WhatsApp Financial Lure Installs VulcanRAT With SYSTEM Control on Windows
A WhatsApp-delivered ZIP file posing as a financial document launches a multi-stage Windows infection that installs VulcanRAT with SYSTEM privileges. The campaign combines sandbox evasion, PoolParty injection, a...
Trojanized Terraform Provider Delivers Cross-Platform Backdoors to Developers
A malicious Terraform provider masquerading as an AWS plugin delivers FLATROOF and ROOFDECK malware across macOS, Linux, and Windows. The campaign targets developer and CI/CD environments where cloud...
CastleStealer Malware Adds Remote Shell Access After Cracking Chrome’s Cookie Protection
CastleStealer, a C#-based information stealer first spotted in April, has gained the ability to bypass Chrome's App-Bound Encryption and hand its operators a remote shell on infected Windows...
Warden Stealer-as-a-Service Expands to Target Browser Vaults, Crypto Wallets, and AI Agent Tokens
A fast-growing Rust-based information stealer called Warden Stealer is spreading through ClickFix lures, malicious ads, cracked software, and fake game cheats. Sold as a malware-as-a-service kit, it bypasses...
UAC-0099 Refines MATCHBOIL Malware With Cloudflare-Hidden Servers to Hit Ukrainian Organizations
ESET researchers have detailed how the UAC-0099 threat group has evolved its MATCHBOIL downloader with Cloudflare-concealed command servers, stronger code obfuscation, and anti-analysis checks. Victims span transportation, manufacturing,...
Compromised Tensorlake npm Release Spreads Shai-Hulud Worm Through Developer Systems
A malicious Tensorlake npm release executed during installation, harvested developer and cloud secrets, and used worm-like techniques to threaten downstream projects. Teams that installed version 0.5.144 should treat...
Fake Rabby and OKX Wallet Clones Found Stealing Crypto Seed Phrases via Firefox Add-ons
Researchers at Socket.dev uncovered 16 malicious Firefox extensions posing as Rabby Wallet and OKX Wallet that quietly captured recovery phrases and private keys and sent them to attacker-controlled...
Fake Cloudflare Verification Pages Used to Push LUNEXSTEALER Malware on 100+ Hacked Sites
Ukraine's CERT-UA is tracking a campaign, dubbed UAC-0277, that has compromised more than 100 legitimate websites to show visitors a convincing but fake Cloudflare verification screen. Clicking through...