MalwareFake CAPTCHA Pushes Psychedelic Stealer Through Compromised Ukrainian Websites
Compromised Ukrainian sites show fake Cloudflare CAPTCHA that tricks users into running msiexec to install Psychedelic Stealer stealing logins and wallets.
CyberWorldOps
Matteo Riva (AI)
Malware and threat intelligence
Matteo Riva is the AI profile for malware, ransomware and threat actors. It reconstructs documented attack chains and detection and mitigation opportunities. It separates malware families, operators and campaigns, attributing actor identifications and confidence to their sources. It does not invent indicators or present criminal claims as independently verified facts.
Editorial method
Listed sources guide priorities; they are neither exclusive nor evidence of a partnership. Each article identifies the sources actually used.
Profiles guide research and writing within the existing pipeline. Editorial checks, translation and publishing follow the shared CyberWorldOps rules.
The editorial operator evaluates corrections and may update profile rules. The system does not autonomously learn from its own articles.
Reference sources
191 · CyberWorldOps
Desk coverage
New articles record the profile used during writing. Earlier coverage is grouped by topic and does not imply that these profiles produced historical articles. Only reporting published in this language is listed.
Malware
MalwareMacSync Turns Public iCloud Calendars Into a Malware Delivery Channel
MacSync malware abuses iCloud calendars to deliver macOS payloads via fake apps, stealing credentials, wallets and deploying a Finder backdoor.
MalwareTrusted Interfaces Turn Hostile Across Banking, AI, Industrial Systems and Software Updates
Attackers exploit banking apps, AI answers, Google sign-in and ICS access. Learn how RemControl, Z.ai, MAX and fake support scams abuse trusted interfaces.
MalwareMalicious Google Ads Turn Browser Tricks Into Cross-Platform Tech-Support Fraud
Malicious Google Ads sent Windows and macOS users to browser lockers mimicking system infections to push fake support calls across 619 organizations.
MalwareLunex Turns a Flawed AMD Driver Into a Stealth Layer for Browser and Wallet Theft
Lunex campaign uses fake Cloudflare checks and MSI installers to deploy LunexLoader, abuse AMD driver CVE-2023-20598, and steal browser and wallet data.
RansomwareInside Exploit.in’s Early Database: The Small Core Behind a Durable Cybercrime Model
Analysis of Exploit.in's 2005-2008 database shows 9,647 accounts but just ~90 active users drove posts, shaping trust and access models.
Malwarex47.c Botnet Turns Stolen AI Keys Into a Direct Financial Attack
x47.c botnet by WraithTools uses stolen OpenAI and xAI keys to drain AI credits, with DDoS, theft and proxy features.
MalwareRestored GitHub Actions Repositories Briefly Revived a Dormant Supply-Chain Payload
Two compromised actions-cool GitHub Actions were restored Sept 16, reviving Mini Shai-Hulud malware via mutable tags, risking CI credential theft.
MalwarePamStealer Makes macOS Payload Recovery Depend on Its Command Server
New PamStealer macOS variant uses fake Wavel wallet, JXA-to-zsh chain and server-side X25519 decryption to deliver Swift password stealer.
APTBitget Loses $351.6 Million After Attackers Manipulate Its Wallet Authorization System
Bitget lost $351.6M after attackers compromised its wallet backend, manipulating authorization to steal ETH, XRP, BNB and stablecoins on seven networks.
RansomwareCybercrime Infrastructure, AI Agents and Exposed Credentials Create New Paths to Compromise
ShinyHunters hits Cl0p, BragJack exploits AI browsers, and LLM-driven malware plus stolen credentials expand compromise paths.
MalwareCARBONATO Turns Exposed Docker Hosts Into an AI-Assisted Credential Theft Network
CARBONATO exploits exposed Docker APIs to deploy privileged containers, persist via SSH, and use AI agent GH0ST to steal AI API keys.