malware

The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware. The post Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight appeared first on SecurityWeek .

Head Mare Breaches TrueConf: From SYSTEM Privileges to Trojanized Legitimate Client Updates 1. Basic Information Article Title : Hackers breach TrueConf to trojanize client installers with backdoors Publisher : BleepingComputer Publication Date : August 8, 2026, 10:16 (As noted in the article) Original Source : BleepingComputer Primary Source : Kaspersky Securelist Related Malware : PhantomCore, …

What Happened On May 14, 2026, Microsoft's Security Blog published a detailed analysis of Kazuar — a backdoor operated by Turla (also known as Secret Blizzard, Venomous Bear, and Waterbug), a Russian state-sponsored APT group linked to the FSB. The report revealed that Turla has transformed Kazuar from a traditional command-and-control (C2) backdoor into a modular peer-to-peer (P2P) botnet design…

Executive Summary Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY , distributed through a fraudulent Polish apartment and house rental platform designed to lure users into downloading an Android APK. Based on the Polish-language lure and rental-themed distribution website, the activity appears to be Poland-focused, targeting users in Poland…

Socket Security just published research on TrapDoor malware: 34 malicious packages targeting developers building on Solana, Aptos, and Sui. If you've installed any npm or PyPI packages from these ecosystems recently, your wallet may already be at risk even if nothing looks wrong yet. How it works: The packages execute on install. They silently harvest crypto wallet credentials, SSH keys, cloud cr…

Cybercriminals used the Glassworm botnet to infect open source software projects with malware, and in turn hack the developers and companies that use that software.

Executive Summary Cyble Research and Intelligence Labs (CRIL) has identified a novel Android banking trojan, dubbed OverlayPhantom, actively distributed in the wild via malicious URLs. The malware employs a two-stage infection chain, using a dropper application that impersonates trusted platforms, including the official Austrian government identity application, ID Austria, and the widely used con…

Notable Changes Observed in Malicious LNK Files Distributed by Kimsuky Group Article Summary: The North Korean Kimsuky hacker group recently used malicious LNK files disguised as HWP documents to launch multi-stage attacks. They extended the attack chain by adding intermediate stages such as XML, VBS, and PS1 files to evade detection. The attack creates hidden folders, registers scheduled tasks f…

Executive Summary CRIL (Cyble Research and Intelligence Labs) has been tracking a sophisticated commodity loader utilized by multiple high-capability threat actors. The campaign demonstrates a high degree of regional and sectoral specificity, primarily targeting Manufacturing and Government organizations across Italy, Finland, and Saudi Arabia. This campaign utilizes advanced tradecraft, employin…