StopRansomware Advisory: SafePay Ransomware Targets Global Infrastructure
SafePay ransomware has targeted over 600 global victims, leveraging multiple CVEs and sophisticated evasion tactics to demand cryptocurrency ransoms.
Category
Malware
83 published analyses.
Hackers Exploit Plex2Shell Flaws to Deploy Crypto Miners and Proxy Backdoor
A chain of four vulnerabilities in Plex Media Server named Plex2Shell is actively exploited to install cryptocurrency miners and reverse proxy backdoors, following a public proof-of-concept release.
Rank Math PRO WordPress Plugin Compromised in Supply-Chain Attack
The Rank Math PRO WordPress plugin was compromised via its official vendor site, distributing malware with hidden backdoors that affect numerous websites.
Candiru Spyware Delivered via Zero-Click Targeted Ads at Al Jazeera
Candiru spyware was installed on Al Jazeera devices through zero-click attacks leveraging malicious targeted advertisements, demonstrating a sophisticated infection vector.
Attackers Delivered Backdoor via AOMEI Backupper Update Server Tampering
Between May and July 2026, attackers intermittently modified files on AOMEI Backupper's update servers to deliver a backdoor to Windows systems updating during specific periods, representing a supply-chain compromise.
Citizen Lab Links Zero-Click Candiru Spyware to Al Jazeera via Ads
Citizen Lab researchers uncovered that Candiru spyware exploited zero-click vulnerabilities embedded in online ads to infect Al Jazeera devices, employing stealthy delivery methods.
Hackers Hijack D-Link and Ubiquiti Devices to Resell Bandwidth
A proxyjacking campaign has compromised D-Link and Ubiquiti devices in 34 countries to resell stolen bandwidth via a commercial residential proxy network.
Microsoft Disrupts 3 Phishing Kits Behind Over 1 Billion Scam Messages
Microsoft, Health-ISAC, JC3, and private partners disrupted three major phishing kits responsible for over 1 billion scam messages since January 2026, targeting global phishing campaigns.
Inside AvisLoader: New Windows Malware Loader Designed to Resist Disruption
AvisLoader is a new Windows malware loader that uses encrypted peer-to-peer communications to protect its command-and-control infrastructure and supports click-fix delivery, shortcut persistence, and remote command execution.
Credential-Stealing GitHub Actions Workflows Found in Thousands of Repos
Attackers compromised open-source maintainer accounts to plant malicious GitHub Actions workflows stealing credentials in over 340 repositories.
Hackers Use Google Ads and Bing Redirects to Spread Claude ClickFix Malware
Attackers exploit legitimate Bing search-result redirects in Google search ads to deliver fake Claude installers, leading to ClickFix malware infections and leveraging trusted platforms for distribution.
FakeGit Malware Campaign Relaunches with Over 17,600 Malicious GitHub Repos
The FakeGit malware campaign has resurfaced with more than 17,600 malicious GitHub repositories distributing SmartLoader malware and the StealC infostealer, posing risks to developers and open-source security.
Eight Malicious npm Packages Delivered Overlord RAT and Stealer
Researchers uncovered 12 malicious npm packages, including eight delivering Overlord RAT and stealers, downloaded over 40,000 times since August 2023, posing supply chain risks to npm users.
PoeLLM Malware Infects Over 3,400 Servers to Expand Crypto Mining Botnet
The PoeLLM malware family targets exposed AI and language model infrastructure, compromising over 3,400 servers to deploy cryptocurrency miners and grow the Canto Incognito botnet.
Linux Backdoors Evade Detection by Mimicking Email Security Tools in Asia
Linux backdoors targeting telecom and network devices in South Korea and Taiwan disguise their traffic as email services and legitimate processes to evade detection.
Realtek Jungle SDK Exploit Attempts Spread Cling Botnet via STUN C2
Threat actors exploit a patched critical flaw in the Realtek Jungle SDK to spread the Cling botnet, employing the STUN protocol for command-and-control communications.
Warlock ransomware exploits SharePoint in water and telecom attacks
The China-linked Warlock ransomware group exploited SharePoint vulnerabilities to gain initial access in attacks against water utilities, telecom providers, regional governments, and universities, underscoring ongoing risks to critical infrastructure and public sector organizations.
WordPress Backdoor Rebuilds Itself Using Files, Database, and Shared Memory
Researchers uncovered a WordPress backdoor named SC that self-heals using multiple persistence methods, complicating removal efforts and increasing ongoing risks.
NeedyMantis: Modular Malware Threat in Targeted Intrusions
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework designed for persistent access in targeted operations.
Lunex Stealer Exploits AMD Driver to Bypass Security and Steal Credentials
Lunex Stealer uses a compromised AMD driver to evade detection and steal browser credentials, targeting Ukrainian users through a complex four-stage attack chain.
Compromised GitHub Actions Resume Mini Shai-Hulud Malware Execution
Two GitHub Actions repositories compromised during the May 2026 Mini Shai-Hulud campaign resumed malware execution after recent unauthorized access, highlighting risks in CI/CD supply chains.
New Carbonato Botnet Uses AI Agents to Hijack Docker Hosts
The Carbonato malware exploits exposed Docker daemons by deploying the Hermes Agent AI framework to control infected hosts, marking an evolution in AI-driven hijacking.
Malicious Terraform Providers Distribute Go Malware via HashiCorp Registry
Researchers identified Go-based malware distributed through malicious Terraform providers and Go Modules hosted on the HashiCorp official registry, exposing DevOps environments to novel risks.
Malicious npm Packages Evade Install-Script Defenses at Runtime
Threat actors are using the 'indexed-btree' npm package to bypass supply chain defenses by hiding malicious code in runtime behavior rather than installation scripts, complicating detection.
Fake LastPass Authenticator GitHub Repos Spread New Rapuncel Infostealer
A campaign exploits SEO-optimized fake LastPass Authenticator GitHub repositories to distribute a new information stealer named Rapuncel.
RatHat Android Malware Exploits ADB to Maintain Shell Access
Researchers identified RatHat, an Android malware using AI and abusing ADB to maintain shell access post-uninstallation, spreading via smishing and malvertising.
New RatHat Android Malware Uses AI for Automated Device Control
RatHat is a newly discovered Android malware that incorporates an AI-powered subsystem enabling attackers to remotely control compromised devices, streamlining exploitation actions.
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials
The Brazilian KREMLIN banking malware uses malicious Chrome and Edge extensions to steal credentials and session tokens, impersonating multiple Brazilian banks.
Hackers Exploit Tencent App Flaw to Deploy GrayRabbit Malware
A China-linked espionage group exploits a critical vulnerability in Tencent's Sogou Input Method to deliver GrayRabbit backdoor malware, posing risks to users and enterprises.
Hackers Deploy Linux Rootkit on F5 BIG-IP APM Devices
A Linux rootkit targets F5 BIG-IP APM devices by injecting fileless web shells into memory through PHP file loading interception, complicating detection.
BigBear Phishing Service Bypasses MFA at 258 Organizations
The BigBear 2.0 phishing-as-a-service framework bypassed multi-factor authentication at 258 organizations, compromising over 5,000 Microsoft 365 credentials.
JSCeal Malware Can Bypass Google Auth Using Stolen Session Cookies
JSCeal malware is a sophisticated JavaScript-based threat that bypasses Google authentication by stealing session cookies and uses advanced obfuscation to evade detection.
REVSTEALER Modules Disable Windows Defender to Run Crypto Miner
Elastic Security Labs identified four REVSTEALER-associated programs that disable Windows Update and Defender to deploy a cryptocurrency miner, persisting even after the main stealer removes itself.
5,400+ hacked sites deliver ClickFix malware via blockchain storage
Over 5,400 small-business websites have been compromised to distribute ClickFix malware payloads stored in smart contracts on the BNB Smart Chain, using blockchain to evade detection.
New 'Ted' Backdoor Hides in HAProxy to Intercept Web Traffic
A Linux backdoor named 'Ted' has been found in trojanized HAProxy builds at South Korean organizations, intercepting and modifying web traffic while requiring prior code execution on the host.
BraZetsu Malware Turns Windows Hosts Into Underground Marketplace Assets
Researchers identify BraZetsu, a Python-based Windows malware that enables Initial Access Brokers to commercialize compromised systems as marketplace inventory.
Guildma (Astaroth) Malware Infection via Brazilian Portuguese Email
A surge of Guildma (Astaroth) malware infections is spreading through Brazilian Portuguese phishing emails, posing risks through data theft and stealthy behavior.
Microsoft alerts on TerminalFix attacks using reverse tunnels
Microsoft warns of TerminalFix malware that exploits Windows Terminal and PowerShell via fake CAPTCHA prompts to create persistent reverse tunnels on compromised systems.
Anthropic warns of infostealer malware hijacking Claude AI sessions
Anthropic alerts users that infostealer malware is stealing active Claude AI login sessions to fraudulently consume usage, enabling attackers to access accounts and drain resources.
TerminalFix campaign uses reverse tunnel and DLL sideloading in complex intrusion
Microsoft Threat Intelligence analyzes the TerminalFix campaign, which leverages fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel for multistage intrusion.
19 Chrome and Edge Extensions Found Stealing Crypto Wallets
Researchers discovered 19 malicious Chrome and Edge browser extensions that steal cryptocurrency wallet secrets, indicating a coordinated campaign.
296K IoT Botnet, 100+ Water Systems Targeted, New SharePoint RCE Chain
A large IoT botnet impacting nearly 300,000 devices, attacks on over 100 water systems, and a novel SharePoint remote code execution vulnerability highlight a growing threat to critical infrastructure and enterprise environments.
ToxicPanda Android Malware Uses VPN Permissions to Block Google Play
ToxicPanda Android malware exploits VPN permissions to block Google Play, targeting 349 apps and executing 167 remote commands, complicating removal efforts.
SynkLoader Malware Spreads via Microsoft Teams Phishing Campaign
SynkLoader malware is delivered through a Microsoft Teams phishing campaign that uses a fake lock screen to steal enterprise user credentials, enabling unauthorized access.
Trojanized npm Packages Deploy AI-Powered RedC2 4.0 Linux Backdoor
Researchers identified 14 malicious npm packages that deploy RedC2 4.0, an AI-assisted Linux backdoor, leveraging open-source supply chain compromise for stealthy persistence.
Hackers Compromise Rust Crate to Deliver Infostealer Malware
Attackers compromised the maintainer account of the Rust crate arrayref to inject malware that executes on developer systems during compilation, risking exposure of sensitive data.
StopAndProtect Uses 2,000 Hacked WordPress Sites to Spread Malware
The StopAndProtect campaign uses nearly 2,000 compromised WordPress sites worldwide to distribute malware and collect stolen data, impacting web infrastructure security.
Clop Gang Uses Custom Web Shell for Targeted Windchill Data Theft
The Clop ransomware group developed a custom Java web shell targeting PTC Windchill and FlexPLM servers, enabling credential decryption, file enumeration, and data theft.
Uncovering MacSync Stealer Infrastructure via Behavioral Pivots
MacSync Stealer evades detection by rapidly rotating domains, but Microsoft identified over 30 related domains by analyzing consistent behavioral patterns to uncover its infrastructure.
AmnesiaStealer macOS Malware Hijacks Browsers via Remote Control
AmnesiaStealer is new macOS malware that hijacks browser sessions through remote control, enabling attackers to steal data interactively.
New Evooo1Bot Linux Botnet Turns Routers into Traffic Relays
Evooo1Bot is a new Mirai-based Linux botnet targeting internet-facing routers to convert them into SOCKS5 traffic relay nodes, expanding attack surfaces.
Akira ransomware disables EDR via Safe Mode, steals data but no encryption
An Akira ransomware affiliate bypassed endpoint detection by rebooting the infected system into Safe Mode with Networking to disable the EDR solution, stealing data without encrypting files.
Hundreds of Fake Chrome VPN Extensions Route Traffic Through Proxy
Over 737 fake VPN and proxy extensions on the Chrome Web Store routed user traffic through SOCKS5 proxies controlled by a single entity, posing serious privacy and security risks.
Malicious LiteLLM Releases Linked to Trivy Hack Expose 2,100+ Orgs
Two malicious LiteLLM packages on PyPI in March contained credential-stealing code that potentially exposed over 2,100 organizations by capturing cloud and system secrets.
DeadLock ransomware uses decentralized infrastructure for extortion
Microsoft Threat Intelligence analyzes DeadLock ransomware, a Rust-based encryptor that employs decentralized victim communication and negotiation infrastructure alongside double extortion tactics.
#StopRansomware: Emerging Gunra Ransomware Threat
Gunra ransomware, a double-extortion RaaS exploiting VPN and RDP vulnerabilities, threatens government and critical infrastructure with data encryption and leaks.
Nearly 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
A campaign distributing nearly 800 malicious npm packages with typo-squatted AI-generated names delivers a powerful RAT and infostealer targeting Windows, Mac, and Linux environments, posing a significant threat to developers and enterprises using npm packages.
Attackers Use Oracle SQL Injection to Compile Khunt Toolkit for SYSTEM Access
An Oracle database SQL injection vulnerability was exploited to compile and run the Khunt post-exploitation toolkit entirely within the database engine, avoiding writing executables to disk.
Inside the Keyv/Cacheable npm Token Worm: Why Not to Revoke Tokens Yet
A compromise affecting the Keyv and Cacheable npm packages is leading to reconsideration of token revocation policies due to an active malware that triggers upon premature token revocation.
ChainDrop Malware Infects 1,300+ npm Packages in Supply-Chain Attack
The ChainDrop malware has compromised over 1,300 npm packages, impacting software supply chain security with billions of downloads monthly.
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The Greatness phishing-as-a-service toolkit now uses device code phishing to exploit OAuth 2.0 Device Authorization Grant, bypassing MFA and hijacking accounts.
DOUBLECUP ClickFix Service Hides Malware in Browser Cache Images
The DOUBLECUP loader uses ClickFix attacks to embed malware within PNG images cached by browsers on Windows and macOS, complicating detection.
INC Ransomware Exploits SonicWall SMA 1000 Vulnerabilities
INC Ransomware is exploiting vulnerabilities in SonicWall SMA 1000 VPN devices, leading to increased attacks and multiple victims listed on its data leak site.
Adform's Ad Script Compromised to Steal Cryptocurrency via Clipboard Hijack
Adform's advertising scripts were compromised in a supply-chain attack that hijacks clipboard cryptocurrency addresses to redirect funds to attackers.
Microsoft Teams Vishing Attacks Deploy Chaos Ransomware in North America
Attackers use vishing via Microsoft Teams to impersonate IT support and deploy Chaos ransomware targeting organizations in North America through social engineering.
SourTrade Malvertising Uses Browser to Assemble Malware Executable
A malvertising campaign named SourTrade targets retail traders by using browsers and a legitimate Bun runtime to assemble Windows malware executables, evading traditional detection methods.
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
CERT-UA has identified a campaign where a fake Notepad++ plugin delivers MATCHBOIL.V2 malware, linked to the Russia-aligned UAC-0099 threat group targeting Windows systems.
Fake Claude app promoted via Bing ads spreads SectopRAT malware
A malvertising campaign on Bing promotes a fake Claude desktop app from a legitimate domain to deliver SectopRAT malware, posing a threat to affected systems.
FakeGit Campaign Uses 7,600 GitHub Repos to Spread SmartLoader Malware
Nearly 7,600 malicious GitHub repositories were discovered distributing the SmartLoader malware, leveraging cloned projects and fake profiles to deceive users.
NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
The NadMesh Go botnet targets exposed AI services to harvest over 3,800 unique AWS keys, threatening cloud and Kubernetes environments.
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
Seven malicious npm packages in the Vite ecosystem use a four-tier blockchain-based command-and-control infrastructure to deploy RAT malware, expanding the ChainVeil supply chain threat.
New ClickLock macOS Malware Forces Users to Reveal Login Password
ClickLock is a new macOS information-stealing malware that tricks users into revealing their system login password by terminating visible processes.
New OkoBot framework deploys 20 payloads targeting crypto and data theft
The OkoBot malware framework deploys more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and sensitive data, posing a notable threat to individuals and enterprises.
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
Researchers revealed TuxBot v3 Evolution, an IoT botnet framework apparently developed with help from a large language model, highlighting emerging AI-assisted malware creation risks.
Nearly 300 Fake GitHub Repos Distribute Infostealer Malware
A threat actor created almost 300 counterfeit GitHub repositories impersonating legitimate software projects to deliver infostealer malware, posing a significant supply chain threat.
Hackers Backdoor Jscrambler npm Package with Infostealer Malware
A malicious version of the Jscrambler npm package containing infostealer malware was published and downloaded nearly 1,500 times, posing risks to developers and users of this client-side security tool.
Compromised jscrambler npm Release Installs Rust Infostealer
The jscrambler npm package version 8.14.0 was compromised to install a Rust-based infostealer via a preinstall hook, impacting Windows, macOS, and Linux environments.
Exposed Server Reveals WP-SHELLSTORM Backdoor Targeting 1.4M WordPress Sites
A hacker group's exposed server revealed tools, logs, and a target list of over 1.4 million WordPress sites, exposing a large-scale WordPress backdoor campaign.
Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK GitHub repository to publish a malicious npm package that steals cryptocurrency wallet private keys and seed phrases. This malware poses a direct threat to developers and users managing crypto assets.
Microsoft Uncovers GigaWiper Backdoor Combining Disk Wiping and Spyware
Microsoft has analyzed a new Windows backdoor called GigaWiper that merges three destructive tools: full disk wiping, Windows drive overwriting, and fake ransomware that scrambles files without saving keys. This modular malware gives operators multiple ways to disrupt or destroy infected machines.
New Ghost Phishing Wave Evades Traditional Email Security
A new EvilTokens campaign uses ghost phishing to bypass traditional email security by hiding malicious pages until decrypted inside a victim’s browser. This poses high risk to businesses using Microsoft 365 and handling sensitive data.
Fake IT Support Calls on Microsoft Teams Spread EtherRAT Malware
Threat actors are impersonating IT support via Microsoft Teams voice calls to trick employees into installing EtherRAT malware, compromising corporate networks. This tactic enables attackers to gain initial access and conduct further intrusion.
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Attackers compromised ShapedPlugin's build pipeline to inject backdoor code into Pro plugins via official update channels. This supply chain attack puts thousands of WordPress sites at risk of remote exploitation.