Search: “editor”

458 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 602 Vulnerability 499 Malware 458 Policy & legal 426 Threat actor 399 Industry 289 Phishing & fraud 250 Data breach 189 Exploit / PoC 175 Research 54 AI safety & security 50 AI tools & infra 32 AI industry 32 Advisory 30

SeverityAll critical 948 high 997 medium 510 low 936 info 141

Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

Compromised Admin Menu Editor Pro update server distributed backdoored plugin versions installing web shells and hidden admin accounts on roughly 1,500 WordPress sites.

A threat actor with root-level access to adminmenueditor.com pushed trojanized Admin Menu Editor Pro versions 2.35 and 2.36 containing includes/wp-user-consent.php, which installed a web shell and created a hidden wp_-prefixed user account. At least 230 customers and roughly 1,500 sites installed the malicious update, with several hundred more downloads possibly affected. Developer Janis Elsts took the site offline after the attacker recompromised the clean 2.36 release; version 2.34 and the free plugin are believed unaffected.

BleepingComputerSep 15, 20:34 UTC · 18h agoMalware in the wild1

TamperedChef Malware Disguised as Fake PDF Editors Steals Credentials and Cookies

The Hacker NewsSep 30, 04:34 UTC · Sep 30, 2025Malware

Microsoft revealed details of a supply chain attack at unnamed Maker of PDF Editor

Security AffairsJul 28, 08:32 UTC · Jul 28, 2018Malware

These 28+ Android Apps with 10 Million Downloads from the Play Store Contain Malware

The Hacker NewsJul 27, 13:37 UTC · Jul 27, 2022Malware

Infected text editors load backdoor into macOS

Kaspersky SecurelistMar 13, 11:29 UTC · Mar 13, 2024Malware

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.

Manifold Security found 77 extensions uploaded to the Open VSX marketplace between July 26 and August 1, 2026 that impersonate real Microsoft VS Code Marketplace tools, with all 77 sending data to mangorbit.com. 58 lightweight variants exfiltrate the hostname, while 19 recon variants collect editor details, OS username, Git remote hosts, CI environment variables (GitHub, GitLab, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod), and installed extension IDs. The recon variant retries for up to seven days and can fall back to a DNS TXT record for exfiltration if the primary domain is blocked. The extensions were removed from Open VSX by August 3, 2026; the disclosure follows a separate npm supply chain campaign, ChainDrop, which compromised 450 packages with a Shai-Hulud worm variant.

The Hacker NewsSep 1, 08:33 UTC · 15d agoMalware

Rules File Backdoor: AI Code Editors exploited for silent supply chain attacks

Security AffairsMar 19, 10:42 UTC · Mar 19, 2025Malware

New ‘Rules File Backdoor’ Attack Lets Hackers Inject Malicious Code via AI Code Editors

The Hacker NewsMar 18, 16:19 UTC · Mar 18, 2025Malware1

SteelFox Trojan imitates popular products to drop stealer and miner malware

Kaspersky SecurelistNov 6, 10:00 UTC · Nov 6, 2024Malware CVE-2020-14979

ClickFix campaign delivers Mac malware via fake Apple page

Help Net SecurityApr 10, 00:00 UTC · Apr 10, 2026Malware

Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings

Infosecurity MagazineApr 9, 11:20 UTC · Apr 9, 2026Malware

EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations

The Hacker NewsOct 8, 04:33 UTC · Oct 8, 2025Malware

Fleckpe Android Malware Sneaks onto Google Play Store with Over 620,000 Downloads

The Hacker NewsMay 5, 09:31 UTC · May 5, 2023Malware

North Korean Hackers Use Fake Coding Tasks to Steal Crypto

Infosecurity MagazineJun 8, 15:00 UTC · Jun 8, 2026Malware

New macOS infostealer impersonates Apple, Microsoft, and Google in a single attack chain

Help Net SecurityMay 19, 00:00 UTC · May 19, 2026Malware

Notepad++ users take note: It's time to check if you're hacked

Ars Technica · SecurityFeb 2, 20:30 UTC · Feb 2, 2026Malware

Compromised Cloud Compute Credentials: Case Studies From the Wild

Palo Alto Unit 42Jun 5, 17:10 UTC · Jun 5, 2024Malware

Facestealer\' malware remains a quiet scourge in Google Play Store apps

The RecordJan 12, 00:00 UTC · Jan 12, 2023Malware

New Mirai variant adds stealth capabilities to notorious botnet code

FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.

FortiGuard Labs has identified Evooo1Bot, a previously undocumented Linux malware based on the Mirai botnet code, which has been actively exploiting unpatched vulnerabilities in internet-facing hardware for at least a month. Targeted devices include routers and edge hardware from Alcatel, D-Link, Mitsubishi Electric, Netgear, Tenda and Telesquare, with telemetry showing activity in North and South America, Europe, India, China and Japan. Beyond Mirai's usual DDoS functions, the variant adds encrypted C2 communications, a honeypot-aware SSH scanner, a sniffer for unchanged default credentials, and abuse of the SOCKS protocol to turn compromised devices into persistent proxies for concealing origin and pivoting into internal networks.

The RecordAug 13, 15:57 UTC · Aug 13, 2026Malware in the wild