Latest Malware news

An updated SparkCat variant hides inside App Store and Google Play apps, scanning photo galleries with OCR for crypto wallet seed phrases. Kaspersky found two infected iOS apps and one on Android, primarily targeting Asia. The malware is actively maintained …

Fake installers with step-by-step SmartScreen bypass instructions have been deploying RATs and crypto miners since late 2023. Elastic Security Labs tracked 27.88 XMR ($9,392) across four wallets. The operation uses a new .NET implant called CNB Bot alongside PureRAT and …

A new loader called DeepLoad steals credentials from the moment of infection and reinfected a cleaned host three days after remediation through hidden WMI persistence. ReliaQuest says the obfuscation layer was likely AI-generated.

A five-stage chain uses ClickFix social engineering and the Deno JavaScript runtime to load CastleRAT entirely in memory. ThreatDown calls it the first Deno abuse in malware. Velvet Tempest already deployed CastleRAT in a 12-day ransomware staging operation.

Bogus AI downloads tricked macOS users into pasting Terminal commands that dropped the MacSync infostealer. Sophos tracked 50,000+ clicks in days. A parallel InstallFix variant hits developers because curl | sh is a legitimate pattern.

A supply-chain operation planted 72 malicious VS Code extensions on Open VSX using transitive dependencies that bypass initial review. The same GlassWorm threat actor injected Unicode payloads into 151 GitHub repos with LLM-generated cover commits.

A domain registrar hijack turned the AppsFlyer Web SDK into a crypto-stealing weapon for nearly 14 hours. The injected code swapped wallet addresses on every website loading the script. Independent analysis found a seven-module interception framework far beyond a simple …

Seven Steam games secretly installed malware that drained crypto wallets and harvested credentials. The FBI named all seven titles and is seeking victims. One game alone stole $150,000 from hundreds of players.

Fake job applications are delivering kernel-level malware to HR departments. The BlackSanta campaign, attributed to allegedly Russian-speaking hackers, uses BYOVD to kill EDR before stealing crypto wallets and employee data. Active for over a year.