Search: “Exodus Wallet”

11 stories

Huntress found tampered Exodus crypto wallet installers delivering a modular RAT that steals credentials rather than wallet funds.

Huntress analysts analyzed tampered installers for the Exodus cryptocurrency wallet that bundle a modular remote access trojan. The implant focuses on harvesting credentials instead of draining wallet balances, suggesting broader access theft. The case highlights installer tampering as a supply-chain-style delivery vector for credential-stealing tooling.

HuntressSep 1, 04:00 UTC · 16d agoMalware in the wild

Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13

The Hacker NewsMar 26, 10:55 UTC · Mar 26, 2026Exploit / PoC in the wildCVE-2024-23222 CVE-2022-48503 CVE-2023-43000+9 CVEs

Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer

The Hacker NewsJun 30, 11:18 UTC · Jun 30, 2026Vulnerability in the wildCVE-2026-485582

SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)

Help Net SecurityJun 30, 00:00 UTC · Jun 30, 2026Vulnerability in the wildCVE-2026-485581

New macOS malware steals passwords by posing as Apple's crash-reporting tool

Help Net SecurityJul 14, 00:00 UTC · Jul 14, 2026Malware in the wild

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Enigma, Vector, and TgToxic: The New Threats to Cryptocurrency Users

The Hacker NewsFeb 11, 13:10 UTC · Feb 11, 2023Exploit / PoC in the wildCVE-2015-2291

⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More

The Hacker NewsMar 15, 00:00 UTC · Mar 15, 2026Malware in the wildCVE-2026-3909 CVE-2026-3910 CVE-2026-3913+40 CVEs2

CrashStealer: New macOS Infostealer Uses Signed Apps to Evade Gatekeeper

Security AffairsJul 14, 07:42 UTC · Jul 14, 2026Malware in the wild

Lazarus Group deceives developers with 6 new malicious npm packages

CyberScoopMar 12, 22:31 UTC · Mar 12, 2025Threat actor in the wild1

Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads

Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.

HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.

Cyber Security Newsupdated Sep 15, 11:51 UTC · 1d agofirst Sep 15, 06:56 UTC · 1d agoMalware in the wild 7 sources