Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China

The threat actor known as Silver Fox has been spotted orchestrating a false flag operation to mimic a Russian threat group in attacks targeting organizations in China. The search engine optimization SEO poisoning campaign leverages Microsoft Teams lures to trick unsuspecting users into downloadin...

Brazil Hit by Banking Trojan Spread via WhatsApp Worm and RelayNFC NFC Relay Fraud

The threat actor known as Water Saci is actively evolving its tactics, switching to a sophisticated, highly layered infection chain that uses HTML Application HTA files and PDFs to propagate via WhatsApp a worm that deploys a banking trojan in attacks targeting users in Brazil. The latest wave is...

New Android malware lets criminals control your phone and drain your bank account

Albiriox is a new family of Android banking malware that gives attackers live remote control over infected phones, letting them quietly drain bank and crypto accounts during real sessions. Researchers have analyzed a new Android malware family called Albiriox which is showing signs of developing...

CacheTrap: Injecting Trojans in LLMs without Leaving Any Traces in Inputs or Weights

Adversarial weight perturbation has emerged as a concerning threat to LLMs that either use training privileges or system-level access to inject adversarial corruption in model weights. With the emergence of innovative defensive solutions that place system- and algorithm-level checks and correctio...

Malicious code in tablates (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 56df7571e75ad7e85850f9a34bb482f19466af4481db56951ffba42475a4238d This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

MAL-2025-191534 Malicious code in tablates (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 56df7571e75ad7e85850f9a34bb482f19466af4481db56951ffba42475a4238d This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

MAL-2025-191535 Malicious code in tableate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 762292d92c617c287b3c6b54f7c4a8b8630e7dd893b40dd05bade462fec7ca26 This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

Malicious code in tableate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 762292d92c617c287b3c6b54f7c4a8b8630e7dd893b40dd05bade462fec7ca26 This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

CISA Warns of Active Spyware Campaigns Hijacking High-Value Signal and WhatsApp Users

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday issued an alert warning of bad actors actively leveraging commercial spyware and remote access trojans RATs to target users of mobile messaging applications. "These cyber actors use sophisticated targeting and social...

New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse

Sturnus, an advanced Android banking trojan, has been discovered by ThreatFabric. Learn how this malware bypasses end-to-end encryption on Signal and WhatsApp, steals bank credentials using fake screens, and executes fraudulent transactions...

New Eternidade Stealer Uses WhatsApp to Steal Banking Data

Trustwave SpiderLabs warns of Eternidade Stealer, a new banking trojan spreading via personalised WhatsApp messages. Find out how this malicious software bypasses security checks and deploys fake login screens for major banks and wallets...

Malicious code in siitoogether (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6fccd687f1acb55e6da0782b08ef14b3e8be5587dee4743a163a106c48390a50 Importing the module starts an RAT-like process capable of execute remote commands, with the C2 through Discord --- Category: MALICIOUS - The campaign has...

New Sturnus Android Trojan Quietly Captures Encrypted Chats and Hijacks Devices

Cybersecurity researchers have disclosed details of a new Android banking trojan called Sturnus that enables credential theft and full device takeover to conduct financial fraud. "A key differentiator is its ability to bypass encrypted messaging," ThreatFabric said in a report shared with The...

Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices

Cybersecurity researchers have disclosed details of a new campaign that leverages a combination of social engineering and WhatsApp hijacking to distribute a Delphi-based banking trojan named Eternidade Stealer as part of attacks targeting users in Brazil. "It uses Internet Message Access Protocol...

Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

The threat actor known as Dragon Breath has been observed making use of a multi-stage loader codenamed RONINGLOADER to deliver a modified variant of a remote access trojan called Gh0st RAT. The campaign, which is primarily aimed at Chinese-speaking users, employs trojanized NSIS installers...

Malicious code in spellcheckers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c83520810b148ec74e509b16851a1fafa1bec576b502a5debabd9b52520d9754 This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

MAL-2025-191533 Malicious code in spellcheckers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c83520810b148ec74e509b16851a1fafa1bec576b502a5debabd9b52520d9754 This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

We opened a fake invoice and fell down a retro XWorm-shaped wormhole

Somebody forwarded an “invoice” email and asked me to check the attachment because it looked suspicious. Good instinct—it was, and what we found inside was a surprisingly old trick hiding a modern threat. What it does If the recipient had opened the attached Visual Basic Script .vbs file, it woul...

Malicious code in itale-adci-gnyagyyu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4d75141209655c4d7f19debd59e89cdadca5ed3f04e6e097666e81243b627d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Android Trojan 'Fantasy Hub' Malware Service Turns Telegram Into a Hub for Hackers

Cybersecurity researchers have disclosed details of a new Android remote access trojan RAT called Fantasy Hub that's sold on Russian-speaking Telegram channels under a Malware-as-a-Service MaaS model. According to its seller, the malware enables device control and espionage, allowing threat actor...