30
30
Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs
Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.
PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.
55
30
30
30
30
30
30
30
30
30
30
30
30
30
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens from nearly 31,000 users to Russian bot-service proxy servers.
Socket researchers found the 'Twitch Enhanced Viewer | JeetBot' browser extension forwarded users' live Twitch OAuth tokens as an &auth= query parameter to operator-controlled proxy servers, affecting about 30,000 Chrome users and 604 Firefox users. The tokens, written in cleartext to proxy logs, are bearer credentials granting access to chat, whispers, and account settings without password or 2FA. The operator is a Russian commercial Twitch/Kick/VK-Live bot SaaS linked to Cyprus-based developer Aleksandr Popov; earlier v4.x builds also POSTed tokens to a set-token endpoint. Firefox add-on version 85.8.7 stops the token forwarding, but previously transmitted tokens remain valid until revoked.
50
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
BambooToken Malware Uses MQTT to Control Windows and Linux Systems
Lumen uncovers BambooToken, a stealthy multi-platform malware using MQTT C2 and Tendyron DLL sideloading to compromise Asian and South American organizations.
Lumen Black Lotus Labs disclosed BambooToken, a previously undocumented malware family active since at least February 2023 that controls Windows and (since December 2025) Linux hosts via the MQTT protocol for C2. The malware sideloads a rogue OnKeyToken_KEB.dll via Tendyron's OnKey PKI token software, gathers host details, and uses a WMI-based plugin to enumerate installed antivirus products and exfiltrate them to C2 domains proxied through Cloudflare. A dozen compromised entities were detected across Asia and South America, and DLL sideloading plus SoftEther VPN usage suggests a China nexus.
48
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
Group-IB says Gigabud installs a helper app called Vwork, derived from the open-source Shelter tool, which creates an Android work profile and drops a tampered banking app inside it, hiding the trojan from banking apps' malware scans. Gigabud, active since 2022 and linked by Group-IB to the GoldFactory group, abuses Accessibility access and overlay screens to steal credentials and run fraudulent payments while a black screen conceals the operator's actions. Group-IB confirmed the full attack chain on infected devices in Indonesia, counting about 1,469 compromised devices and estimated losses of roughly $960,000 between February and July 2026. Vwork-compatible Gigabud samples have been found targeting 11 countries including Brazil, Mexico, Indonesia, Thailand, and Türkiye, though only the Indonesian chain is confirmed.
60
HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.
ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.
55
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.
SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.
72
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.
Check Point Research's new report analyzes JSCeal, a compiled V8 JavaScript malware obfuscated with javascript-obfuscator using RC4-protected strings, control-flow flattening, and proxy functions. Delivered through fake TradingView installers on malvertising sites overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns, it harvests cookies, passwords and OAuth tokens from Chromium browsers, records keystrokes and screenshots, and can replay stolen Google session cookies to bypass authentication. It also installs a local proxy with service-specific handlers for Binance, Bybit, and Ledger to intercept and modify cryptocurrency-related traffic.
45
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.
Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.
45
New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
A new Windows backdoor dubbed SLEEPWALKER hides as ESET Management Agent's dpapi.dll, waits for a crafted network packet, then executes custom 23-instruction bytecode.
Researcher Dominik Reichel documented SLEEPWALKER, an unsigned 59,904-byte 64-bit Windows DLL that side-loads into ESET Management Agent's ERAAgent.exe while impersonating dpapi.dll. The implant monitors every network interface indefinitely for a specifically crafted trigger packet, then executes commands written in a custom 23-instruction bytecode language over six transports, including TCP, UDP, ICMP, SMB named pipes, raw promiscuous capture, and VMware VMCI. It has no embedded infrastructure, makes no outbound connections of its own, and requires prior local administrator access to install; no victims, attribution, or in-the-wild deployment are confirmed. Reichel assesses the design as consistent with a targeted, well-resourced operation, while ESET calls the scenario's security relevance negligible since it provides no new access path.
52