Search: “Elastic Security Labs”

77 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 88 Vulnerability 34 Ransomware 21 Industry 11 Threat actor 8 Policy & legal 5 AI safety & security 4 AI tools & infra 4 Phishing & fraud 4 Research 4 Exploit / PoC 3 Data breach 3 AI industry 1 Tools 1

SeverityAll critical 51 high 78 medium 41 low 9 info 13

KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.

Elastic Security Labs tracks the KREMLIN banking malware operation as REF9334, active since at least May 2025 across seven campaigns primarily targeting 12 Brazilian banks. The malware is installed by a victim-run JavaScript loader, achieves scheduled-task persistence, and side-loads a malicious DLL via SentinelOne's SentinelMemoryScanner.exe. It modifies Chrome and Edge Secure Preferences files, enables developer mode, and regenerates Chromium MAC values to silently install extensions, while extracting browser encryption material including the newer App-Bound OSCrypt key. An Ethereum smart contract serves as a dead-drop resolver for C2 config; Elastic disrupted over 1,500 infections via a canary domain.

GBHackersSep 16, 05:33 UTC · 19h agoMalware in the wild 2 sources

Elastic Defend now covers 800+ vulnerable drivers, with automated troubleshooting and ARM support

Help Net SecurityAug 3, 00:00 UTC · Aug 3, 2026Ransomware

Hackers Use Leaked Shellter Tool License to Spread Lumma Stealer and SectopRAT Malware

The Hacker NewsJul 10, 07:51 UTC · Jul 10, 2025Malware

Pikabot returns with new tricks up its sleeve

Help Net SecurityFeb 26, 00:00 UTC · Feb 26, 2024Ransomware

Experts detected a new variant of RUSTBUCKET macOS malware

Security AffairsJul 3, 09:36 UTC · Jul 3, 2023Malware

New Lobshot hVNC malware spreads via Google ads

Security AffairsMay 5, 22:14 UTC · May 5, 2023Malware

JOKERSPY used to target a cryptocurrency exchange in Japan

Security AffairsJun 27, 07:27 UTC · Jun 27, 2023Malware

TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Malware

Open-source CI/CD abuse detector guards against stolen credential attacks

Help Net SecurityJun 15, 00:00 UTC · Jun 15, 2026Vulnerability

Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069

The Hacker NewsApr 15, 00:00 UTC · Apr 15, 2026Ransomware

NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems

The Hacker NewsDec 12, 13:12 UTC · Dec 12, 2025Malware1

New Malware Loaders Use Call Stack Spoofing, GitHub C2, and .NET Reactor for Stealth

The Hacker NewsApr 5, 08:10 UTC · Apr 5, 2025Malware1

Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

The Hacker NewsJul 17, 15:19 UTC · Jul 17, 2026Malware

Researchers Uncover Flaws in Windows Smart App Control and SmartScreen

The Hacker NewsAug 6, 04:00 UTC · Aug 6, 2024Vulnerability in the wild1

Researchers Uncover Hijack Loader Malware Using Stolen Code

The Hacker NewsOct 21, 13:19 UTC · Oct 21, 2024Malware

How 2022's threats will impact the global landscape in 2023

Help Net SecurityMay 22, 08:08 UTC · May 22, 2023Malware

Elastic detects stealthy NANOREMOTE malware using Google Drive as C2

Security AffairsDec 12, 11:11 UTC · Dec 12, 2025Malware

Lazarus targets blockchain engineers with new KandyKorn macOS Malware

Security AffairsNov 5, 12:14 UTC · Nov 5, 2023Malware

Experts spotted a new macOS Backdoor named SpectralBlur linked to North Korea

Security AffairsJan 6, 18:36 UTC · Jan 6, 2024Malware

North Korea-linked APT BlueNoroff used new macOS malware ObjCShellz

Security AffairsNov 8, 08:12 UTC · Nov 8, 2023Malware

New SPECTRALVIPER Backdoor Targeting Vietnamese Public Companies

The Hacker NewsJun 10, 12:04 UTC · Jun 10, 2023Malware

Medusa ransomware uses malicious Windows driver ABYSSWORKER to disable security tools

Security AffairsMar 24, 14:56 UTC · Mar 24, 2025Ransomware

Beware: New 'RustBucket' Malware Variant Targeting macOS Users

The Hacker NewsJul 10, 04:23 UTC · Jul 10, 2023Malware

ClickFix Campaign Abuses Compromised Sites to Deploy MIMICRAT Malware

The Hacker NewsFeb 20, 14:07 UTC · Feb 20, 2026Malware

New macOS Malware TodoSwift Linked to North Korean Hacking Groups

The Hacker NewsAug 22, 04:13 UTC · Aug 22, 2024Malware

North Korea-linked APT Sapphire Sleet targets IT job seekers

Security AffairsNov 13, 08:51 UTC · Nov 13, 2023Malware

Japanese Cryptocurrency Exchange Falls Victim to JokerSpy macOS Backdoor Attack

The Hacker NewsJun 28, 05:25 UTC · Jun 28, 2023Malware

Stealthy BLOODALCHEMY Malware Targeting ASEAN Government Networks

The Hacker NewsMay 29, 04:43 UTC · May 29, 2024Malware

N. Korea's BlueNoroff Blamed for Hacking macOS Machines with ObjCShellz Malware

The Hacker NewsNov 8, 03:48 UTC · Nov 8, 2023Malware

New Phishing Campaign Deploys WARMCOOKIE Backdoor Targeting Job Seekers

The Hacker NewsJun 12, 09:34 UTC · Jun 12, 2024Malware

Axios Supply Chain Attack Pushes Cross

The Hacker NewsMar 31, 18:05 UTC · Mar 31, 2026Malware

SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

Bitdefender reports SilkParasite, a China-nexus espionage cluster targeting Central Asian governments with seven RATs, five newly documented, delivered via spearphished RAR archives.

Bitdefender Labs assesses with medium confidence that SilkParasite, first discovered in late 2025, is a China-nexus cluster targeting government bodies in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia. Attacks use password-protected RAR archives with malicious Office documents, macro-triggered DLL sideloading, and checks for running Kaspersky AV before execution. The arsenal spans seven RAT families in .NET, C++, Go, and JavaScript with plugin architectures and diverse C2 channels including Google Drive and HTTP cookie/ETag headers; roughly 65 DriveSilkRAT infections were observed, mostly in Asia. Ties to China include BLOODALCHEMY (a Deed RAT/ShadowPad descendant) and an improved SpiceRAT used by SneakyChef, with traces of AI-assisted development in the tooling and lures.

The Hacker NewsAug 20, 05:47 UTC · 27d agoThreat actor in the wild

New BLISTER Malware Update Fuelling Stealthy Network Infiltration

The Hacker NewsSep 5, 14:04 UTC · Sep 5, 2023Malware

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

The Hacker NewsJul 19, 18:14 UTC · Jul 19, 2026Malware

Medusa Ransomware Uses Malicious Driver to Disable Anti

The Hacker NewsMar 22, 04:07 UTC · Mar 22, 2025Ransomware

Outlaw Group Uses SSH Brute-Force to Deploy Cryptojacking Malware on Linux Servers

The Hacker NewsMay 1, 06:38 UTC · May 1, 2025Malware CVE-2016-8655 CVE-2016-5195

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.

Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.

Elastic Security LabsSep 14, 00:00 UTC · 3d agoMalware in the wild

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.

Broadcom's Symantec and Carbon Black detail Jewelbug, a China-based hackers-for-hire group conducting espionage against governments and militaries in the Middle East, Southeast Asia, and South Asia, plus crypto fraud against Chinese-speaking victims. Operations center on XG-Web, a browser-centric remote-access and infostealing framework, with implants spanning browsers, Windows, Linux, and network devices. The group overlaps with CL-STA-0049, Ink Dragon, Earth Alux, and REF7707, and compromised a Middle Eastern government's webmail across 15 tenants.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code

The Hacker NewsJul 20, 08:37 UTC · Jul 20, 2026Malware

OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack

The Hacker NewsJun 11, 09:45 UTC · Jun 11, 2026Vulnerability1