Malware

Malware

Ledger Halts Asian Reseller Sales After Wallet Implants Capture Recovery Phrases

Ledger halted reseller sales in seven Asian markets after confirming CryptoBilis wallets had implants capturing recovery phrases.

Oct 14, 202619:47 3 min readRead →

Malware

Polish Probe Says NSO Retained Technical Access to Poland’s Pegasus System

Polish prosecutors found CBA lacked full control of Pegasus as NSO retained infrastructure access and data routed abroad, with no proof of specific access.

Oct 14, 202618:38 3 min readRead →

Malware

Microsoft and Health-ISAC Disrupt Infrastructure Behind Billion-Message Phishing Market

Microsoft and Health-ISAC seized domains supporting YAM Store, CoGUI and Iron Man, phishing services Microsoft says enabled global campaigns.

Oct 14, 202615:02 4 min readRead →

Malware

XWorm’s 46-Plugin Arsenal Expands the Windows RAT Into a Surveillance Toolkit

Netskope reports XWorm uses 46 plugins for GPS, audio, webcam and authenticated browser session control on Windows systems.

Oct 13, 202613:16 3 min readRead →

Malware

Fake Claude Mac installer ads hide behind Bing redirects to run ClickFix commands

Malicious Google ads show bing.com URLs to send Mac users to a fake Claude page pushing a ClickFix Terminal command; final payload unknown.

Oct 9, 202622:00 3 min readRead →

Malware

Midnight Mimosa Turns Budget Android Devices Into Pre-Compromised Ad-Fraud Nodes

Bitdefender-reported Midnight Mimosa firmware malware in budget Android uses system privileges for ad-fraud payloads and reportedly evading Play Protect.

Oct 9, 202611:49 6 min readRead →

Malware

Fake Firefox Wallet Extensions Target Rabby and OKX Recovery Secrets

Report says 16 fake Firefox extensions posed as Rabby and OKX wallets to intercept recovery phrases during import for attacker transmission.

Oct 8, 202611:30 5 min readRead →

Malware

Ploutus ATM Cash-Out Case Brings Alleged Malware Engineer Before a US Court

Alleged Ploutus developer Anibal Canelon Aguirre arrested over $5.4M ATM jackpotting scheme targeting banks across 47 states and linked to TdA.

Oct 5, 202618:27 5 min readRead →

Malware

ClingSTUN Turns Compromised Linux Devices Into NAT-Traversing Proxies

ClingSTUN Linux backdoor uses STUN to bypass NAT, turns infected devices into proxies, persists via reboot and spreads with hardcoded exploits.

Oct 5, 202614:25 5 min readRead →