In recent weeks, the activity of the Vidar Stealer malware has surged dramatically — its new version 2.0 emerged amid the decline of Lumma Stealer’s dominance and has already captured the attention of cybercriminal...
Over the past two years, Kaspersky Lab researchers have been tracking a little-known espionage campaign dubbed PassiveNeuron. Initial server compromises of government organizations were observed as early as 2024, yet for a long time...
Hackers have unleashed a new self-propagating malware dubbed GlassWorm, which first infiltrated the Visual Studio Code extension ecosystem via the OpenVSX marketplace. Researchers at Koi Security found that the worm conceals malicious code using...
A malicious file was discovered in the downloads section of Xubuntu.org, the official website of the Ubuntu distribution featuring the Xfce desktop environment. The counterfeit installer, disguised as “Xubuntu — Safe Downloader,” was designed...
A North Korean–linked group has, for the first time, adopted EtherHiding — a technique that conceals malicious code inside smart contracts on public blockchains and swaps payloads on the fly. Google’s Threat Intelligence Team...
In October 2025, researchers at Kaspersky Lab uncovered a malicious package on the popular npm registry named https-proxy-utils, masquerading as a legitimate proxy utility. The trojanized module was engineered to deploy AdaptixC2 on compromised...
McAfee researchers have reported a renewed campaign by the banking trojan Astaroth, which has begun abusing GitHub as a resilient channel for delivering configuration data. By leveraging a legitimate platform in this way, attackers...
In Spain, authorities have concluded a large-scale operation targeting one of the most active cybercriminal groups operating within the Spanish-speaking segment of the internet. Law enforcement officers apprehended the alleged leader of the network,...
The threat actor known as BatShadow, linked to Vietnam, has launched a new malicious campaign targeting job seekers and digital marketing professionals. Posing as recruiters, the attackers distribute forged job descriptions; when victims open...
In a complex attack chain that blends malicious advertising, DNS-based control, and multi-stage delivery schemes, researchers at Infoblox uncovered the operations of a cybercriminal group known by the alias Detour Dog. The group orchestrates...
Researchers at Varonis have reported the emergence of a new toolkit named MatrixPDF, which enables attackers to transform ordinary PDF files into interactive phishing lures. These maliciously crafted documents can bypass email security filters...
A new tool has emerged on the cybercriminal marketplace—one that has swiftly become a weapon of choice for dozens of groups. This is HeartCrypt, a malware-packing service that disguises malicious code as familiar, legitimate...
