional but trojanized npm packages (streak-*, kit-map-vim, map-streak-kit) that load a bundled Linux implant, the RedShell beacon of RedC2 4.0, without requiring install hooks. RedC2 4.0, sold by Red Offsec for $99.99 and advertised on Hack Forums by actor MarlboroMan in June 2026, offers shell access, credential theft, SOCKS5 proxying, in-memory execution, and an LLM-driven component called Red Agent for natural-language post-exploitation. The framework has evolved from version 2.0 in August 2025 through 4.0, with the Linux beacon introduced in the latest release.

The Hacker News · 23d agoMalware in the wild

New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks

Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.

Nozomi Networks identified KATARU in August after a Telnet password-guessing attack against a honeypot retrieved an ARM payload. The malware attempts exploits for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape, and persists via systemd services, cron tasks, rc scripts, OpenWrt hooks, and Android boot locations. Its C2 uses X25519 key exchange with ChaCha20-Poly1305 encryption and supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, plus SSH brute forcing and command execution; embedded exploit shellcode in the ARM build targeted x86, suggesting untested copied code.

Cyber Security News · 5d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

BambooToken malware controls Windows and Linux systems via MQTT

Lumen Black Lotus Labs exposes BambooToken, a China-aligned malware framework using MQTT C2 to backdoor Windows and Linux systems at roughly a dozen enterprises.

Lumen's Black Lotus Labs documented BambooToken, a previously unknown malware framework active since at least 2023 that adopted MQTT for command-and-control in 2024-2025 variants targeting Windows and Linux. Infection occurs via DLL side-loading through digitally signed Tendyron OnKey USB-token software or an impersonated Kingsoft Office installer; dead code suggests keylogging, clipboard theft, audio/webcam capture, and screenshot modules. Telemetry identified roughly a dozen compromised entities, mostly in Asia and South America, including a Hong Kong GitLab server and possibly users of the SpeedCN VPN service. Targeting patterns are consistent with China-aligned operations, though no attribution to a known cluster was made.

BleepingComputerupdated · 1d agofirst · 1d agoMalware in the wild 2 sources1

Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.

ClickFix malvertising campaigns deliver MacSync, a macOS infostealer sold as MaaS that bypasses Gatekeeper via Terminal commands and steals credentials.

Threat actors use ClickFix social-engineering lures, SEO poisoning, and malvertising impersonating brands like Claude, ChatGPT, Zoom, and Docker to trick users into pasting curl-to-zsh commands into Terminal, evading Gatekeeper and notarization checks. The MacSync Stealer (formerly Mac.c, emerged April 2025, linked to developer 'Mentalpositive') is a 64-bit Mach-O stager with single-byte XOR string obfuscation that daemonizes, polls C2 with custom API-key headers, streams AppleScript payloads into osascript, and persists via fake LaunchAgents. It steals browser credentials, Keychain data, SSH keys, session tokens, and crypto wallets, exfiltrating archives in 10MB HTTP PUT chunks. Microsoft documented more than 30 related MacSync domains.

GBHackersupdated · 6d agofirst · 6d agoMalware in the wild 2 sources

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security News · 7d agoMalware in the wild2

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.

GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.

The Hacker News · 13d agoMalware in the wild1

Fake Claude Opus 5 app delivers malware and wipes its own tracks

A fake 'Claude Opus 5' GitHub repository impersonating Anthropic distributes RevStealer, a Windows infostealer stealing passwords, crypto wallets and VPN credentials.

Morphisec identified a malicious GitHub repository, Claude-Opus-5-Free-Desktop, impersonating Anthropic to distribute a roughly 101 MB download that launches RevStealer, a Windows information-stealing malware. The malware targets browser credentials, Windows Credential Manager, a dozen password managers, more than fifty cryptocurrency wallets, VPN, messaging, game launcher and streaming accounts, streaming stolen data to its server before deleting itself. It evades analysis with ten sandbox and VM checks, indirect system calls, Windows Defender exclusions, a fake verification window, and a Polygon blockchain smart contract fallback for C2. Only 1 of 66 antivirus engines flagged the sample at check time.

Help Net Security · 15d agoMalware

Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results

NCSC, FBI, and AIVD warn Iranian state-linked actors deliver CHOSEN BRICK Windows spyware via fake AI apps, antivirus installers, and MRI-result lures.

A joint advisory from the UK NCSC, FBI, and Dutch AIVD details CHOSEN BRICK (FBI tracking name: HEAVYGRAM), Iranian state-linked Windows spyware targeting dissidents, activists, and journalists worldwide since at least 2025. Lures impersonate Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass, and operators pivot conversations from corporate to personal devices to bypass enterprise controls. The spyware persists via Registry Run keys, adds Microsoft Defender exclusions, uses per-victim Telegram bots for command-and-control, and exfiltrates screenshots, audio, email, and chat data via Telegram and cloud services, with some victim data appearing on pro-Iranian leak sites.

GBHackersupdated · 2h agofirst · 15h agoMalware in the wild 6 sources

Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities

Sophos uncovers a 64-bit Cyclops Blink variant on hacked Cisco FMC appliances, adding internal network scanning and selective packet capture; linked to Sandworm.

Sophos CTU analyzed a new 64-bit x86-64 Cyclops Blink implant (timezone_check) deployed on Cisco Secure Firewall Management Center appliances compromised via CVE-2026-20079 authentication bypass and CVE-2026-20316 low-privileged login. The activity is assessed with high confidence as Russian-nexus, with a moderate-confidence link to Sandworm (IRON VIKING, also tracked as Seashell Blizzard). The implant runs a parent controller plus five worker modules, masquerades as [kworker/0:1], persists via SysV init scripts at /lib/tz/timezone_check, and beacons to hard-coded C2 89.34.96.56 over a custom TLS protocol on ports 43856 and 49172. New module 0x11 scans internal IPv4 networks for SSH, SMB, LDAP, VMware, HTTP/HTTPS and VPN services, while module 0x12 performs filtered packet capture that can expose cleartext credentials, cookies and tokens.

GBHackers · 2d agoMalware in the wild 9 sourcesCVE-2026-20079CVE-2026-20316

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare Blog · 2h agoMalware in the wild

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker News · 9d agoMalware in the wild1

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.

Palo Alto Unit 42 · 7d agoMalware in the wild1

PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users

JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.

PAPERMILL delivers ISO disk images via tax-audit phishing emails that passed SPF, DKIM, and DMARC, containing a renamed Authenticode-signed Notepad++ executable and a malicious libcurl.dll that proxies curl functions while executing loader logic in DllMain. The chain uses Mark-of-the-Web bypasses, anti-sandbox sleeps, UAC elevation prompts, Registry persistence, and a Donut shellcode loader to reflectively load .NET VenomRAT v6.0.3 with HVNC and credential-stealing capability, with C2 at 154.36.188.201:4449. JUMPSEC assesses the campaign as China-nexus, financially motivated, and Silver Fox-adjacent rather than definitively Silver Fox-operated.

GBHackersupdated · 10h agofirst · 13h agoMalware in the wild 2 sources

KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.

Elastic Security Labs tracks the KREMLIN banking malware operation as REF9334, active since at least May 2025 across seven campaigns primarily targeting 12 Brazilian banks. The malware is installed by a victim-run JavaScript loader, achieves scheduled-task persistence, and side-loads a malicious DLL via SentinelOne's SentinelMemoryScanner.exe. It modifies Chrome and Edge Secure Preferences files, enables developer mode, and regenerates Chromium MAC values to silently install extensions, while extracting browser encryption material including the newer App-Bound OSCrypt key. An Ethereum smart contract serves as a dead-drop resolver for C2 config; Elastic disrupted over 1,500 infections via a canary domain.

GBHackers · 17h agoMalware in the wild 2 sources

New Android malware encrypts files, steals data, and harasses victims

Zimperium details Mantax Otax, an Android malware combining ransomware, spyware, and harassment, spread via phishing APKs to Indonesian users.

Zimperium researchers report Mantax Otax is distributed through malicious APKs hosted outside Google Play via phishing and social engineering, then abuses Accessibility permissions for broad device control. It encrypts files with a C2-provided AES key on Android 9 and older, adds '.enc' extensions, and hosts ransom chats on Firebase; researchers exposed attacker chats via a Firebase misconfiguration. The malware steals lock-screen PINs, SMS one-time codes, contacts, WhatsApp and Telegram chats, and captures screens via MediaProjection, while version 2 adds jumpscare overlays and text-to-speech harassment. Google Play Protect already detects and blocks it on up-to-date devices via the App Defense Alliance.

BleepingComputerupdated · 5d agofirst · 6d agoMalware in the wild 6 sources

AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process

Point Wild details a five-stage AsyncRAT campaign using AutoIt abuse and process injection to hide a .NET RAT inside Microsoft's signed charmap.exe.

Researchers at Point Wild Threat Intelligence analyzed a campaign starting from a lure batch file ('Right-click to open Invoice Details.bat') that launches hidden PowerShell to reconstruct a Base64/XOR-obfuscated payload. The stage drops a renamed signed AutoIt interpreter and loader script into %LOCALAPPDATA%\Temp and achieves persistence via a batch file in the user's Startup folder (T1547.001). The loader decrypts the payload in memory with single-byte XOR key 0x36 and injects it into SysWOW64\charmap.exe using OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, with PE-sieve confirming an in-memory implanted PE and patched AMSI modules. The final AsyncRAT payload performs screen capture and data theft, with observed C2 at 158[.]51[.]122[.]136:4944 over raw TCP.

GBHackers · 2d agoMalware3· 1 read

Malware bypasses browser checks to force install Chrome, Edge extensions

Elastic Security Labs detailed KREMLIN, a Brazilian banking malware that silently installs malicious Chrome and Edge extensions, with 1,515 confirmed infections.

Elastic Security Labs analyzed KREMLIN, a toolkit used by a Brazilian operation in at least seven campaigns since May 2025 that impersonates 12 banks to trick users into opening a JavaScript file disguised as a bank receipt or invoice. After anti-sandbox checks, it downloads Node.js, persists via a scheduled task, and fetches payload locations from an Ethereum smart contract, hiding payloads in JPEG images on Internet Archive. The toolkit bypasses Chromium integrity mechanisms to install unapproved Chrome/Edge extensions masquerading as AVSync that steal cookies, keylog form input, capture screenshots, and intercept HTTP traffic, while recent campaigns deployed the REMCOS RAT and earlier ones Pulsar RAT. Elastic confirmed 1,515 infected systems, almost all in Brazil, and disrupted the campaign by registering an anti-sandbox canary domain; the linked wallet handled roughly 20,800 USDT incoming and 19,000 USDT outgoing.

BleepingComputer · 3h agoMalware in the wild 3 sources

Dogged Russia-based botnet dismantled after 23-year run

Law enforcement, CrowdStrike and Shadowserver dismantled the 23-year-old Sality P2P botnet that infected more than 11 million devices.

Sality, a Russia-based peer-to-peer botnet active for 23 years and infecting over 11 million devices, was dismantled by law enforcement working with CrowdStrike and the Shadowserver Foundation. CrowdStrike poisoned the botnet's peer list so infected machines permanently disappeared from the operator's view, while domains were seized in a coordinated effort involving the FBI, Justice Department, Europol and authorities from Bulgaria, Hungary and Romania. The financially motivated operation enabled cryptocurrency theft, DDoS attacks and other cyberattacks, and Europol said the effort dates back to 2017; the operators were not named.

CyberScoop · 14d agoMalware

Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users

Casbaneiro banking Trojan targets Latin American bank users via phishing PDFs, geofencing, AutoIt staging, and distributed C2 servers to evade detection.

FortiGuard Labs detailed a Casbaneiro banking Trojan campaign observed in August 2026 targeting users in Argentina, Peru, Colombia, and Mexico via fake invoice and legal-notice emails. The operation uses geofenced landing pages, an HTA downloader with WMI-based sandbox checks, a legitimate AutoIt interpreter, and process injection into RegSvcs.exe (fallback mobsync.exe). C2 activation is conditional on victims visiting banking websites, enabling keyboard control, clipboard manipulation, and fake overlay windows for bank-focused fraud, while distributed exfiltration servers and unusual HTTP 403-based signaling hinder analyst correlation.

GBHackers · 2d agoMalware in the wild1

Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

Zscaler ThreatLabz reports SloppyRAT, a new Windows RAT delivered via ClickFix lures that supports reconnaissance, reverse SOCKS proxying, and lateral movement for ransomware affiliates.

Zscaler ThreatLabz first observed SloppyRAT in June 2026, delivered through multi-stage ClickFix chains that abuse finger.exe, a renamed curl.exe, and IronPython to load a reflective Python payload. The C++ implant implements 47 PowerShell-like commands via native APIs and direct syscalls, modifies Microsoft Defender settings, and establishes a reverse SOCKS proxy that lets operators pivot into internal networks. It is linked to CastleLoader and CastleRAT components and uses certificate-pinned HTTPS C2 with an EtherHiding fallback via Polygon JSON-RPC. Zscaler assesses it as an intrusion-enablement tool for ransomware operations, though flawed persistence logic suggests the family is still under development.

GBHackersupdated · 5d agofirst · 5d agoMalware in the wild 3 sources

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.

Cyber Security News · 7d agoMalware in the wild

GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks

Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.

Group-IB's 'Hook for Gold' investigation found GoldFactory ships Vwork, a modified fork of the open-source Shelter app, alongside its Gigabud Android banking trojan, active since 2022. Vwork abuses Android Work Profile provisioning to clone banking apps into an isolated environment, weakening the link between detected malware signals and fraudulent transactions. Gigabud has targeted victims in Southeast Asia, Latin America, the Middle East, Africa, and beyond via fake airline, tax, and government apps requesting Accessibility and overlay permissions. In Indonesia, telemetry recorded about 1,469 compromised devices and roughly $960,939 in estimated losses between February and July 2026.

GBHackers · 7d agoMalware in the wild

StreamRat Android malware spreads through Meta and TikTok ads

Malwarebytes reports StreamRat Android banking trojan spread via Meta and TikTok ads reaching roughly 570,000 users, mostly in Spain.

Malwarebytes researchers uncovered a malicious advertising campaign on Meta and TikTok promoting a fake free TV-streaming service that delivered the StreamRat Android banking trojan and infostealer. The ads, aimed at Spanish-speaking users with most victims in Spain, reached approximately 570,000 Meta users in a campaign running June 11 through July 3, 2026. The download site detected Android devices and the referral source, then coached users through sideloading steps including enabling installs from unknown sources. StreamRat can monitor the screen, capture typed credentials, display fake login screens, and give attackers remote control, including black-screen and fake Android update overlays.

Malwarebytes Labs · 13d agoMalware in the wild

Android malware creates a hidden copy of your banking app

Group-IB found the Gigabud Android banking trojan clones banking apps into a hidden work profile to conduct fraud undetected.

Group-IB researchers found the Gigabud Android banking trojan installs Vwork, a trojanized version of the open-source Shelter app, to create a separate Android work profile and clone the victim's banking app into it. The operator then performs fraudulent transactions from the cloned app, separating risky activity from malware detections in the personal profile and potentially bypassing bank-side anti-fraud checks. Victims are lured into sideloading fake airline, tax, or government apps via phishing sites and messages, then grant Accessibility, overlay, and battery-optimization permissions that enable remote control and credential-theft overlays. Malwarebytes detects Gigabud components under multiple Android.Trojan.Banker signatures.

Malwarebytes Labs · 5d agoMalware 3 sources1

Twitch extension with 30K installs exposes users’ OAuth tokens

Twitch extension with 30,000+ installs exfiltrates users' OAuth session tokens to Russian-run JeetBot proxy servers.

Socket analysis shows the "Twitch Enhanced Viewer | JeetBot" browser extension, with over 30,000 installs on the official Chrome and Firefox stores, captures the Twitch web client's authorization header and extracts the user's OAuth token. The token is appended as an auth= URL parameter to video playlist requests routed through JeetBot proxy servers, landing in cleartext request logs retrievable by the Russian-language bot service vendor; ten hardcoded Russian-language channels are exempted. Earlier versions used more explicit token exfiltration, and the extension remained live in both stores at publication. Socket recommends removing the extension, disconnecting all Twitch sessions, and re-authenticating.

BleepingComputer · 2d agoMalware in the wild

Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown

McAfee says WeedHack infostealer MaaS still spreads via ten fake Minecraft client sites and SEO poisoning despite C2 takedown, with 116,464 infections logged.

McAfee Labs' follow-up on the WeedHack Malware-as-a-Service operation, first documented in June 2026, found ten active fake Minecraft client sites and multiple file-hosting accounts still distributing the infostealer even after its C2 server went dark; over 6,300 user attempts were blocked in the past month. The campaign, running since January with 116,464 infected systems and 2,000-3,000 daily new victims, offered a free Discord-gated tier and a $5/month premium tier with webcam surveillance, and stole session cookies, passwords, browser data, and cryptocurrency wallets. Distribution relies on SEO poisoning that ranked fake sites such as nova-client.com above genuine GitHub repositories, with most malicious links coming via Discord (49.6%) and MediaFire (23.4%), and one fake site built with the AI website builder lovable.app.

Security Affairs · 22d agoMalware

JSCeal Hides Crypto Malware in V8 Bytecode

Check Point details JSCeal, a crypto-stealing malware delivered as compiled V8 bytecode, and built a decompiler pipeline to expose its capabilities.

JSCeal, tracked by Check Point Research since early 2025, is a cryptocurrency stealer delivered as heavily obfuscated JavaScript compiled to V8 bytecode (.jsc) and run by a bundled Node.js runtime. Check Point, presenting at Black Hat USA 2026, extended the open-source View8 decompiler into a pipeline that recovered readable code from 23 samples, revealing theft of browser credentials and cookies, Telegram sessions, keystrokes, screenshots, HTTPS traffic interception with attacker-controlled certificates, and automated Google account takeover. Targeted overrides rewrite content for Binance, Bybit, and Ledger users. Later samples added AES-256-CBC encryption with externally supplied keys and expanded targeting to macOS.

Security Affairs · 9d agoMalware1

Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

FBI, NCSC, and AIVD detail Iran MOIS spyware CHOSEN BRICK/HEAVYGRAM, Telegram-controlled Windows malware spying on dissidents since 2023.

A September 15 joint advisory from the FBI, UK NCSC, and Dutch AIVD attributes the Windows spyware HEAVYGRAM (NCSC name CHOSEN BRICK) to Iran's Ministry of Intelligence and Security, with the campaign dating to autumn 2023 and targeting dissidents, journalists, and activists in the UK, US, Netherlands, and worldwide. Delivered via messages impersonating known contacts or tech support, the malware assigns each victim a dedicated Telegram bot for command-and-control and exfiltration, and can take screenshots, record microphone audio, steal Telegram/WhatsApp data, saved passwords, and emails, download more malware, and wipe the computer. Persistence uses a registry Run key (SMQDService or winappx) plus Microsoft Defender exclusions, with stolen data exiting via Telegram and cloud storage services like Vultr and Storj. The US Justice Department seized four pro-Iranian leak sites in March that had published stolen victim data.

The Hacker News · 1d agoMalware in the wild1

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers · 5d agoMalware in the wild2

Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning

McAfee Labs reports Weedhack malware spread via spoofed Minecraft client websites using SEO poisoning, with over 6,300 blocked access attempts.

McAfee Labs found multiple lookalike websites impersonating legitimate Minecraft clients (Glazed, Radium, Meteor, Nova, Xenon) still distributing Weedhack, a multi-stage malware whose JAR payloads collect system information, add Microsoft Defender exclusions, and steal sensitive data. Distribution relies on SEO poisoning to outrank official sources, plus Discord, MediaFire, GitHub, and Minecraft hosting sites; nearly half of malicious URLs were Discord links. One fake site was built with the AI website builder Lovable, and McAfee blocked more than 6,300 access attempts to malicious sites.

The Hacker News · 23d agoMalware in the wild

Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers

Huntress found fake GTA 6 installer ISOs spreading NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware wiper that steals credentials.

Huntress analyzed a malicious ISO disguised as a leaked GTA 6 build, distributed via SEO poisoning, torrent sites, and social media, with some images exceeding 100 GB and padded with junk data. The installer stages game-named executables in %TEMP% and deploys NJRAT, DCRAT, and the Mercurial Grabber infostealer, harvesting browser passwords, Discord tokens, Roblox and Minecraft session data, Windows product keys, and cryptocurrency details, with exfiltration via a Discord webhook. A Chaos ransomware variant launched through gta6.exe deletes shadow copies, disables Windows recovery, encrypts files up to 200 MB with AES, and overwrites larger files, effectively acting as a wiper attributed to the 'ASHA Hacker Team'. A Visual Basic script displays a fake 'license not found' error to conceal the already-installed payloads.

GBHackersupdated · 6d agofirst · 6d agoMalware in the wild 3 sources

Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware

Cisco Talos details ClickFix campaigns abusing fake Google CAPTCHA prompts, WebDAV and BNB Smart Chain to deploy the Amatera infostealer.

Cisco Talos identified a multi-stage campaign, first observed in April 2026 when a Ukrainian government organization executed a disguised DLL named verification.google from a WebDAV path. The chain combines ClearFake JavaScript injected via malicious Cloudflare Workers, EtherHiding payloads stored in BNB Smart Chain contracts, ClickFix social engineering, and WebDAV-hosted DLL loaders to deliver the Amatera (ACR Stealer) infostealer. The Amatera configuration contained over 400 collection entries targeting browsers, messengers, crypto wallets, password managers, FTP and VPN tools, hunting for .kdbx, .p12, .pfx and .pem files. The pf.ch branch deploys ZigCryptoStealer, an EDR-terminating vulnerable driver and Go-based reverse TCP proxies, while the verification.google branch installs NetSupport Manager, supporting moderate-confidence attribution of the UAT-10820 activity to a Russian actor.

GBHackers · 7d agoMalware in the wild

TuxBot v3: Inside an IoT Botnet Framework With LLM

Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.

Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.

Palo Alto Unit 42 · 28d agoMalware1

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.

Manifold Security found 77 extensions uploaded to the Open VSX marketplace between July 26 and August 1, 2026 that impersonate real Microsoft VS Code Marketplace tools, with all 77 sending data to mangorbit.com. 58 lightweight variants exfiltrate the hostname, while 19 recon variants collect editor details, OS username, Git remote hosts, CI environment variables (GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod), and installed extension IDs. The recon variant retries for up to seven days and can fall back to a DNS TXT record for exfiltration if the primary domain is blocked. The extensions were removed from Open VSX by August 3, 2026; the disclosure follows a separate npm supply chain campaign, ChainDrop, which compromised 450 packages with a Shai-Hulud worm variant.

The Hacker News · 15d agoMalware