Tag: malware

Cybersecurity researchers have identified 19 Chrome and Edge extensions containing wallet stealing and cryptocurrency draining capabilities. The campaign has reportedly been active since February 2024 and uses compromised and newly created browser extensions.

Recorded Future has identified a new HOOKEDGE backdoor linked to APT28, targeting government and diplomatic organizations in Romania, Spain, and Türkiye through malicious Microsoft Word documents.

Arctic Wolf has identified the new GoCaracal malware framework, linking it with medium confidence to Dark Caracal and revealing its use of Ethereum smart contracts to update command and control infrastructure.

Security researcher uncovers the SLEEPWALKER Windows backdoor featuring a custom bytecode language, passive network activation, DLL side loading, and stealth capabilities.

OX Security has uncovered a campaign abusing 24 npm packages and unpkg mirrors to host fake Cloudflare CAPTCHA pages that can redirect users to phishing infrastructure.

Researchers have uncovered a malware campaign using FTP banners as dead drop resolvers to deliver E4del and PINHOLE RATs, introducing a new technique for command and control operations.

Check Point Research uncovers StopAndProtect operation using nearly 2,000 hacked WordPress websites for malware distribution, surveillance, and data theft.

Fortinet researchers have identified the Evooo1Bot Linux botnet, which exploits multiple known vulnerabilities to compromise internet facing devices and convert them into SOCKS5 proxy nodes.

Broadcom researchers reveal China linked Jewelbug using the XG Web platform to conduct cyber espionage against governments and militaries while operating cryptocurrency fraud campaigns.

Cybersecurity researchers have identified malicious Solidity Pro Visual Studio Code extensions that steal crypto wallets, API keys, developer credentials, and sensitive tokens through delayed activation techniques.

Microsoft has uncovered a cyber campaign using hijacked hotel Wi Fi networks to deliver the CornFlake remote access trojan through fake browser updates and device authentication phishing.

Researchers report that the Dysphoria IoT botnet has adopted blockchain based name services and infected device relays after law enforcement disrupted JackSkid infrastructure, making the botnet more resilient.