MAL-2025-191535 Malicious code in tableate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 762292d92c617c287b3c6b54f7c4a8b8630e7dd893b40dd05bade462fec7ca26 This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

CISA Warns of Active Spyware Campaigns Hijacking High-Value Signal and WhatsApp Users

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday issued an alert warning of bad actors actively leveraging commercial spyware and remote access trojans RATs to target users of mobile messaging applications. "These cyber actors use sophisticated targeting and social...

New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse

Sturnus, an advanced Android banking trojan, has been discovered by ThreatFabric. Learn how this malware bypasses end-to-end encryption on Signal and WhatsApp, steals bank credentials using fake screens, and executes fraudulent transactions...

New Eternidade Stealer Uses WhatsApp to Steal Banking Data

Trustwave SpiderLabs warns of Eternidade Stealer, a new banking trojan spreading via personalised WhatsApp messages. Find out how this malicious software bypasses security checks and deploys fake login screens for major banks and wallets...

Malicious code in siitoogether (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6fccd687f1acb55e6da0782b08ef14b3e8be5587dee4743a163a106c48390a50 Importing the module starts an RAT-like process capable of execute remote commands, with the C2 through Discord --- Category: MALICIOUS - The campaign has...

New Sturnus Android Trojan Quietly Captures Encrypted Chats and Hijacks Devices

Cybersecurity researchers have disclosed details of a new Android banking trojan called Sturnus that enables credential theft and full device takeover to conduct financial fraud. "A key differentiator is its ability to bypass encrypted messaging," ThreatFabric said in a report shared with The...

Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices

Cybersecurity researchers have disclosed details of a new campaign that leverages a combination of social engineering and WhatsApp hijacking to distribute a Delphi-based banking trojan named Eternidade Stealer as part of attacks targeting users in Brazil. "It uses Internet Message Access Protocol...

Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

The threat actor known as Dragon Breath has been observed making use of a multi-stage loader codenamed RONINGLOADER to deliver a modified variant of a remote access trojan called Gh0st RAT. The campaign, which is primarily aimed at Chinese-speaking users, employs trojanized NSIS installers...

MAL-2025-191533 Malicious code in spellcheckers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c83520810b148ec74e509b16851a1fafa1bec576b502a5debabd9b52520d9754 This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

Malicious code in spellcheckers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c83520810b148ec74e509b16851a1fafa1bec576b502a5debabd9b52520d9754 This package is malicious and typosquating the legitimate pyspellchecker library. This package will deploy a remote-access trojan that...

We opened a fake invoice and fell down a retro XWorm-shaped wormhole

Somebody forwarded an “invoice” email and asked me to check the attachment because it looked suspicious. Good instinct—it was, and what we found inside was a surprisingly old trick hiding a modern threat. What it does If the recipient had opened the attached Visual Basic Script .vbs file, it woul...

Malicious code in itale-adci-gnyagyyu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4d75141209655c4d7f19debd59e89cdadca5ed3f04e6e097666e81243b627d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Android Trojan 'Fantasy Hub' Malware Service Turns Telegram Into a Hub for Hackers

Cybersecurity researchers have disclosed details of a new Android remote access trojan RAT called Fantasy Hub that's sold on Russian-speaking Telegram channels under a Malware-as-a-Service MaaS model. According to its seller, the malware enables device control and espionage, allowing threat actor...

MAL-2025-63618 Malicious code in jaja-esdoger98-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94a589ddc3c0e3ed88900bbb93546b36b32336ecb1913910f23fca796722ce40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Automated Hardware Trojan Insertion in Industrial-Scale Designs

Industrial Systems-on-Chips SoCs often comprise hundreds of thousands to millions of nets and millions to tens of millions of connectivity edges, making empirical evaluation of hardware-Trojan HT detectors on realistic designs both necessary and difficult. Public benchmarks remain significantly...

Konni Hackers Turn Google's Find Hub into a Remote Data-Wiping Weapon

The North Korea-affiliated threat actor known as Konni aka Earth Imp, Opal Sleet, Osmium, TA406, and Vedalia has been attributed to a new set of attacks targeting both Android and Windows devices for data theft and remote control. "Attackers impersonated psychological counselors and North Korean...

Fantasy Hub is spyware for rent—complete with fake app kits and support

Researchers at Zimperium identified Fantasy Hub, a new Android spyware developed and sold as a subscription on Russian-language cybercrime forums. Malware-as-a-Service MaaS means cybercriminals rent out to malware to other criminals, complete with the infrastructure necessary to harvest and abuse...

Malicious VSX Extension "SleepyDuck" Uses Ethereum to Keep Its Command Server Alive

Cybersecurity researchers have flagged a new malicious extension in the Open VSX registry that harbors a remote access trojan called SleepyDuck. According to Secure Annex's John Tuckner, the extension in question, juan-bianco.solidity-vlang version 0.0.7, was first published on October 31, 2025, ...

Researchers Uncover BankBot-YNRK and DeliveryRAT Android Trojans Stealing Financial Data

Cybersecurity researchers have shed light on two different Android trojans calledBankBot-YNRK and DeliveryRAT that are capable of harvesting sensitive data from compromised devices. According to CYFIRMA, which analyzed three different samples of BankBot-YNRK, the malware incorporates features to...

MAL-2025-191874 Malicious code in speed-testing-nt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dcfc1b92868e7f4eef0f4c0e901418a557089fe5269a1e4ef07725d397cddbb3 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category:...