Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs

A previously undocumented threat actor has been attributed to attacks targeting Ukrainian organizations with malware known as CANFAIL. Google Threat Intelligence Group GTIG described the hacking group as possibly affiliated with Russian intelligence services. The threat actor is assessed to have...

MAL-2026-886 Malicious code in open-answer-engine-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c367c12ff794a5b5d5562c0a1a8ab6225007fc76fc23310d8ddc33dda56b8112 The package open-answer-engine-frontend was found to contain malicious code. Source: ghsa-malware...

Malicious code in hxz-protection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13dc9932ef1f00aa6dc52dbc5bbb2a7b4096ff94d4dc575903837159d377ba18 The package hxz-protection was found to contain malicious code. Source: ghsa-malware bbf0a8985b32c32401ddf04b75ef930250aab926a54a6ae5dfce381386eb0876...

Malicious code in wropz-6module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b88cb695572ff176899ffcf9aed27987ea204493850e0bf4b17537d50b93dd59 The package wropz-6module was found to contain malicious code. Source: ghsa-malware 38cd1d5c8154310330369a075368b8556bcffed70470476c894f5d4feb1a2bae...

MAL-2026-892 Malicious code in wropz-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48a8b0a5b3f12323a6bbc3014fa023b370236b8874253a47ed61930d4bbcee4d The package wropz-module was found to contain malicious code. Source: ghsa-malware fbe5a4f55692f6a9db6c052776dc2fcfd3825f7da077f3e45b67466cd4059bd0 A...

MAL-2026-880 Malicious code in console-style-pro0o0o0o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe7407a5523ef7efe6bec615d9601fe978b9e5de59d19d7e8e2ff054c5e09e9 The package console-style-pro0o0o0o was found to contain malicious code. Source: ghsa-malware...

CVE-2025-15575

The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks e.g. digital signatu...

Malicious code in stylelint-recommended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f0d274dda57eb9c09967bc0bfad1709fd8ddcbf3ec4c0e7e9828826e6d0d9a The package stylelint-recommended was found to contain malicious code. Source: ghsa-malware...

Criminals are using AI website builders to clone major brands

AI tool Vercel was abused by cybercriminals to create a Malwarebytes lookalike website. Cybercriminals no longer need design or coding skills to create a convincing fake brand site. All they need is a domain name and an AI website builder. In minutes, they can clone a site's look and feel, plug i...

LoRA-Based Parameter-Efficient LLMs for Continuous Learning in Edge-Based Malware Detection

The proliferation of edge devices has created an urgent need for security solutions capable of detecting malware in real time while operating under strict computational and memory constraints. Recently, Large Language Models LLMs have demonstrated remarkable capabilities in recognizing complex...

MalTool: Malicious Tool Attacks on LLM Agents

In a malicious tool attack, an attacker uploads a malicious tool to a distribution platform; once a user installs the tool and the LLM agent selects it during task execution, the tool can compromise the user's security and privacy. Prior work primarily focuses on manipulating tool names and...

MAL-2026-857 Malicious code in osopackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81f944909c442d3ce5de69ca15e63f1dc9aac8408cd2d3875794fde6ac0c4efd The package osopackage was found to contain malicious code. Source: ghsa-malware ea6582943b363713bda63ec879242935fe1a5f5efa7be40fbb87173570f642a0 Any...

Malicious code in systemtest-network (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8fadd3f7e7470daeb4e977c85dbe226a9225b2c4eae6c269a4d85fc01e96681 The package systemtest-network was found to contain malicious code. Source: ghsa-malware...

MAL-2026-859 Malicious code in systemtest-network (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8fadd3f7e7470daeb4e977c85dbe226a9225b2c4eae6c269a4d85fc01e96681 The package systemtest-network was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-prop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6708dacd87e4aafa4ffafa5b20fff5ae416d6580ba01ddcaaa51ca08f0317c85 The package chai-prop was found to contain malicious code. Source: ghsa-malware 46a6572ddbd6c8ceef059f6e07126d160a849cf4912b1befe7b4523393c72484 Any...

The game is over: when “free” comes at too high a price. What we know about RenEngine

We often describe cases of malware distribution under the guise of game cheats and pirated software. Sometimes such methods are used to spread complex malware that employs advanced techniques and sophisticated infection chains. In February 2026, researchers from Howler Cell announced the discover...

Malicious code in sinon-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c9ac1d9ff3647908703db921b2e950e479861f18e7b1bad8377baaa7400d32c The package sinon-node was found to contain malicious code. Source: ghsa-malware 5aa93130bd1915120b30dc2472c774ac984ea2c2166d7865d30fdf8343225f50 Any...

Malicious code in chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 463f0440f6a90a98f9a12131b19f99b472b0ee82b6feb5b6066996ca4be4e07a The package chai-await was found to contain malicious code. Source: ghsa-malware c3cd8be2d97babb314b0adf3d3b9b6467057d39f64e41afe5d5f33cad5e3fbe6 Any...

Malicious code in ntoctfutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f65404ba7442c7d16e3f569b7c84afc4d1df23f9497ac3a6101d5ec3c168956f Importing the module downloads and runs a remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-850 Malicious code in ntoctfutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f65404ba7442c7d16e3f569b7c84afc4d1df23f9497ac3a6101d5ec3c168956f Importing the module downloads and runs a remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...