Malware

Malware

Malicious Google Ads Turn Browser Tricks Into Cross-Platform Tech-Support Fraud

Malicious Google Ads sent Windows and macOS users to browser lockers mimicking system infections to push fake support calls across 619 organizations.

Sep 27, 202605:30 6 min readRead →

Malware

Lunex Turns a Flawed AMD Driver Into a Stealth Layer for Browser and Wallet Theft

Lunex campaign uses fake Cloudflare checks and MSI installers to deploy LunexLoader, abuse AMD driver CVE-2023-20598, and steal browser and wallet data.

Sep 26, 202621:45 6 min readRead →

Malware

x47.c Botnet Turns Stolen AI Keys Into a Direct Financial Attack

x47.c botnet by WraithTools uses stolen OpenAI and xAI keys to drain AI credits, with DDoS, theft and proxy features.

Sep 26, 202613:29 6 min readRead →

Malware

Restored GitHub Actions Repositories Briefly Revived a Dormant Supply-Chain Payload

Two compromised actions-cool GitHub Actions were restored Sept 16, reviving Mini Shai-Hulud malware via mutable tags, risking CI credential theft.

Sep 26, 202603:43 5 min readRead →

Malware

PamStealer Makes macOS Payload Recovery Depend on Its Command Server

New PamStealer macOS variant uses fake Wavel wallet, JXA-to-zsh chain and server-side X25519 decryption to deliver Swift password stealer.

Sep 26, 202601:28 6 min readRead →

Malware

CARBONATO Turns Exposed Docker Hosts Into an AI-Assisted Credential Theft Network

CARBONATO exploits exposed Docker APIs to deploy privileged containers, persist via SSH, and use AI agent GH0ST to steal AI API keys.

Sep 25, 202613:26 6 min readRead →

Malware

ClickFix Turns Legitimate Websites and System Tools Into a Malware Delivery Chain

ClickFix tricks users into running malicious commands via fake Cloudflare checks, using 17,000+ infected sites, blockchain redirects and OS-specific lures.

Sep 24, 202623:52 7 min readRead →

Malware

RemControl Turns Fake IPTV Downloads Into Full Android Banking Surveillance

RemControl Android malware spreads via fake TVTap IPTV pages, stealing banking credentials with overlays, surveillance and remote control.

Sep 24, 202601:32 6 min readRead →

Malware

ChainScript RAT Turns Polygon Smart Contracts Into a Movable C2 Directory

ChainScript RAT spreads through fake software installers, uses Node.js and PowerShell, and finds replaceable C2 servers through Polygon smart contracts.

Sep 21, 202615:41 6 min readRead →