PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces

The Computer Emergency Response Team of Ukraine CERT-UA has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between October and December 2025. The activity has been attributed with medium confidence to a Russian hacking group tracked as Void...

The Promptware Kill Chain: How Prompt Injections Gradually Evolved into a Multi-Step Malware

Whitepaper called The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into A Multi-Step Malware...

Malware Classification Using Diluted Convolutional Neural Network with Fast Gradient Sign Method

Android malware has become an increasingly critical threat to organizations, society and individuals, posing significant risks to privacy, data security and infrastructure. As malware continues to evolve in terms of complexity and sophistication, the mitigation and detection of these malicious...

Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool

Cybersecurity researchers have disclosed details of a malicious Google Chrome extension that's capable of stealing API keys associated with MEXC, a centralized cryptocurrency exchange CEX available in over 170 countries, while masquerading as a tool to automate trading on the platform. The...

EUVD-2026-2234

Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file...

Proactive Malware Threat Management: A How-To Guide

Trying to defend against every potential malware attack is like trying to boil the ocean. You can’t be everywhere at once, and treating every vulnerability as a top priority is a surefire way to burn out your team. The old way of reacting to every alert simply doesn't scale. A modern defense...

Why iPhone users should update and restart their devices now

If you were still questioning whether iOS 26+ is for you, now is the time to make that call. Why? On December 12, 2025, Apple patched two WebKit zero‑day vulnerabilities linked to mercenary spyware and is now effectively pushing iPhone 11 and newer users toward iOS 26+, because that’s where the...

New Advanced Linux VoidLink Malware Targets Cloud and container Environments

Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that's specifically designed for long-term, stealthy access to Linux-based cloud environments According to a new report from Check Point Research, the cloud-native...

Malicious code in cnamts-captcha-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f061900c13c9363e97f1336b62c6c9efff79aefdae954a4d6183900bf71f69c The package cnamts-captcha-component was found to contain malicious code. Source: ghsa-malware...

MAL-2026-244 Malicious code in helium-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 643f63c743fd06fb24cb2d488e001ce0efab3f0d82014801ea2eebad96041692 The package helium-module was found to contain malicious code. Source: ghsa-malware d34558c0d1e56c0103ad087e485e142f3918050a1b0bdc15fc7e7b46c1a2ae1f...

Malicious code in francium-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f204d22648cb65e36ba9d225f45edaac3240ad8b638e40aa87397ebd20bc9bde The package francium-ui was found to contain malicious code. Source: ghsa-malware 9d6cf557fe491bb7638bf2b12ca8587adf51f6f3f105002a08544b42b567ee7d An...

Malicious code in francium-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bbfe7cfa0e201004579dc73a60307dbd93e6507801d3dd767b689cb748535c1 The package francium-utils was found to contain malicious code. Source: ghsa-malware 36e968a97c914ae6c1bf4fb980564d69546cc92105d1be341f56c933ec2caa12...

Malicious code in extended-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1daed3089b5ef77daaeecaac9fe17f36363fd47d3dbe2814f5902c7ec3e61a74 The package extended-path was found to contain malicious code. Source: ghsa-malware 69c860714616f6ecc1c5b9d066780ece372fd1346ffce61438ecc12c9a98b30b...

Pega Customer Service Framework 安全漏洞

Pega Customer Service Framework is a customer service framework from Pega Corporation in the United States. A security vulnerability exists in Pega Customer Service Framework versions 8.7.0 through 25.1.0, which originates from an unrestricted file upload and could allow a privileged user to uplo...

Integrating APK Image and Text Data for Enhanced Threat Detection: A Multimodal Deep Learning Approach to Android Malware

As zero-day Android malware attacks grow more sophisticated, recent research highlights the effectiveness of using image-based representations of malware bytecode to detect previously unseen threats. However, existing studies often overlook how image type and resolution affect detection and ignor...

A Decompilation-Driven Framework for Malware Detection with Large Language Models

The parallel evolution of Large Language Models LLMs with advanced code-understanding capabilities and the increasing sophistication of malware presents a new frontier for cybersecurity research. This paper evaluates the efficacy of state-of-the-art LLMs in classifying executable code as either...

Malware Detection Based on API Calls: A Reproducibility Study

This study independently reproduces the malware detection methodology presented by Felli cious et al. 7, which employs order-invariant API call frequency analysis using Random Forest classification. We utilized the original public dataset 250,533 training samples, 83,511 test samples and replicat...

MAL-2026-236 Malicious code in graponater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9bbd986bf5883f6b5b40a7061c514b13f71a27c021471595671d060b260affc3 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category:...

Firefox Security Vulnerabilities: An Expert Guide

For any vulnerability management team, the daily flood of alerts can be overwhelming. When your scanner flags dozens of new CVEs, it’s easy to see browser-related issues as lower priority. Yet, a critical flaw in a widely used application like Firefox can be the initial foothold an attacker needs...

A week in security (January 5 – January 11)

Last week on Malwarebytes Labs: pcTattletale founder pleads guilty as US cracks down on stalkerware Are we ready for ChatGPT Health? CISA warns of active attacks on HPE OneView and legacy PowerPoint Lego’s Smart Bricks explained: what they do, and what they don’t Fake WinRAR downloads hide malwar...