Malware

Malware

FBI Domain Seizures Cut Off NightmareStresser’s DDoS-for-Hire Storefront

FBI seized NightmareStresser domains in Operation PowerOFF, disrupting a DDoS-for-hire service linked to hundreds of thousands of attacks.

Sep 21, 202605:45 5 min readRead →

Malware

KREMLIN Malware Rewrites Chromium Trust Data to Hijack Brazilian Banking Sessions

KREMLIN malware installs rogue Chrome and Edge extensions by rewriting Chromium trust data to steal Brazilian banking credentials and session tokens.

Sep 21, 202601:16 6 min readRead →

Malware

Runtime-Triggered npm Malware Slips Past Install-Script Protections

A malicious npm campaign hides its payload in normal library functions, bypassing install-script controls and using runtime triggers, reconnaissance, and blockchain C2.

Sep 20, 202615:46 6 min readRead →

Malware

Inside TeamPCP: How Google Disrupted a Supply-Chain Campaign From the Hackers’ Core Chat

Google infiltrated TeamPCP’s inner chat to disrupt a supply-chain campaign, revoke stolen credentials, warn victims and uncover an AI-assisted zero-day exploit.

Sep 20, 202613:58 7 min readRead →

Malware

PhantomRaven Used npm Packages and Remote Code to Hunt for Developer Secrets

PhantomRaven malware hid in 100+ npm packages to steal developer credentials and CI/CD secrets.

Sep 20, 202609:28 6 min readRead →

Malware

Fake GitHub Downloads Pair Rapuncel Credential Theft With a Signed EDR-Killing Driver

Fake GitHub repos impersonate LastPass and 39 apps to spread Rapuncel stealer and a signed driver that kills 145 security tools to steal credentials.

Sep 20, 202605:56 6 min readRead →

Malware

WeaselBiscuit Turns npm Imports Into a Chrome Extension Data-Theft Channel

13 malicious npm packages deploy WeaselBiscuit, a JS stealer that harvests Chrome extension LevelDB data, clipboard and keystrokes via in-memory loader.

Sep 20, 202601:32 6 min readRead →

Malware

RatHat Turns Android’s Own Debugging Tools and Generative AI Into a Persistent Control Channel

RatHat Android malware abuses Accessibility to enable wireless ADB, persist via reverse proxy, and use AI for screen navigation and banking theft.

Sep 18, 202607:31 7 min readRead →

Malware

BambooToken Uses MQTT to Control Compromised Windows and Linux Systems

BambooToken malware uses MQTT brokers to control Windows and Linux hosts, enabling stealthy commands, data collection and modular plugins.

Sep 15, 202617:23 7 min readRead →