Malware Campaigns

2+ day, 16+ hour ago   (629+ words) Mac users seeking AI tools face a malware trap. Attackers are using fake Claude and ChatGPT installers and sponsored search results to push MacSync, a macOS password stealer. The campaign relies on persuasion instead of a software flaw. A visitor…...

2+ day, 18+ hour ago   (593+ words) The campaigns do not require a macOS vulnerability; instead, they abuse user trust by persuading victims to paste attacker-controlled commands into Terminal, sidestepping traditional file-centric protections. However, Russian-language artifacts observed in some samples do not establish attribution to a particular…...

3+ day, 6+ hour ago   (78+ words) scworld.com F5 BIG-IP malware hides web shells in memory to evade detection An In-Depth Guide to Network Security MikroTik routers targeted by active SSH zero-day exploitation Cisco addresses critical vulnerabilities in Nexus 9000 switches and IOS XR HPE patches ArubaOS-CX switches…...

3+ day, 13+ hour ago   (33+ words) varindia.com Infostealers Hijack Claude Sessions See What’s Next in Tech With the Fast Forward Newsletter Nothing to see here - yet When they Tweet, their Tweets will show up here....

3+ day, 23+ hour ago   (565+ words) Basic Tutorials What happened in the Claude attacks? The debate was sparked by the case of Grant De Swardt, an independent AI consultant from East Sussex in the UK, as reported by TechCrunch. De Swardt uses Claude agents professionally to…...

4+ day, 15+ hour ago   (404+ words) Fake Minecraft sites continue distributing WeedHack malware through SEO poisoning and trusted hosting platforms despite disruption of its original C2 infrastructure. Disrupting WeedHack’s command-and-control infrastructure did not stop its distribution. Fake Minecraft client sites and trusted hosting services continued serving the…...

4+ day, 20+ hour ago   (330+ words) A previously documented Shai-Hulud npm supply-chain worm payload has reportedly reappeared after 111 days of inactivity, using the exact same malicious file linked to the May 19 compromise of hundreds of @AntV package versions. The reactivation raises concerns about registry-level malware detection…...

4+ day, 11+ hour ago   (1507+ words) Following the initial investigation, we decided to hunt for similar WebDAV and ordinal-execution patterns in an attempt to recover the full infection chain. Using VirusTotal, we were able to identify a full chain from a second DLL loader named "pf....

4+ day, 16+ hour ago   (448+ words) UPDATED 06:00 EDT / SEPTEMBER 08 2026 Cisco Systems Inc.’s Talos Threat Intelligence group today detailed two ClickFix campaigns that push the technique past the copy-and-paste PowerShell prompt it is known for, one that never touches the operating system at all and one…...

4+ day, 16+ hour ago   (507+ words) Four packages is a small blast radius next to the 639 malicious versions pushed during the May campaign. The significance sits elsewhere. npm rolled out publish-time scanning in July, a control that briefly holds new publications for automated analysis before they…...