tsecurity.de - News Radar & Live Feeds

CloudSyncD Backdoor Spread Through Fake Zoom Installer Targeting macOS

Mon, 05 Oct 2026 21:37:55 +0200

Using fake Zoom installers, a macOS malware campaign distributes a backdoor known as CloudSyncD, a backdoor for MacOS. Jamf Threat Labs first identified the malware during its development in mid-September, but later samples indicated it had moved to a live command-and-control infrastructure. It is initiated by the use of a disk image that is made... Weiterlesen

Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor

Mon, 05 Oct 2026 18:52:04 +0200

Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes. This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original article: Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor... Weiterlesen

New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic

Mon, 05 Oct 2026 16:48:21 +0200

Rapid7 has uncovered new BPFDoor, BPF Rekoobe and AVERAT malware variants targeting telecom and network-edge appliances in South Korea and Taiwan Weiterlesen

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

Mon, 05 Oct 2026 15:12:16 +0200

ClingSTUN operates as a back-connect proxy backdoor, sets up persistence, and contains exploits for self-propagation. The post Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws appeared first on SecurityWeek. Weiterlesen

One hidden Meta Muse setting could let attackers turn the AI assistant into a backdoor

Mon, 05 Oct 2026 10:24:51 +0200

Meta Muse is designed to act as a personal AI assistant across a Mac and connected devices – much like the new Siri AI released with… This article has been indexed from Panda Security Mediacenter Read the original article: One hidden Meta Muse setting could let attackers turn the AI assistant into a backdoor The post One hidden Meta Muse setting... Weiterlesen

Neue macOS-Backdoor "CloudSyncD" tarnt sich als Zoom-Installer

Sun, 04 Oct 2026 00:17:45 +0200

Die Experten der Jamf Threat Labs haben mit "CloudSyncD" eine neue zweistufige macOS-Backdoor analysiert. Die Malware tarnt sich als legitimer Zoom-Installer und fordert Nutzer dazu auf, die Sicherheitsfunktionen (Gatekeeper) von macOS zu umgehen und ihr Anmeldepasswort einzugeben. Die Jamf Threat … Weiterlesen → Quelle Weiterlesen

Fake Zoom installer hides macOS backdoor CloudSyncD

Sat, 03 Oct 2026 18:45:53 +0200

Jamf Threat Labs details CloudSyncD, a fake macOS Zoom installer that hides a phished password using invisible zero-width Unicode characters. Jamf Threat Labs found CloudSyncD while doing routine scanning on VirusTotal, buried inside a disguised Zoom client. They first spotted it on September 15, clearly still under construction, and within two... Weiterlesen

Fake Zoom installer hides macOS backdoor CloudSyncD

Sat, 03 Oct 2026 18:32:10 +0200

CloudSyncD MacOS Backdoor Used Fake Zoom Installer to Steal Passwords

Sat, 03 Oct 2026 16:02:18 +0200

Cybersecurity researchers have identified a new macOS backdoor called CloudSyncD that uses a fake Zoom installer to trick users into providing their computer passwords. The malware was discovered by Jamf Threat Labs and uses a two-stage infection process to gain elevated access and communicate with attacker-controlled servers. One of the most... Weiterlesen

Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel

Sat, 03 Oct 2026 12:23:42 +0200

Cisco Talos details UAT-11587, a China-linked group using the Antino backdoor and Microsoft 365 as cover to spy on Asian governments. Cisco Talos has been tracking a cluster of espionage activity since September 2025 that it calls UAT-11587, and by July 2026 the group had hit at least 16 government and policy organizations across eight Asian... Weiterlesen

Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel

Sat, 03 Oct 2026 12:16:55 +0200

CloudSyncD: Fake Zoom Installer Hides Password with Zero-Width Unicode and Launches macOS Backdoor

Sat, 03 Oct 2026 02:57:33 +0200

1. Basic Information Original Title: CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode Source: Jamf Threat Labs Publication Date: 2026-09-30 Update Date: None Severity: High Basis of Severity: Exploitation requires the victim to bypass Gatekeeper and enter a valid administrator password. If successful, the... Weiterlesen

Antino-Backdoor nutzt Outlook und OneDrive als C2-Kanal für Espionage

Fri, 02 Oct 2026 20:52:16 +0200

LONDON (IT BOLTWISE) – Eine neue Espionage-Kampagne setzt auf eine bislang undokumentierte Rust-basierte Windows-Backdoor namens Antino. Laut Cisco Talos läuft der Command-and-Control-Kanal ausschließlich über Microsoft 365: Outlook dient dem Nachrichtenaustausch, OneDrive als Speicher für Datei- und Status-Updates. Der Einstieg erfolgt über... Weiterlesen

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Fri, 02 Oct 2026 19:49:39 +0200

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor... Weiterlesen

New CloudSyncD macOS Backdoor Uses Fake Zoom Installer to Steal Passwords

Fri, 02 Oct 2026 19:26:12 +0200

CloudSyncD macOS backdoor uses a fake Zoom installer to steal Mac passwords, bypass Gatekeeper and connect infected devices to remote C2 servers. Weiterlesen

SC-Backdoor: WordPress-Persistenz über Dateien, DB und Shared Memory neu gebaut

Fri, 02 Oct 2026 19:26:07 +0200

LONDON (IT BOLTWISE) – Sicherheitsforscher beschreiben eine WordPress-Backdoor, die sich nach Bereinigung selbst neu aufbaut. Laut Bericht verteilt sie identische Komponenten über Dateien, Datenbankeinträge und System-V-Shared-Memory, sodass keine einzelne Maßnahme das Ganze zuverlässig stoppt. Der Angreifer nutzt zudem eine Decoder-Logik mit... Weiterlesen

macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

Fri, 02 Oct 2026 19:22:17 +0200

The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime. The post macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor appeared first on SecurityWeek. Weiterlesen

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Fri, 02 Oct 2026 19:22:11 +0200

Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC_" markers present in the injected content. Sucuri has described the malware as... Weiterlesen