ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
Latest cybersecurity malware news, analysis, and intelligence.
Security researchers discovered two Windows variants of the SprySOCKS backdoor—WIN_DRV and WIN_PLUS—using advanced kernel-level stealth drivers and injection chains. The finding reveals state-sponsored actors expanding their cyber espionage tools across multiple platforms, significantly broadening t
ScarCruft uses fake Microsoft security alerts to phish NarwhalRAT, a new Python-based trojan. The attack chain uses malicious LNK files to maintain persistent, undetectable access.
Chinese APT Earth Lusca deploys Windows variants of SprySOCKS backdoor against governments in Taiwan, Thailand, Pakistan, and Honduras. The malware features advanced kernel rootkit capabilities that significantly complicate detection and remediation.
Attackers compromised 400+ Arch Linux AUR packages by injecting a Rust credential stealer into abandoned package build scripts. The malware executes during compilation and can optionally deploy an eBPF rootkit for post-exploitation persistence.
OnyxC2 is a $250/month malware-as-a-service that steals credentials from 210+ applications, offering enterprise-grade theft capabilities to ordinary cybercriminals. Its advanced evasion techniques and broad targeting democratize credential harvesting, making sophisticated attacks accessible to non-t
A leaked supply chain toolkit with pre-built malware cuts software compromise from weeks to days. It democratizes attacks and marks cybercrime's shift to industrialized operations.
JDY, a China-linked botnet with 1,500+ compromised devices, prioritizes stealthy intelligence gathering over destructive attacks by targeting SOHO devices in enterprise networks.
The JDY botnet, attributed to Chinese state-sponsored actors, has grown to 1,500+ nodes and rapidly identifies vulnerabilities in U.S. critical infrastructure. It feeds intelligence to APT operators for swift exploitation, representing a sophisticated evolution in state-sponsored reconnaissance tact
Microsoft removed 73 GitHub repositories after a malware supply-chain attack targeted AI development tools. The Miasma/Shai-Hulud campaign was contained in 105 seconds but disrupted CI/CD pipelines.
Researchers built an autonomous AI worm using local language models—no cloud needed. It self-replicates across networks, generates custom attacks per target, and requires zero human intervention.
100+ NPM/PyPI packages hit by Shai-Hulud attacks with 471+ malicious artifacts since June 1. Leaked source code accelerated the worm's spread across JavaScript and Python ecosystems.
The Hades campaign compromised 19 PyPI packages with malicious code executing at startup to steal developer credentials from AWS, GCP, Azure, GitHub, Kubernetes, and CI/CD platforms.
NFCShare Android malware resurges targeting European banks, distributed via GitHub. It tricks victims with fake verification screens into scanning payment cards via NFC, stealing card data and PINs.
WhatsApp has disrupted NSO Group-attributed spear-phishing campaigns targeting user accounts through social engineering. The attacks aimed to compromise credentials and enable malware installation, highlighting persistent threats from state-level surveillance actors.
Meta filed a contempt order after NSO Group launched phishing attacks on WhatsApp, using malicious domains to trick users into compromising their credentials. The campaign violates an existing federal injunction and marks the fourth documented breach by the Israeli spyware vendor.
VerdantBamboo deployed BRICKSTORM malware on Linux appliances via compromised MSPs. Targeting overlooked devices like firewalls and NAS, they achieved persistent access and lateral movement in victim networks.
VS Code delays extension updates by 2 hours to counter supply chain attacks. This critical window allows developers and maintainers to detect and remove malicious packages before deployment.
C0XMO, a sophisticated Gafgyt botnet variant, targets IoT devices and routers across multiple CPU architectures, exploiting CVE-2021-27137 in DD-WRT firmware. Its modular design enables independent updates and lateral movement capabilities while actively eliminating rival malware from compromised sy
A self-replicating Miasma worm compromised 73 Microsoft GitHub repositories across four organizations (Azure, Azure-Samples, Microsoft, MicrosoftDocs), marking a major supply chain attack. GitHub disabled public access to contain the breach.
Over 50 npm packages weaponized with IronWorm stealer and Miasma worm. IronWorm uses eBPF rootkits to hide while stealing developer credentials, posing a critical supply chain threat.
New Android spyware Asin targets Arabic journalists via fake apps posing as news sources and PDF editors. Active since early 2025, it compromises OSINT researchers through deceptive websites and social engineering.
Chinese APT UNC5221 hid in compromised networks for 18+ months using advanced backdoors like Brickstorm, targeting U.S. enterprises and MSPs in sophisticated state-sponsored espionage.
TA4922, a China-linked cybercrime group, has expanded globally with phishing and messaging app evasion tactics to steal credentials and data from organizations across Europe and Africa.
IronWorm compromised 36 npm packages to steal developer credentials and self-propagate via eBPF rootkit and Tor C&C. The attack exfiltrates API keys, SSH credentials, and wallets, infecting downstream developers and CI/CD systems.
A new macOS backdoor called FlutterShell spreads via Google ads using legitimate Apple signatures to bypass security checks. Its WebView-based architecture enables real-time malware updates without recompilation, extending its operational lifespan and evasion capabilities.
TA4922 expanded from East Asia to conduct phishing campaigns across the UK, Germany, Italy, and South Africa, deploying surveillance-capable malware for financial crime and espionage resale.
Chinese cybercrime group TA4922 escalates European attacks with Atlas RAT malware, conducting unprecedented campaign volumes targeting Germany, Italy, UK, and South Africa for financial gain.
Attackers exploit Google's DoubleClick to deliver DesckVB RAT through phishing emails, abusing trusted infrastructure to evade email filters. Once installed, the .NET trojan provides remote access and disables security controls to establish persistent footholds in corporate networks.
AI can now convert vulnerability disclosures into functional malware in minutes, eliminating the patching window that responsible disclosure relies on. As LLMs become weaponizable, the traditional security model collapses.
Dutch police dismantled Asocks, a 17-million-device botnet used for DDoS attacks and fraud. The takedown seized 200 command-and-control servers in one of the largest botnet disruptions on record.