Danbooru Flash XSS worm stole viewer IPs and hijacked accounts
The site was taken down in about six minutes; roughly 300 people ran the worm and seven got unused API keys.
Stories per day · 30 days
2 RSS
24 stories, newest first · one card per story
Stories tagged #worm
Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)
SANS analyzes Panchan, a Golang cryptomining worm that still spreads by stealing SSH keys.
3
Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise
Shai-Hulud infected Tensorlake’s npm SDK 0.5.144, stealing credentials before the package was removed within minutes.
3
Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets
Malicious tensorlake@0.5.144 on npm delivers a Shai-Hulud worm that steals developer secrets and can wipe hosts.
9
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Attackers published a malicious tensorlake npm package that spreads a new Shai-Hulud supply-chain worm.
7
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.
3
Add one more AI worry to the nightmare scenario: self-replicating prompt injections
OpenAI found worm-like 'self-replicating prompt injections' against its GPT models and is adversarially training GPT-5.6 to resist them.
1
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
New Carbonato malware uses AI agents to hijack exposed Docker hosts
Carbonato botnet hijacks exposed Docker hosts, installs Hermes Agent, and spreads by scanning for more daemons.
An Undercover Google Analyst Infiltrated a Notorious Supply Chain Hacking Gang
Google revealed a Mandiant undercover analyst infiltrated TeamPCP, letting it warn hundreds of victims and disrupt the gang's supply chain attacks and extortion.
ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks
ConnectWise patched critical ScreenConnect flaw CVE-2026-84869 (CVSS 9.9) exploited since August 20 in worm-like attacks; CISA added it to KEV.
4
Quoting Calif Research
Calif Research demos WeWorm, an AI-built zero-click worm that spreads via WeChat calls on iOS and Android without user interaction.
Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls
Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.
WeChat worm could pwn a friend before they even answered the call
Calif researchers demoed WeWorm, a zero-click WeChat VoIP memory-corruption worm enabling account takeover; Tencent patched it August 21.
WeChat Worm Can Hijack Accounts Without Victims Answering Calls
Researchers demoed WeWorm, a zero-click WeChat worm hijacking accounts via incoming VoIP calls using a memory corruption flaw; Tencent patched it in August.
2
WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android
Researchers demonstrated WeWorm, a zero-click worm exploiting a memory-corruption flaw in WeChat's VoIP stack to spread via calls across iOS and Android.
WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
Researchers demonstrated a zero-click WeChat worm that hijacked accounts via incoming calls; Tencent blocked the exploit server-side after July disclosure, no real attacks reported.
4
THost9 Android RAT Pairs Packed Loader With ADB Worm
Dark Atlas details THost9, a packed Android RAT paired with an ADB worm that installs itself on devices with exposed Android Debug Bridge services.
Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
1
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
1
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
4
Risky Bulletin: Two TeamPCP members arrested in Australia
Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Check Point details StopAndProtect: ~2,000 compromised WordPress sites deliver ClickFix fake-CAPTCHA malware toolkit combining ransomware, credential theft, screenshots, and WhatsApp surveillance.
3
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.