tsecurity.de - Malware / Trojaner / Viren

LeakWatch KW 38/2026: 490 Millionen Gyazo-Metadaten, Malware aus der Cloud, OpenAI bis zum internen Code offen und Nova Lake leakt an allen Ecken

Sun, 20 Sep 2026 05:54:15 +0200

Manchmal besteht eine LeakWatch-Woche aus einem unscharfen Foto eines Grafikkartenkartons, einer CPU-Zeile in irgendeiner Benchmark-Datenbank und einem Leaker, der mit drei Wörtern genügend Interpretationsspielraum für die nächsten vier Monate schafft. Kalenderwoche 38 ist nicht so eine Woche. Zwischen dem 14. und 20. September 2026 sind gleich... Weiterlesen

The fake job interview that installs malware

Sun, 20 Sep 2026 00:33:16 +0200

Key takeaways The attack arrives at the assessment, which is the one stage in hiring where a candidate is expected to run someone else's code. Microsoft's Defender Experts team documents a campaign it calls Contagious Interview, in which fake recruiters get victims to clone and execute a package from a normal-looking repository. Presentation... Weiterlesen

IT Security News Hourly Summary 2026-09-19 18h : 4 posts

Sat, 19 Sep 2026 18:22:25 +0200

4 posts published in the last hour 15:02Google Gemini also Broke Out of Its Test Environment 15:02TigerByte Cyber Emerges From Stealth With $3 Million in Funding 15:02WeaselBiscuit Stealer Found in 13 Malicious npm Packages 15:00IT Security News Hourly Summary 2026-09-19 17h : 4 posts The post IT Security News Hourly Summary 2026-09-19 18h : 4... Weiterlesen

IT Security News Hourly Summary 2026-09-19 17h : 4 posts

Sat, 19 Sep 2026 17:22:30 +0200

4 posts published in the last hour 14:31RatHat Android Malware Uses AI to Control Infected Devices 14:31Identity Visibility in 2026: The Foundation of Identity Security 14:31Agentic security is the billion-dollar challenge for some clever startup to solve 14:01AI Helps Hackers Hijack OpenAI Staff Accounts Through a Forum The post IT Security News... Weiterlesen

WeaselBiscuit Stealer Found in 13 Malicious npm Packages

Sat, 19 Sep 2026 17:22:30 +0200

Researchers have discovered 13 npm packages carrying a previously undocumented JavaScript information stealer called WeaselBiscuit, introducing yet another malicious threat to the npm package ecosystem. In addition to linking the packages together via shared indicators, OpenSourceMalware found several similarities between BeaverTail and... Weiterlesen

RatHat Android Malware Uses AI to Control Infected Devices

Sat, 19 Sep 2026 16:37:16 +0200

A new Android backdoor called RatHat utilizes an AI-powered system to remotely navigate compromised devices, while also stealing sensitive information and using a variety of methods to maintain its presence. Researchers at Zimperium’s zLabs found indications that RatHat may be associated with threat actors based in China after they discovered... Weiterlesen

The best way to check your PC for malware

Sat, 19 Sep 2026 16:32:39 +0200

If your PC is slowing down or not behaving as usual, it's worth running through these tips to see if you have malware. Weiterlesen

Ransomware reloaded: Jetzt wird mit der Veröffentlichung von privaten Daten gedroht

Sat, 19 Sep 2026 13:19:48 +0200

Kriminelle drohen zunehmend mit der Veröffentlichung persönlicher Daten statt „nur“ zu verschlüsseln. Das verändert Risiko und Gegenmaßnahmen vor allem im Privatbereich. Immer häufiger beschränken sich Kriminelle beim Einsatz von Ransomware nicht mehr auf das bloße Verschlüsseln, sondern stehlen private Informationen und erpressen mit der Drohung,... Weiterlesen

Sicherheitskontrolle am Flughafen: Deine Rechte beim Smartphone

Sat, 19 Sep 2026 10:40:53 +0200

Darf man mein Smartphone bei der Sicherheitskontrolle des Flughafens beschlagnahmen? Darf man mich dazu zwingen, es zu entsperren? Der Artikel Sicherheitskontrolle am Flughafen: Deine Rechte beim Smartphone erschien zuerst auf TARNKAPPE.INFO Weiterlesen

New RatHat Android Malware Uses AI to Steal Banking Logins, PINs and OTP Codes

Sat, 19 Sep 2026 10:36:15 +0200

Security researchers have discovered a new Android banking Trojan called RatHat. This malware combines artificial intelligence (AI), abuse of accessibility features, and Android Debug Bridge (ADB) capabilities to steal financial credentials, PINs, and one-time passcodes. RatHat Android Malware According to MalwareBytes, RatHat differs from... Weiterlesen

AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes

Sat, 19 Sep 2026 10:36:06 +0200

Researchers have identified a new Android banking Trojan called RatHat that utilizes artificial intelligence to automate device compromise and steal financial credentials, PINs, and one-time passcodes. Zimperium’s zLabs researchers analyzed this malware, which represents a significant evolution in Android threats. AI-Powered RatHat Android Trojan... Weiterlesen

Hackers Hide PowerShell Malware in Registry, PNG and WAV Files to Deploy XMRig Miner

Sat, 19 Sep 2026 09:36:39 +0200

Researchers have uncovered a multi-stage cryptomining campaign that uses PowerShell, Registry-stored payloads, DNS TXT records, PNG images, and WAV audio files to conceal malware and deploy an XMRig-based cryptocurrency miner on compromised Windows systems. The activity was first identified after repeated alerts involving suspicious PowerShell... Weiterlesen

PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner

Sat, 19 Sep 2026 09:36:31 +0200

A sophisticated cryptomining campaign is employing multiple layers of obfuscation to conceal malicious PowerShell payloads and ultimately deploy an XMRig-based cryptocurrency miner. This obfuscation includes Windows Registry entries, DNS TXT records, PNG images, and WAV audio files. The infection was detected after repeated security alerts... Weiterlesen

‘Nudify’ apps: What to do if someone makes a fake nude of you

Sat, 19 Sep 2026 07:22:33 +0200

Whether you’re a victim, the parent of a victim, or just concerned, here’s what you can do about fake nude images Weiterlesen

exploiting vulnerable CCTV systems

Sat, 19 Sep 2026 04:03:18 +0200

Youtube channel name: ninjascum1337 https://www.youtube.com/watch?v=I_gxvKEvi6k&t=4s submitted by /u/LegalPirate1337 [link] [comments] Weiterlesen

Rapuncel: Fake GitHub Repositories Disable EDR with a Signed Kernel Driver

Sat, 19 Sep 2026 03:56:23 +0200

1. Basic Information Original Title: Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign Source: LastPass TIME / Delphos Labs Published Date: 2026-09-17 Updated Date: None Severity: High Basis for Severity: An active distribution infrastructure impersonating over 40... Weiterlesen

i have found a malicious site that tempts me to download a piece of software by impersonating google, can someone explain to me what exactly this file does

Sat, 19 Sep 2026 00:49:53 +0200

The site had a "bot verification" which asked me to run a command on the terminal to "unlock" whatever is behind the website (image 1). I immediately got suspicious of what it was telling to do and after some not-so-thorough investigation of mine (I decoded the entire thing), I realized that it was a command to download an external file into my... Weiterlesen

Brevo Supply-Chain Attack Infected Over 100,000 Websites

Sat, 19 Sep 2026 00:06:35 +0200

A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites. Brevo, formerly known as Sendinblue, is a French cloud-based marketing and customer communication platform whose clients include eBay, Louis Vuitton and Michelin. The company was first compromised on September... Weiterlesen

IT Security News Hourly Summary 2026-09-18 23h : 4 posts

Fri, 18 Sep 2026 23:07:19 +0200

4 posts published in the last hour 20:31Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories 20:31Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root 20:02HBO Max Reddit Account Hacked: 108 Malicious Ads Push ClickFix Malware 20:00IT Security News Hourly Summary 2026-09-18 22h : 4... Weiterlesen

Jetzt aktualisieren: Angreifer konnten beliebige Daten von Synology-NAS auslesen - Heise

Fri, 18 Sep 2026 22:03:44 +0200

It was translated with ... Newsletter. Ob Sicherheitslücken, Viren oder Trojaner – alle sicherheitsrelevanten Meldungen gibts bei heise security ... Weiterlesen

New Android malware can deploy AI to automate device control — and it can even bring itself back from the dead

Fri, 18 Sep 2026 22:02:35 +0200

Zimperium zLabs discovered RedHat, a Chinese‑origin Android banking trojan with AI assistantAI interprets screen layouts in real‑time, enabling credential theft and bypassing app redesignsDistributed via third‑party stores, social media, malvertising, and SMS; persistence blocks uninstall attemptsThere is an Android malware out there that comes... Weiterlesen

InjectEave: Elektromagnetischer Angriff macht elektronische Geräte abhörbar

Fri, 18 Sep 2026 21:13:55 +0200

InjectEave zeigt, wie elektromagnetische Angriffe Signale aus elektronischen Geräten aus der Ferne rekonstruieren können. Der Artikel InjectEave: Elektromagnetischer Angriff macht elektronische Geräte abhörbar erschien zuerst auf TARNKAPPE.INFO Weiterlesen

Apple baut einen Exploit-Wächter in den iOS-Kernel ein

Fri, 18 Sep 2026 21:08:46 +0200

Cybersicherheit ios apple ios 27.2 ios sicherheit endpoint security kernel exploit spyware cybersicherheit. Inhaltsverzeichnis. 1.Was ist ... Weiterlesen

Operation RapidRust: Transparenter Tribe nutzt GitHub-C2 und Rust-Malware

Fri, 18 Sep 2026 19:38:46 +0200

LONDON (IT BOLTWISE) – Ein neuer Kampagnenkomplex der Gruppe Transparent Tribe zielt laut Zscaler ThreatLabz auf Regierungs- und Verteidigungsumgebungen in Indien und Afghanistan. Im Zentrum steht Operation RapidRust, die erstmals mehrere Rust- und Script-Bausteine namens RUSTYSHADE, RUSTYMOVE, PSNATCH und BASHNATCH kombiniert. Auffällig ist vor... Weiterlesen

IT Security News Hourly Summary 2026-09-18 19h : 17 posts

Fri, 18 Sep 2026 19:38:41 +0200

17 posts published in the last hour 16:31Google Opens Google Home to Claude and Other AI Agents — Here’s What They Can Control 16:31Settra ransomware variant deployed in recent attacks 16:312026 Péter Szőr Award shortlisted nominees 16:31FBI: Fake cop and government impersonation scams cost victims $1.6B 16:31Google Pixel owners urged to patch... Weiterlesen

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

Fri, 18 Sep 2026 19:38:41 +0200

North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all... Weiterlesen

Hackers Compromise iTorrents Repository to Spread MovieReaper Malware Through Fake Movie Torrents

Fri, 18 Sep 2026 19:36:44 +0200

Cybercriminals have found a clever new trick to spread malware. They broke into a shared torrent repository that many trackers rely on. Then they used it to push fake movie downloads onto unsuspecting users. According to SecureList, the campaign started around mid-August 2026. It has already reached several hundred victims across many countries.... Weiterlesen

New Android malware uses AI to steal bank logins and PINs

Fri, 18 Sep 2026 18:38:44 +0200

RatHat can navigate infected phones while stealing bank logins, authentication codes, and screen-lock PINs. This article has been indexed from Malwarebytes Read the original article: New Android malware uses AI to steal bank logins and PINs The post New Android malware uses AI to steal bank logins and PINs appeared first on IT Security News. Weiterlesen

Settra ransomware variant deployed in recent attacks

Fri, 18 Sep 2026 18:38:44 +0200

Security researchers warned that hackers are using VPN credentials for initial access and deploying RMM tools. This article has been indexed from Cybersecurity Dive – Latest News Read the original article: Settra ransomware variant deployed in recent attacks The post Settra ransomware variant deployed in recent attacks appeared first on IT... Weiterlesen

Telnet Is Still Open: Why the IoT Botnet Notices Keep Describing the Same Reachable Population

Fri, 18 Sep 2026 17:58:17 +0200

Telnet Is Still Open: Why the IoT Botnet Notices Keep Describing the Same Reachable Population When a national CERT publishes a notice about active botnet families, the intrusion methods listed are usually unremarkable. The August 2026 notice from China's National Network and Information Security Notification Centre named five cross-border... Weiterlesen

Four Countries Attribute “Contagious Interview” Fake-Job Malware Campaign to North Korea’s WaterPlum

Fri, 18 Sep 2026 17:23:39 +0200

Japan, the United States, Australia and Germany, today issued a joint cybersecurity advisory formally attributing the long-running "Contagious Interview" campaign to a North Korean state-sponsored group they are calling WaterPlum. The operation has infected more than 30,000 computers in more than 100 countries and stolen about 1.7 billion yen, or... Weiterlesen

Cyber Briefing: 2026.09.18

Fri, 18 Sep 2026 17:23:12 +0200

Iranian malware is using Telegram for command and control, AI is being used to build convincing fake antivirus renewal scams, and an autonomous AI agent reportedly accessed systems, altered personal.. This article has been indexed from CyberMaterial Read the original article: Cyber Briefing: 2026.09.18 The post Cyber Briefing: 2026.09.18 appeared... Weiterlesen

IT Security News Hourly Summary 2026-09-18 17h : 16 posts

Fri, 18 Sep 2026 17:23:12 +0200

16 posts published in the last hour 14:3136,769 Self-Hosted AI Services Exposed Online — What Security Teams Should Check 14:31In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw 14:31Cyber Briefing: 2026.09.18 14:31Meta Plans Smart Glasses Without Camera, Amid Complaints 14:03New Settra Ransomware Variant... Weiterlesen

Malware-Falle auf 100.000 Internetseiten - COMPUTER BILD

Fri, 18 Sep 2026 17:23:08 +0200

Großangriff auf mehr als 100.000 Internetseiten: Hacker verteilten ClickFix-Malware über einen beliebten Online-Dienst und lockten Nutzer in die Falle. submitted by /u/Altruistic_Level9640 [link] [comments] Weiterlesen

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

Fri, 18 Sep 2026 17:19:53 +0200

An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. [...] Weiterlesen

In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw

Fri, 18 Sep 2026 17:19:37 +0200

Noteworthy stories that might have slipped under the radar: Mandiant's 2026 AI risk report, PhantomRaven malware used by bug bounty hunter, WordPress plugin bug exploited. The post In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw appeared first on SecurityWeek. Weiterlesen

AI Agents Now Run Ransomware Attacks End-to-End Without Human Operators

Fri, 18 Sep 2026 16:23:38 +0200

Ransomware attacks are entering a new phase. Researchers have documented a campaign in which an AI agent planned, executed, and escalated an extortion operation without evidence that a human approved its actions. The operation, tracked as JADEPUFFER, used an exposed AI workflow server to steal credentials, reach databases, encrypt records, and... Weiterlesen

Feral Wolf Ransomware Attacks Exploit Atlassian Confluence and Misconfigured 1C Systems

Fri, 18 Sep 2026 16:23:37 +0200

Feral Wolf is using exposed business software and weak server settings to reach corporate networks, then locking files with ransomware. The campaign shows how one overlooked internet-facing system can become the starting point for a much larger incident. The group targeted Russian organizations in retail, construction, manufacturing, and... Weiterlesen

US, UK, Dutch Expose Iranian Chosen Brick Malware

Fri, 18 Sep 2026 16:23:08 +0200

Cybersecurity agencies from the United States, United Kingdom, and the Netherlands have published a joint advisory exposing Iranian surveillance malware known as Chosen Brick. This article has been indexed from CyberMaterial Read the original article: US, UK, Dutch Expose Iranian Chosen Brick Malware The post US, UK, Dutch Expose Iranian Chosen... Weiterlesen

IT Security News Hourly Summary 2026-09-18 16h : 19 posts

Fri, 18 Sep 2026 16:23:08 +0200

19 posts published in the last hour 13:31Hacker ‘Breached Italian Gov’t Email’ To Steal Revolut Data 13:31Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware 13:31US, UK, Dutch Expose Iranian Chosen Brick Malware 13:31NCSC and Allies Warn of Iranian Spyware Campaign 13:31NIS-2: Why practical relevance is crucial in... Weiterlesen

Brevo Breach Exposes Customer Websites to ClickFix Malware

Fri, 18 Sep 2026 16:23:08 +0200

Email marketing and customer relationship management platform Brevo, formerly known as Sendinblue, suffered a supply chain attack in which malicious code was able to reach Brevo's own websites as well as customers' websites utilizing embedded Brevo services. Researchers at Sansec discovered that the incident was much more extensive than the six... Weiterlesen

New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing

Fri, 18 Sep 2026 16:20:51 +0200

Huntress researchers highlighted a new ransomware variant, named Settra, and the post-compromise techniques used in two recent attacks Weiterlesen

Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware

Fri, 18 Sep 2026 15:23:29 +0200

Feral Wolf has expanded its ransomware tradecraft by abusing exposed Atlassian Confluence servers and insecure 1C:Enterprise deployments to gain access to Russian corporate networks before deploying GenieLocker ransomware. The campaign, tracked from May through August 2026, targeted organizations in the retail, construction, manufacturing, and IT... Weiterlesen

IT Security News Hourly Summary 2026-09-18 15h : 9 posts

Fri, 18 Sep 2026 15:23:13 +0200

9 posts published in the last hour 12:31GenAI-Powered ‘RatHat’ Android Malware Bypasses App Sandboxes via ADB 12:31Protesters Fight Microsoft’s Huge Leeds Data Centre 12:31Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells 12:31JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data 12:31Two-week... Weiterlesen

New SETTRA Ransomware Uses MeshAgent RMM and BYOVD to Encrypt Windows Systems

Fri, 18 Sep 2026 15:23:13 +0200

A newly observed ransomware operation dubbed SETTRA is abusing the legitimate MeshAgent remote monitoring and management platform for persistence while using recovery-inhibition and defense-evasion techniques to maximize the impact of Windows encryption attacks. Huntress investigated two SETTRA incidents in July and September 2026, uncovering a... Weiterlesen

Detecting ransomware with eBPF in Rust

Fri, 18 Sep 2026 14:47:29 +0200

Detecting ransomware with eBPF in Rust Title: Detecting ransomware with eBPF in Rust Target: ~1000 words, B1-safe English, working-code-first Build: demo + article for DEV.to / Draft.dev share Source repo: github.com/BartoszOsiej/talus-process-monitor (MIT) 1. The idea (hook) Ransomware works in a simple way: it opens your files, encrypts them,... Weiterlesen

PhantomRaven im npm: Vermuteter KI-Einsatz für Stealer und Bug-Bounty-Strategie

Fri, 18 Sep 2026 14:41:14 +0200

LONDON (IT BOLTWISE) – PhantomRaven wird mit einer npm-Supply-Chain-Attacke in Verbindung gebracht, die Entwickler gezielt um Authentifizierungs- und CI/CD-Daten bringen soll. In einer Analyse wird als plausibel eingestuft, dass der Code des JS-Infostealers mit einem großen Sprachmodell (KI-gestützt) erzeugt wurde. Das Schadprogramm holt u. a.... Weiterlesen

WeaselBiscuit: neuer npm-Dieb zielt auf Chrome-Extension-Storage statt Kryptowallets

Fri, 18 Sep 2026 14:41:14 +0200

LONDON (IT BOLTWISE) – Sicherheitsforscher haben 13 npm-Pakete identifiziert, die den JavaScript-Stealer WeaselBiscuit nachladen. Die Schadsoftware ist bewusst schlank: Sie verzichtet auf Remote-Access, Persistenz und klassische Kryptowallet-Drain-Funktionen. Stattdessen liest sie Chrome-Extension-Storage als rohen LevelDB-Key/Value aus und kann... Weiterlesen

JADEPUFFER Evolves Agentic Ransomware to Target AI Models and Training Data

Fri, 18 Sep 2026 14:41:08 +0200

JADEPUFFER, the agentic threat actor first linked to an autonomous ransomware operation against exposed Langflow infrastructure, has evolved its tooling to target artificial intelligence models, training datasets, and vector data. Its latest payload, ENCFORGE, marks a shift from conventional database extortion toward destruction-focused attacks on... Weiterlesen

GenAI-Powered ‘RatHat’ Android Malware Bypasses App Sandboxes via ADB

Fri, 18 Sep 2026 14:38:07 +0200

HOC Shorts New Android Malware Alert: RatHat As per security research, its linked to China-aligned hackers, this new malware strain is using Generative AI to become virtually hidden. The Trick: It bypass Accessibility Services and auto-pairs with local ADB to completely break out of the Android sandbox. The AI Edge: It uses real-time GenAI to... Weiterlesen

(g+) Praxis-Workshop: TPM 2.0 unter Linux

Fri, 18 Sep 2026 13:32:08 +0200

Das einst verteufelte TPM ist längst im Linux-Alltag angekommen: Es entsperrt LUKS-Volumes, hütet SSH-Schlüssel und versiegelt Geheimnisse. Eine Anleitung von Martin Loschwitz (Linux, Malware) Weiterlesen

Fake LastPass downloads on GitHub pushed password-stealing malware

Fri, 18 Sep 2026 12:53:11 +0200

A malware campaign impersonates LastPass on GitHub to trick users into installing an information stealer that can harvest browser passwords, cryptocurrency wallets, and messaging app sessions. The campaign, detailed in a report by LastPass and Delphos Labs, used fake GitHub pages designed to appear in search results for terms such as “LastPass... Weiterlesen

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Fri, 18 Sep 2026 12:50:13 +0200

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK)... Weiterlesen

Malware-Falle auf 100.000 Internetseiten

Fri, 18 Sep 2026 12:47:29 +0200

Großangriff auf mehr als 100.000 Internetseiten: Hacker verteilten ClickFix-Malware über einen beliebten Online-Dienst und lockten Nutzer in die Falle. Weiterlesen

API-Key geleakt: Plötzlich Malware über 100.000 Websites verbreitet

Fri, 18 Sep 2026 12:47:02 +0200

Angreifer sind an einen API-Schlüssel von Brevo gelangt. Dieser hat mit einem Schlag Clickfix-Attacken über mehr als 100.000 Websites ermöglicht. (Malware, Virus) Weiterlesen

PhantomRaven im npm-Netz: LLM-gestützter JS-Stealer und RDD-Fallback

Fri, 18 Sep 2026 12:22:09 +0200

LONDON (IT BOLTWISE) – Ein finanziell motivierter Angreifer soll über den npm-Registry-Zugang den JS-Informationsdiebstahl PhantomRaven aufgebaut und verbreitet haben. Hinweise deuten darauf hin, dass der Schadcode vermutlich mit einem KI-Sprachmodell (LLM) generiert wurde. Das Paket-Setup nutzt dabei eine Tarnschicht über Typosquatting und... Weiterlesen

Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites

Fri, 18 Sep 2026 12:22:02 +0200

A supply-chain compromise involving Brevo briefly turned widely used website tools into a delivery channel for malware. Attackers inserted hostile JavaScript into services that customer websites load, exposing both visitors and WordPress administrators. The activity reached more than 100,000 customer sites on September 14, according to the... Weiterlesen

Berlin-Hack 2026: Ransomware, Datenabfluss und KRITIS-Lücke - Security-Insider

Fri, 18 Sep 2026 12:19:15 +0200

Vom 7. und dem 12. August 2026 hatten Cyberkriminelle Zugriff auf sensible Daten der Landesverwaltung Berlin. (Bild: Aliaksei - stock.adobe.com). Weiterlesen

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Fri, 18 Sep 2026 12:19:10 +0200

Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts. The post Brevo Supply Chain Attack Injects Malware Into 100,000 Websites appeared first on SecurityWeek. Weiterlesen

Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

Fri, 18 Sep 2026 12:19:06 +0200

A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code,... Weiterlesen

AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection

Fri, 18 Sep 2026 10:52:09 +0200

AI-powered malware is making a familiar security problem harder to contain. Instead of keeping the same code long enough for antivirus tools to recognize it, these programs can alter their form repeatedly while retaining the same harmful purpose. The emerging model relies on large language models as an automated code factory. A malicious dropper... Weiterlesen

Fake Apps, Real Spies: How Iran Tracks Dissidents Through Telegram

Fri, 18 Sep 2026 10:52:04 +0200

Iranian cyber actors are using a malware family known as HEAVYGRAM, also tracked as CHOSEN BRICK, to target dissidents, journalists, and opposition groups worldwide, according to a recent FBI FLASH report and a joint advisory from the UK National Cyber Security Centre (NCSC), the US FBI, and the Netherlands' General Intelligence and Security... Weiterlesen

Agentic Ransomware Lets AI Agents Execute Cyberattacks Without Human Operators

Fri, 18 Sep 2026 10:06:50 +0200

Ransomware attacks have traditionally depended on human operators. Affiliates would steal credentials, move through victim networks, deploy malware, and negotiate payments. Even automated ransomware followed scripts written in advance. Agentic ransomware changes that model. It uses autonomous AI agents that can make operational decisions during an... Weiterlesen

New SETTRA Ransomware Wipes Recovery Options Before Locking Windows Files

Fri, 18 Sep 2026 10:06:50 +0200

Security researchers have uncovered new details about Settra ransomware, a recently observed Windows threat that attempts to destroy recovery options before encrypting files. Huntress investigated two Settra incidents, one targeting a consumer services and retail organization in July and another affecting a manufacturing company in September.... Weiterlesen

Manufacturing Accounts for 22% of all Ransomware Victims

Fri, 18 Sep 2026 10:03:40 +0200

Black Kite has found that manufacturing remained the most targeted sector for ransomware attacks, and saw a big jump in incidents in H1 2026 Weiterlesen

Ransomware-Angriffe setzen auf menschliche Schwächen - B2B Cyber Security

Fri, 18 Sep 2026 10:02:51 +0200

KI macht Ransomware-Angriffe überzeugender. Die Studie basiert auf einer Umfrage unter 953 Cybersicherheitsexperten in 12 Ländern. Sie zeigt unter ... Weiterlesen

Beware the SparroWock: The backdoor that bites, the commands that catch

Fri, 18 Sep 2026 09:41:34 +0200

ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group Weiterlesen

Hackers Poison Movie Torrents With MovieReaper Malware That Uses Solana for C2

Fri, 18 Sep 2026 09:38:01 +0200

Movie torrents are being used to deliver a new Windows malware framework called MovieReaper. Attackers have poisoned torrent downloads for popular films, turning a routine search for entertainment into a route for remote access and data theft. The campaign has reached users and organizations across several countries. Victims who use a magnet link... Weiterlesen

RatHat Android-Malware missbraucht ADB, bleibt nach dem Deinstallieren aktiv

Fri, 18 Sep 2026 09:37:39 +0200

LONDON (IT BOLTWISE) – Sicherheitsforscher warnen vor der Android-Malware RatHat, die über smishing und malvertising auch Nutzer zur Installation präparierter APKs bringt. Im Betrieb kombiniert die Schadsoftware Accessibility-Missbrauch mit einer lokalen ADB-Selbst-Pairing-Strategie, um die Android-App-Sandbox zu umgehen und Shell-Zugriff zu... Weiterlesen

IT Security News Hourly Summary 2026-09-18 09h : 7 posts

Fri, 18 Sep 2026 09:05:24 +0200

7 posts published in the last hour 06:31HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th) 06:31Abandoned IoT apps keep sending sensitive data to broken servers 06:31RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall 06:31Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites... Weiterlesen

HydraDragonAntivirus openedr-v2-release-portable-9

Fri, 18 Sep 2026 08:36:16 +0200

Dynamic and static analysis with Real Time Malware Analysis with Antivirus for Windows, including open-source XDR (3 EDR projects), ClamAV, YARA-X, machine learning AI, behavioral analysis, Unpacker, Deobfuscator, Decompiler, website signatures, Ghidra, Suricata, Sigma, Kernel, Hypervisior based protection and much more than you can imagine. Weiterlesen

MovieReaper Gives Hackers 21 Commands to Steal and Manipulate Files on Windows PCs

Fri, 18 Sep 2026 08:35:26 +0200

A newly identified malware framework named MovieReaper is spreading through malicious torrent downloads disguised as popular movies. The modular Windows threat gives attackers 21 remote file-management commands, enabling them to steal, inspect, alter, and delete data from infected systems. Researchers identified the campaign in mid-August 2026... Weiterlesen

PROMPTFLUX Uses Google Gemini to Rewrite Its Malware Code Every Hour

Fri, 18 Sep 2026 08:35:26 +0200

Researchers have identified PROMPTFLUX, an experimental malware dropper that reportedly uses Google’s Gemini API to rewrite parts of its own code about once every hour. The technique shows how attackers could use generative AI to create many changing versions of the same malicious program, making traditional security detection harder. Polymorphic... Weiterlesen

IT Security News Hourly Summary 2026-09-18 08h : 11 posts

Fri, 18 Sep 2026 08:35:18 +0200

11 posts published in the last hour 05:31Andorran Police joins Europol’s secure communication network 05:31FBI Seizes NightmareStresser DDoS-for-Hire Domains Used in Hundreds of Thousands of Attacks 05:3198% of fraudulent hires have company credentials by the time they’re caught 05:31MovieReaper Malware Spreads Through Pirated Movie Torrents and... Weiterlesen

Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites

Fri, 18 Sep 2026 08:35:18 +0200

A suspected supply-chain compromise involving Brevo has exposed visitors and WordPress administrators across more than 100,000 websites to malware. Attackers allegedly abused Brevo-hosted JavaScript assets, signup forms, unsubscribe pages and chat widgets to distribute a WordPress backdoor and ClickFix social-engineering payloads. Brevo, formerly... Weiterlesen

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Fri, 18 Sep 2026 08:32:33 +0200

Cybersecurity researchers have flagged a new Android malware called RatHat that's assessed to be operated by China-based threat actors and features an artificial intelligence (AI)-powered system to navigate and control compromised devices. "Distributed primarily via targeted smishing (SMS/text phishing) and malvertising campaigns leading to... Weiterlesen

Perfekter Hack: Wenn 100.000 Webseiten plötzlich Malware liefern

Fri, 18 Sep 2026 08:32:32 +0200

Schwachstellen in weit verbreiteten Diensten können schnell eine Flut von Sicherheitsproblemen auslösen. Das zeigte sich auch in einem aktuellen Fall, in dem um die hunderttausend Webseiten plötzlich Malware an Nutzer auslieferten. (Weiter lesen) Weiterlesen

AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection

Fri, 18 Sep 2026 08:30:49 +0200

AI-powered malware is beginning to erode one of endpoint security’s oldest assumptions: that malicious code will remain stable long enough to identify, fingerprint, and block. A new class of threats uses large language models during execution to rewrite scripts, generate commands, and alter obfuscation on demand producing variants that can evade... Weiterlesen

MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2

Fri, 18 Sep 2026 07:05:14 +0200

A newly identified Windows malware framework dubbed MovieReaper is being distributed through pirated movie torrents after threat actors compromised a public torrent-file repository used by multiple tracker sites. The campaign combines a multi-stage infection chain, anti-analysis techniques, UAC bypass, file-management capabilities, and Solana... Weiterlesen

CISA Wants Defenders to Deploy Fake Credentials and Systems to Catch Hackers

Fri, 18 Sep 2026 06:37:15 +0200

CISA has urged organizations to deploy fake credentials, systems, files, and data assets inside their environments to expose attackers after an initial compromise. The agency published its new guidance, Using Cyber Decoys to Strengthen Detection and Response, on September 16, 2026. CISA said many attackers now avoid malware-heavy intrusion methods... Weiterlesen

CAPEsolo

Fri, 18 Sep 2026 02:35:21 +0200

Standalone Windows VM malware sandbox running capemon, with GUI triage viewer, YARA signatures, IOC extraction, network analysis, and VirusTotal/MalwareBazaar sample download. Weiterlesen

IT Security News Hourly Summary 2026-09-18 01h : 3 posts

Fri, 18 Sep 2026 01:25:47 +0200

3 posts published in the last hour 22:31Inside the Modern SOC: Defending the Cross-Environment Pivot 22:02Global public-private operation disrupts Sality botnet active for two decades 22:00IT Security News Hourly Summary 2026-09-18 00h : 7 posts The post IT Security News Hourly Summary 2026-09-18 01h : 3 posts appeared first on IT Security News. Weiterlesen

Avast: Oktoberfest

Fri, 18 Sep 2026 01:15:09 +0200

YouTube Video

Prost to faster streaming!

New RatHat Android malware uses AI to automate device control

Fri, 18 Sep 2026 00:24:46 +0200

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. [...] Weiterlesen

Ransomware Operators Are Using AI Coding Agents Now

Thu, 17 Sep 2026 21:18:56 +0200

A ransomware crew used Cursor to write exploit code for ESXi hypervisors this month. Not a hypothetical. Not a tabletop exercise. The Aurora group integrated AI coding agents into active operations and hit production infrastructure with machine-generated payloads. That crossed a line most threat models hadn't drawn yet. The conventional assumption... Weiterlesen

Be alert: targeted attacks on prominent Rustaceans

Thu, 17 Sep 2026 20:17:03 +0200

We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware. What we've seen A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's... Weiterlesen

China’s Salt Typhoon backdoors Latin American orgs with new snooping malware

Thu, 17 Sep 2026 20:13:51 +0200

Beware the SparroWocky, my son! The backdoor that bites… This article has been indexed from www.theregister.com – Articles Read the original article: China’s Salt Typhoon backdoors Latin American orgs with new snooping malware The post China’s Salt Typhoon backdoors Latin American orgs with new snooping malware appeared first on IT Security News. Weiterlesen

China's Salt Typhoon backdoors Latin American orgs with new snooping malware

Thu, 17 Sep 2026 20:10:33 +0200

China’s Salt Typhoon gang has developed a new backdoor and dropped it in networks belonging to high-profile organizations in several countries across Central and South America since at least August 2025, according to researchers. The PRC-backed espionage crew shifted its focus to Latin America a month prior, and from mid-2025 into 2026, the vast... Weiterlesen

Brevo supply-chain attack injected ClickFix scripts on customer sites

Thu, 17 Sep 2026 19:40:40 +0200

Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. [...] Weiterlesen

New Settra Ransomware Strain Deploys MeshAgent RMM for Persistence

Thu, 17 Sep 2026 18:28:29 +0200

Researchers at Huntress have detailed two ransomware incidents involving Settra, a relatively new strain first observed in June, and revealed a consistent set of post-compromise tactics defenders can use to spot the threat before encryption takes hold. In a blog post published this week, Huntress researchers Harlan Carvey and Lindsey... Weiterlesen

Replik zum Artikel „Vom Keller in die Cloud: Warum das lokale Firmen-Rechenzentrum zum Sicherheitsrisiko wird “

Thu, 17 Sep 2026 18:15:22 +0200

Replik zum Cloud-Hype: Wie FUD täuscht, welche Risiken der US Cloud Act birgt und warum die lokale IT erforderlich bleibt. Der Artikel Replik zum Artikel „Vom Keller in die Cloud: Warum das lokale Firmen-Rechenzentrum zum Sicherheitsrisiko wird “ erschien zuerst auf TARNKAPPE.INFO Weiterlesen

CHOSEN BRICK: Iranian Windows Surveillance Malware Using Telegram C2

Thu, 17 Sep 2026 17:31:45 +0200

1. Overview Original Title: Iranian cyber targeting of dissidents, activists and journalists Source: NCSC, FBI, AIVD Published: 2026-09-15 Updated: None Severity: High Basis for Severity: The joint government advisory reports real-world compromises targeting dissidents, activists, and journalists worldwide since at least 2025. The malware focuses... Weiterlesen

LausivLoader analysis, or how to pass data between malware stages, (Thu, Sep 17th)

Thu, 17 Sep 2026 17:28:48 +0200

At the end of August, a malspam message was caught in the quarantine of a mail gateway operated by one of my customers. The message was not especially remarkable – it asked the recipient to review some attached requirements and provide a price quotation for a fiber optic system and appeared to impersonate an employee of a legitimate company. The... Weiterlesen

CISA Wants Defenders to Plant Fake Credentials and Systems to Catch Hackers

Thu, 17 Sep 2026 16:47:40 +0200

Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM

Thu, 17 Sep 2026 16:47:24 +0200

A previously undocumented HEAVYGRAM and CRUDEEXCLUDE malware samples linked with moderate confidence to the Iran-aligned Handala Hack operation. The campaign combines targeted social engineering, Microsoft Defender exclusion abuse, multi-stage loaders, and Telegram-based command-and-control to surveil Iranian dissidents, journalists, and people... Weiterlesen

New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data

Thu, 17 Sep 2026 16:44:04 +0200

Researchers at Zimperium have uncovered a new Android malware strain, dubbed RatHat, with spyware and backdoor capabilities Weiterlesen

Golang BYOVD Malware Loader and Vulnerable Driver Analysis

Thu, 17 Sep 2026 16:30:34 +0200

submitted by /u/jershmagersh [link] [comments] Weiterlesen

The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents

Thu, 17 Sep 2026 16:30:05 +0200

Introduction Torrent trackers have long been abused for distributing malicious software, disguised as popular films, games, and other content. Our previous research has shown that cybercriminals repeatedly turn torrents as an initial infection vector, using trojanized cracks and installers to reach a large number of users. Installation guides for... Weiterlesen

Staatliche Hacker treiben laut Chainalysis einen Anstieg von 420 % bei Onchain-Malware voran

Thu, 17 Sep 2026 15:04:31 +0200

Mit Staaten verbundene Hacker waren in jedem Quartal für etwa zwei Drittel der neuen Aktivitäten verantwortlich, während die Zahl der Fälle, ... Weiterlesen

Chinesische KI-Modelle verursachen Anstieg der auf der Blockchain platzierten Malware ...

Thu, 17 Sep 2026 15:04:31 +0200

Chainalysis verbindet einen Anstieg von 440% bei Malware-Befehlen auf der Blockchain mit chinesischen KI-Modellen, Nordkorea und Iran führen. Weiterlesen

SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia

Thu, 17 Sep 2026 15:00:31 +0200

SilkParasite is a cyberespionage operation aimed at government, energy and telecommunications interests in Central Asia. New infrastructure analysis indicates that the activity behind the campaign may be older and broader than its recent name suggests. The operation has used spear-phishing emails carrying convincing government-themed documents and... Weiterlesen

Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware

Thu, 17 Sep 2026 15:00:31 +0200

HEAVYGRAM is a Windows surveillance backdoor that turns Telegram into an operational command center for attackers. Rather than relying on a dedicated server, it uses bots, accounts and groups to receive instructions, move stolen data and keep infected devices under control. The malware has been used since fall 2023 against journalists, Iranian... Weiterlesen

Druva expands identity resilience with ransomware detection

Thu, 17 Sep 2026 14:57:38 +0200

Druva has announced new capabilities for Druva Identity Resilience alongside the launch of Ransomware Detection, a new feature fueled by a proprietary AI threat pipeline. Powered by Dru MetaGraph, the new offerings use behavioral intelligence and built-in validation to turn suspicious behavior into actionable evidence, definitively confirm impact,... Weiterlesen

Tackling Spyware Abuse: What States Must Do Under International Law to Protect Journalists and Strengthen Security

Thu, 17 Sep 2026 14:57:05 +0200

The Citizen Lab, a digital-security research group at the University of Toronto, published a report this past July revealing that Stelios Kouloglou, a prominent Greek investigative journalist and former member of the European Parliament, was hacked with NSO Group’s Pegasus spyware multiple times in 2022 and 2023. At the time, Kouloglou was serving... Weiterlesen

Kann die Produktion weiterlaufen, wenn die Konzern-IT kompromittiert ist?

Thu, 17 Sep 2026 14:56:38 +0200

Ja, wenn das Werk seine kritischen Funktionen für eine definierte Zeit ohne Konzern-IT betreiben kann. Netzsegmentierung allein belegt das nicht. Ob das gelingt, zeigt sich beim nächsten Schichtwechsel und beim ersten Restore. Die Anlage läuft. Der neue Schichtführer kann sich nicht anmelden. Ransomware hat die Konzern-IT getroffen, Active... Weiterlesen

Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows

Thu, 17 Sep 2026 14:56:23 +0200

Research shows attacks on manufacturers rose 40% in early 2026, as ransomware groups increasingly exploit the supply-chain disruption caused by operational shutdowns. The post Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows appeared first on SecurityWeek. Weiterlesen

FamousSparrow bringt neue SparroWocky-Backdoor in lateinamerikanischen Angriffen aus

Thu, 17 Sep 2026 14:13:37 +0200

LONDON (IT BOLTWISE) – Eine China-ausgerichtete Gruppe namens FamousSparrow setzt in Angriffen gegen mehrere Länder in Lateinamerika eine neue Backdoor namens SparroWocky ein. Die Malware wird seit mindestens August 2025 beobachtet und ersetzt dort Berichten zufolge eine frühere Hauptkomponente. Laut ESET ist das Implantat modular, lässt sich über... Weiterlesen

Fake MRI Scans Deliver CHOSEN BRICK Spyware to Windows PCs

Thu, 17 Sep 2026 14:13:32 +0200

Iranian state-linked attackers are using fake MRI scans and software lures to deploy CHOSEN BRICK spyware on Windows PCs. This article has been indexed from eSecurity Planet Read the original article: Fake MRI Scans Deliver CHOSEN BRICK Spyware to Windows PCs The post Fake MRI Scans Deliver CHOSEN BRICK Spyware to Windows PCs appeared first on IT... Weiterlesen

IT Security News Hourly Summary 2026-09-17 14h : 14 posts

Thu, 17 Sep 2026 14:13:32 +0200

14 posts published in the last hour 11:32Fake MRI Scans Deliver CHOSEN BRICK Spyware to Windows PCs 11:32Test environment let anyone access live customer data 11:31How Candidates Could Use AI for Good 11:31BIND 9.20.29 Fixes 14 Security Flaws Enabling DNSSEC Bypass and Denial-of-Service Attacks 11:31World Quantum Readiness Day: Industry Voices on... Weiterlesen

FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments

Thu, 17 Sep 2026 13:28:53 +0200

China-aligned advanced persistent threat group FamousSparrow has replaced its long-running SparrowDoor implant with a new modular C++ backdoor, SparroWocky, in a sustained cyberespionage campaign against government entities across Latin America. ESET says the malware has been active in the region since at least August 2025, following a sharp shift... Weiterlesen

THEA1200 – drei klassische Amiga-Computer unter einer Haube

Thu, 17 Sep 2026 13:15:23 +0200

Pünktlich zu Weihnachten kommt die neue Emulator-Hardware THEA1200 heraus, sie vereint den A500, A600 und A1200. Der Artikel THEA1200 – drei klassische Amiga-Computer unter einer Haube erschien zuerst auf TARNKAPPE.INFO Weiterlesen

APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks

Thu, 17 Sep 2026 12:28:06 +0200

APT36, a Pakistan-linked threat group, has launched a campaign that uses infected removable drives to carry malware into disconnected government environments. The operation, called RapidRust, targets India and Afghanistan with a backdoor, file stealers, and a USB-spreading tool. This approach is important because air-gapped networks are separated... Weiterlesen

16-31 August 2026 Cyber Attacks Timeline

Thu, 17 Sep 2026 12:27:31 +0200

The second half of August 2026 brought 110 confirmed cyber incidents, with Cyber Crime once again the dominant motivation at 78% of attacks. Malware remained the weapon of choice, exploitation of public-facing applications (T1190) continued to lead initial access, and Information & Communication emerged as the hardest-hit sector. This timeline... Weiterlesen

Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin’s AI use

Thu, 17 Sep 2026 12:27:31 +0200

Ransomware incidents in Japan rose 4.7% year over year. The Gentlemen was the most active group, with leak-site listings more than doubling from January to July. Qilin ranked second and appeared to use AI, while SMEs with capital under JPY 1 billion represented 80% of victims. This article has been indexed from Cisco Talos Blog Read the original... Weiterlesen

16-31 August 2026 Cyber Attacks Timeline Infographic

Thu, 17 Sep 2026 12:27:31 +0200

A one-page visual summary of the 16–31 August 2026 cyber attacks timeline: 110 incidents broken down by motivation, attack technique, initial access vector, targeted sector, and country — Cyber Crime and Malware led the period, with Information & Communication the hardest-hit sector. This article has been indexed from HACKMAGEDDON Read the... Weiterlesen

Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use

Thu, 17 Sep 2026 12:00:56 +0200

Compared with the same period last year, ransomware incidents in Japan increased slightly by approximately 4.7%, indicating that ransomware continues to pose a significant threat.In Japan, The Gentlemen was the most active ransomware group in the first half of 2026.Attackers continue to primarily target small- and medium-sized enterprises, with... Weiterlesen

APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal

Thu, 17 Sep 2026 11:59:35 +0200

Pakistan-nexus threat actor APT36 has launched a renewed espionage campaign targeting government and defense organizations in India and Afghanistan. Deploying a new Rust-based malware suite designed for covert command-and-control, data theft, and propagation into isolated networks. Tracked by Zscaler ThreatLabz as Operation RapidRust, the activity... Weiterlesen

APT36 Uses RUSTYSHADE and USB Malware to Target Government and Defense Organizations

Thu, 17 Sep 2026 11:59:28 +0200

Pakistan-linked threat actor APT36 has launched a new cyber campaign targeting government and defense organizations in India and Afghanistan. The campaign, tracked as Operation RapidRust, was identified by Zscaler ThreatLabz in August 2026 and shows the group continuing to update its malware and post-compromise methods. The operation uses several... Weiterlesen

Cyberthreats are moving faster than SMBs: Readiness must accelerate

Thu, 17 Sep 2026 11:45:20 +0200

As AI adoption expands the attack surface and adds to the security workload, businesses need automation backed by experts Weiterlesen

New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete It

Thu, 17 Sep 2026 11:31:18 +0200

A newly tracked Android malware called RatHat is targeting banking customers with fake screens, stolen verification codes and persistent phone access. The threat can capture PINs, passwords and unlock patterns, raising the risk of account takeovers and payments after a victim believes the malicious app is gone. The campaign relies on deceptive... Weiterlesen

New SparroWocky backdoor deployed in attacks on governments

Thu, 17 Sep 2026 11:31:01 +0200

The China-aligned FamousSparrow cyberespionage group has begun deploying a new modular backdoor named SparroWocky in attacks focused heavily on Latin America. The malware provides extensive remote-control capabilities while using low-level Windows manipulation and anti-analysis techniques to evade security tools. ESET researchers discovered... Weiterlesen

100,000+ WordPress sites infected via Brevo supply chain attack

Thu, 17 Sep 2026 11:31:01 +0200

A breach affecting Brevo infrastructure has pushed malicious JavaScript to more than 100,000 websites through Brevo-hosted widgets and scripts. According to a report from the Sansec Forensics Team, attackers modified Brevo resources on September 14 to deliver malware that attempted to install a malicious WordPress plugin when logged-in... Weiterlesen

Chinese hackers use SparroWocky malware in govt espionage attacks

Thu, 17 Sep 2026 11:26:17 +0200

The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America. [...] Weiterlesen

Malicious npm package found in Antfarm Tech proof_of_dev coding assignment

Thu, 17 Sep 2026 11:15:26 +0200

submitted by /u/Top_Director3322 [link] [comments] Weiterlesen

How MSSPs Can Prove Their Value When “Nothing Happened”

Thu, 17 Sep 2026 10:26:53 +0200

For an MSSP, a quiet month can be a good month. No ransomware outbreak. No major account compromise. No business disruption. But it can also create an awkward conversation with the client: What exactly did we pay for this month? The problem is not that the SOC did nothing. Quite the opposite. Analysts may have investigated hundreds of suspicious... Weiterlesen

RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs

Thu, 17 Sep 2026 10:26:17 +0200

RatHat, a newly identified Android banking malware family that combines Accessibility abuse, local Android Debug Bridge (ADB) pairing, native shell-level components, and generative-AI-assisted interface automation. The operation appears linked to China-based threat actors and is primarily designed to steal banking credentials, payment PINs,... Weiterlesen

Chosen Brick, Iran’s Surveillance Malware

Thu, 17 Sep 2026 10:23:57 +0200

UK, US, and Dutch agencies expose Chosen Brick, Iranian malware used to track and harass dissidents, journalists, and activists via Telegram. The UK, the US, and the Netherlands published a joint advisory warning about a Windows malware family, dubbed Chosen Brick, that Iran’s intelligence services use to track down dissidents, journalists, and... Weiterlesen

Fake AI trading agent steals crypto wallet passwords

Thu, 17 Sep 2026 10:23:52 +0200

Attackers built a website for a fake AI crypto trading agent and used it to install Needle Stealer, malware that replaces a victim’s browser wallet with a copy that sends the wallet password to the attacker. HP caught the campaign between April and June 2026. The Needle campaign targets people who download AI agents from search results or ads, and... Weiterlesen

New RatHat Android Malware Uses AI and ADB to Steal Banking Credentials and OTPs

Thu, 17 Sep 2026 09:57:43 +0200

The malware uses artificial intelligence, Accessibility Service abuse, and Android Debug Bridge (ADB) pairing to steal banking credentials, payment PINs, one-time passwords, and lock-screen data. RatHat is spread through smishing messages, malicious advertisements, phishing websites, and third-party download portals. Victims are lured into... Weiterlesen

PhantomEnigma Shifts Tactics: Explorer-Based Payload Delivery

Thu, 17 Sep 2026 07:45:12 +0200

submitted by /u/ANYRUN-team [link] [comments] Weiterlesen

Built a PPL-aware ALPC enumerator because standard handle duplication was leaving blind spots in the attack surface