Backdoor Smuggled Through a Chinese Keyboard App’s Update Check Hits Six Countries
A China-aligned group dubbed SlippyNunchucks hijacked unencrypted update traffic from the popular Sogou Input Method keyboard app to plant a modular backdoor called DarkVigil on victims across Hong...
Gorbag Hackers Weaponize a WinRAR Bug to Spy on Ukrainian Government Networks
A Russia-aligned group tracked as Gorbag is abusing a WinRAR path-traversal flaw to plant credential-stealing malware inside Ukrainian government, justice, and defense-adjacent networks. Researchers say the group favors...
Google Takes Down a 1.3-Million-Device Botnet Built Into Streaming Boxes Straight From the Factory
Google and a coalition of security partners have dismantled XCPE, a sprawling botnet that Google says was deliberately built into Android TV set-top boxes by their own manufacturer,...
North Korean Hackers Weaponize Stolen Developer Credentials to Poison Open-Source Packages
A North Korea-aligned group tracked as DeceptiveDevelopment has shifted from fake job-interview lures to stealing developer credentials outright, using them to inject malware into npm, PyPI, Packagist, Go,...
Trojanized Claude Code Extension Slipped Past Cursor’s Marketplace for 11 Hours, Planted SSH Backdoors
Cursor has confirmed that tampered versions of the popular Claude Code extension were live on its VS Code marketplace for roughly 11 hours in late October, quietly harvesting...
NetamLoader Malware Hides Inside Trusted Update Tools to Target Asian Government PCs
Kaspersky researchers have detailed a new, highly evasive malware loader called NetamLoader that abuses a legitimate patch-management tool and Microsoft-signed components to infect a custom, government-only build of...
Fake FedEx Tax Invoice Emails Are Dropping a Memory-Only Backdoor That Blinds Windows Defenses
A phishing campaign impersonating FedEx billing notices is delivering a newly documented, largely fileless backdoor called Sirius that patches Windows' own security logging to evade detection. Once installed,...
New DarkCore RAT Hijacks Gmail and WhatsApp Logins, Then Disguises the Theft as the Victim’s Own Traffic
A remote access trojan called DarkCore, discovered by researchers at BlackFog, is being sold with a built-in browser that reuses stolen Gmail and WhatsApp session cookies while routing...