RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

RatHat Android malware uses generative AI to navigate infected devices, steal banking credentials, intercept OTP codes and reinstall itself after removal again...

MovieReaper Malware Uses The Odyssey Torrents to Infect Users Worldwide

MovieReaper malware spreads through compromised Odyssey torrents, infecting hundreds of victims while using Solana to locate command-and-control infrastructure...

Inside a Malicious, Stealthy WordPress Must Use Plugin

The Wordfence Threat Intelligence Team identified an interesting malware sample in mid June during a site clean. The malware was installed as a must-use plugin with several self-healing mechanisms in place in order to survive removal. It also makes use of Etherhiding, a technique that hides the...

Malicious code in tldriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995 The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using...

Introducing CAIRN: Frontier tracking for AI-integrated malware

A cairn is a marker left behind on a trail, a deliberately placed stack of stones that helps hikers find their way when the path is unclear. Attackers building AI-integrated malware unintentionally and inevitably leave behind markers of their own: prompt templates, provider endpoints, API keys,...

A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight

Cisco Talos researchers created a new framework for identifying malware and hacking tools that rely on AI chatbots—and quickly discovered something unusual...

Malicious code in test-react-app-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5f625e91f5a500b87bd2e2d34c625a73bda73a3b9c2e4762b389d42d117be1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16376 Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

HYDRA: Proactive Android Malware Drift Adaptation Via Hierarchical Graph Contrastive Learning

Concept drift, driven by the rapid evolution of Android malware, severely degrades the performance of machine learning detectors. Current adaptation strategies are often reactive, responding only after performance has dropped and imposing a significant manual annotation burden, or they are...

PT-2026-96963

Name of the Vulnerable Software and Affected Versions Crypt::SelfCertificate versions 1.01 through 1.05 Description This software contains malware that executes Python code retrieved from an obfuscated URL. The generate certificate function runs a Python script disguised as a certificate file,...

CVE-2026-95831: Embedded Malicious Code

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

Malicious code in wos-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a0281f721b8645a472011b83299574bb7e74651a8f0e628c519bafb19b86938 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16373 Malicious code in wos-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a0281f721b8645a472011b83299574bb7e74651a8f0e628c519bafb19b86938 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @vite-tab/tabui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5178b465689483c264c60f883fe971a7fa7c9332b22a10281b652f6262c7731d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16368 Malicious code in mathmain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24c3869fb4f125e9ea39f09e5cb9100458e4e2d364047150204909e56527785 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in mathmain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24c3869fb4f125e9ea39f09e5cb9100458e4e2d364047150204909e56527785 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

A week in security (September 14 – September 20)

Last week on Malwarebytes Labs: New Android malware uses AI to steal bank logins and PINs Did an AI really try to break free from human control? Fake parcel delivery messages steal your card and bank details Flock cameras are tracking people as well as cars Revolut phishing texts appear days afte...

100DaysofYARA

100 Days of YARA 2026 100 Days of YARAへようこそ！このリポジトリは、この期間に作成されたすべてのYARAアイデアを保存する場所として機能します。作成した楽しいスクリプト、ツール、ルールはすべてこのGitHubリポジトリにコミットできます！当面は、関連するブログ記事、ウォークスルー、その他の考察は別の場所で公開してください : これっていったい何なの？ 簡単に言うと、100DaysofYARA...

Stress-Testing Structure-Aware Calibration of Malware Graph Neural Networks under Type Shift

Post-hoc malware calibrators can condition confidence on graph structure, but their structural inputs may leave the support represented by validation data under malware-type shift. We study this risk on MalNet-Tiny by holding out each of four malware types across three seeds, freezing a graph...