Spyware providers are flocking to international arms fairs to sell to NATO foesCyberScoop·Nov 9, 13:39 UTC · Nov 9, 2021Malware in the wild60
Spyware campaigns using zero-days found in Italy, Malaysia, Kazakhstan, UAEThe Record·Mar 29, 13:31 UTC · Mar 29, 2023MalwareCVE-2022-42856CVE-2021-30900CVE-2022-3723+6 CVEs60
Google TAG shares details about exploit chains used to install commercial spywareSecurity Affairs·Mar 29, 14:20 UTC · Mar 29, 2023MalwareCVE-2022-42856CVE-2021-30900CVE-2022-3723+7 CVEs60
Tallinn Manual author: Petya malware attack likely war crimeCyberScoop·Jul 19, 18:19 UTC · Jul 19, 2017Malware in the wild60
Friday Squid Blogging: Giant Squid from Newfoundland in the 1800sSchneier on Security·Jan 12, 22:06 UTC · Jan 12, 2024Malware in the wild60
Global malware attack 'most likely' carried out by a nation-state, NATOCyberScoop·Jul 3, 19:47 UTC · Jul 3, 2017Malware in the wild60
Predator spyware resurfaces with signs of activity, Recorded Future saysCyberScoop·Sep 5, 14:00 UTC · Sep 5, 2024Malware in the wild60
Russian military intelligence may have deployed wiper against multiple Ukrainian ISPsCyberScoop·Mar 21, 14:00 UTC · Mar 21, 2024Malware in the wild60
4-year campaign backdoored iPhones using possibly the most advanced exploit everArs Technica · Security·Dec 27, 17:03 UTC · Dec 27, 2023MalwareCVE-2023-32434CVE-2023-32435CVE-2023-38606+1 CVEs160
Google Warns Against Commercial Spyware Exploiting ZeroInfosecurity Magazine·Mar 29, 17:30 UTC · Mar 29, 2023MalwareCVE-2022-42856CVE-2022-413560
Windows spyware and zero-days linked to prodigious Israeli hack-forThe Record·Dec 12, 00:00 UTC · Dec 12, 2022MalwareCVE-2021-21166CVE-2021-30551CVE-2021-33742+2 CVEs60
European Parliament paves path for tighter spyware export controlsCyberScoop·Nov 9, 23:23 UTC · Nov 9, 2020Malware in the wild60
NSO Group spyware used against two Mexican journalists following assassinationCyberScoop·Nov 27, 14:44 UTC · Nov 27, 2018Malware in the wild60
IoT Malware Evolves to Harvest Bots by Exploiting a ZeroPalo Alto Unit 42·Nov 1, 10:59 UTC · Nov 1, 2018MalwareCVE-2014-8361CVE-2017-1721560
SHELLBIND IoT malware targets NAS devices exploiting SambaCry flawSecurity Affairs·Dec 6, 20:50 UTC · Dec 6, 2017MalwareCVE-2017-749460
Researchers warn of 'vast' new IoT botnetCyberScoop·Oct 20, 21:15 UTC · Oct 20, 2017Malware in the wildCVE-2017-822560
Attackers Exploit DVR Command Injection Flaw to Deploy BotnetInfosecurity Magazine·Apr 20, 13:01 UTC · Apr 20, 2026MalwareCVE-2024-3721CVE-2017-1721560
⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & MoreThe Hacker News·Mar 26, 15:38 UTC · Mar 26, 2026Malware in the wildCVE-2026-33017CVE-2026-2013160
⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & MoreThe Hacker News·Mar 15, 00:00 UTC · Mar 15, 2026Malware in the wildCVE-2026-3909CVE-2026-3910CVE-2026-3913+40 CVEs260
Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor BackdoorThe Hacker News·Mar 9, 06:40 UTC · Mar 9, 2026Malware in the wildCVE-2017-7921CVE-2023-6895CVE-2021-36260+2 CVEs60
Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware DeliveryThe Hacker News·Dec 9, 07:34 UTC · Dec 9, 2025MalwareCVE-2025-48543CVE-2025-6554CVE-2023-41993+12 CVEs160
ThreatsDay Bulletin: DNS Poisoning Flaw, Supply-Chain Heist, Rust Malware Trick and New RATs RisingThe Hacker News·Nov 5, 10:38 UTC · Nov 5, 2025Malware in the wildCVE-2017-1188260
⚡ Weekly Recap: Bootkit Malware, AI-Powered Attacks, Supply Chain Breaches, ZeroThe Hacker News·Oct 14, 10:56 UTC · Oct 14, 2025Malware in the wildCVE-2025-2104360
Apple’s new Memory Integrity Enforcement system deals a huge blow to spyware developersCyberScoop·Sep 10, 13:38 UTC · Sep 10, 2025Malware in the wild60
GeoServer Exploits, PolarEdge, and Gayfemboy Push Cybercrime Beyond Traditional BotnetsThe Hacker News·Aug 24, 13:31 UTC · Aug 24, 2025MalwareCVE-2024-36401160
SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkitHelp Net Security·Aug 5, 15:29 UTC · Aug 5, 2025MalwareCVE-2021-20035CVE-2021-20039CVE-2024-38475+1 CVEs60
⚡ Weekly Recap — SharePoint Breach, Spyware, IoT Hijacks, DPRK Fraud, Crypto Drains and MoreThe Hacker News·Jul 28, 15:57 UTC · Jul 28, 2025Malware in the wildCVE-2025-49706CVE-2025-49704CVE-2025-20281+27 CVEs60
Google finds custom backdoor being installed on SonicWall network devicesArs Technica · Security·Jul 15, 00:00 UTC · Jul 15, 2025Malware in the wildCVE-2021-20038CVE-2024-38475CVE-2021-20035+2 CVEs60
⚡ Weekly Recap: Chrome 0-Day, Ivanti Exploits, MacOS Stealers, Crypto Heists and MoreThe Hacker News·Jul 15, 00:00 UTC · Jul 15, 2025Malware in the wildCVE-2025-32462CVE-2025-32463CVE-2025-20309+23 CVEs60
RondoDox Botnet Exploits Flaws in TBK DVRs and FourThe Hacker News·Jul 8, 12:44 UTC · Jul 8, 2025MalwareCVE-2024-3721CVE-2024-1285660
⚡ Weekly Recap: APT Intrusions, AI Malware, ZeroThe Hacker News·Jun 3, 04:04 UTC · Jun 3, 2025Malware in the wildCVE-2025-3935CVE-2025-47577CVE-2025-2760+14 CVEs60
Hackers Exploit Samsung MagicINFO, GeoVision IoT Flaws to Deploy Mirai BotnetThe Hacker News·May 9, 03:55 UTC · May 9, 2025Malware in the wildCVE-2024-6047CVE-2024-11120CVE-2018-10561+1 CVEs60
⚡ Weekly Recap: iOS Zero-Days, 4Chan Breach, NTLM Exploits, WhatsApp Spyware & MoreThe Hacker News·May 6, 07:05 UTC · May 6, 2025Malware in the wildCVE-2025-24054CVE-2024-43451CVE-2025-31200+7 CVEs160
NoviSpy Spyware Installed on Journalist's Phone After Unlocking It With Cellebrite ToolThe Hacker News·Dec 15, 00:00 UTC · Dec 15, 2024Malware in the wildCVE-2024-4304760
How a Russian man’s harrowing tale shows the physical dangers of spywareCyberScoop·Dec 5, 11:00 UTC · Dec 5, 2024Malware in the wild60
RomCom hackers chained Firefox and Windows zero-days to deliver backdoorHelp Net Security·Nov 26, 00:00 UTC · Nov 26, 2024MalwareCVE-2024-9680CVE-2024-49039CVE-2023-3688460
FBI joint operation takes down massive Chinese botnet, Wray saysCyberScoop·Sep 18, 22:20 UTC · Sep 18, 2024Malware in the wild60
Massive China-state IoT botnet went undetected for four years—until nowArs Technica · Security·Sep 18, 19:58 UTC · Sep 18, 2024Malware in the wildCVE-2024-2188760
Multiple malware families delivered exploiting GeoServer GeoTools flaw CVE-2024Security Affairs·Sep 9, 06:41 UTC · Sep 9, 2024Malware in the wildCVE-2024-36401160
Hackers infect ISPs with malware that steals customers’ credentialsArs Technica · Security·Aug 27, 14:00 UTC · Aug 27, 2024MalwareCVE-2024-3971760