Attackers are leveraging the trusted reputation of Foxit PDF Reader, used by over 650 million people, to distribute malicious installers disguised as legitimate software. Rather than exploiting vulnerabilities, threat actors impersonate the vendor through fake installers with document-themed filenames that bypass user suspicion. When executed, these files display decoy passport images while downloading malicious MSI packages that deploy UltraVNC remote access tools disguised as GPU drivers. The attack establishes persistence through registry modifications and firewall exceptions, connecting to attacker-controlled infrastructure for complete remote system control. Telemetry indicates broad distribution across Germany, the United States, the United Kingdom, and Ukraine. This campaign demonstrates how brand impersonation combined with social engineering proves more effective than technical exploits, relying on user trust and behavioral patterns rather than software vulnerabilities.
A newly uncovered campaign abuses the Trillion (formerly Trellian) AdTech network, mimicking the flow of a Traffic Direction System (TDS) to trick visitors of typo-squatted domains into downloading Microsoft Store apps that contain browser hijacking malware. While the abuse of AdTech networks to deliver malware isn’t new, this campaign highlights incredibly similar tactics to VexTrio and previous TDS networks; further blurring the line between AdTech and malicious TDS systems.
The DarkSword exploit kit has been used by both state-sponsored hackers and commercial spyware vendors. The post Apple Rolls Out DarkSword Exploit Protection to More Devices appeared first on SecurityWeek .
Endpoint detection and response (EDR) tools are widely deployed and far more capable than traditional antivirus. As a result, attackers use EDR killers to disable or bypass them. The malicious “msimg32.dll” used in Qilin ransomware attacks, which is a multi-stage infection chain targeting EDR systems. It can terminate over 300 different EDR drivers from almost every vendor in the market.
In January 2026, Nacogdoches Memorial Hospital experienced a data breach where a threat actor infiltrated the hospital's internal network and exfiltrated personal and health information of approximately 250,000 individuals. The breach involved unauthorized access to sensitive patient data, potentially including medical records and personally identifiable information (PII). No specific vulnerability or exploit details have been disclosed, and no known exploits are reported in the wild. The incident highlights risks associated with healthcare network security and data protection. Organizations handling sensitive health data should review their network defenses and incident response plans. The breach underscores the importance of robust access controls, network segmentation, and continuous monitoring in healthcare environments. Given the medium severity and lack of detailed technical information, the threat primarily impacts confidentiality and privacy. Healthcare providers globally should be vigilant against similar attacks targeting patient data. Mitigation should focus on strengthening internal network security, employee training, and rapid detection of intrusions.
Mercor, an AI recruiting firm, suffered a supply chain attack involving the LiteLLM component, resulting in the theft of approximately 4TB of data as claimed by the Lapsus$ threat group. The incident highlights risks associated with third-party AI software dependencies in recruitment technology. Although no known exploits are currently active in the wild, the breach could expose sensitive candidate and corporate information, impacting confidentiality and trust. The attack underscores the importance of securing supply chains, especially for AI-driven platforms handling personal data. Organizations relying on similar AI recruiting tools should be vigilant and assess their exposure to LiteLLM or related components. Mitigation requires thorough supply chain audits, enhanced monitoring of third-party software, and rapid incident response capabilities. Countries with significant AI technology adoption and recruitment sector reliance, such as the United States, United Kingdom, Germany, Canada, Australia, and South Korea, are most at risk. Given the medium severity rating, the threat poses a moderate risk primarily to confidentiality with limited immediate availability or integrity impact. No authentication or user interaction is required for exploitation, but the attack vector is indirect via supply chain compromise.
The CrystalX Remote Access Trojan (RAT) is a newly identified malware capable of spying on victims, stealing sensitive information, and modifying device configurations. Although it is described as sophisticated, there are currently no known exploits in the wild and no specific affected software versions have been identified. The malware's capabilities suggest it targets confidentiality and integrity by enabling unauthorized surveillance and data theft. The threat is assessed as medium severity due to the lack of widespread exploitation and limited technical details. Organizations should monitor for unusual device behavior and implement strong endpoint detection measures. Countries with significant use of Windows-based systems and high-value targets in sectors like finance, government, and critical infrastructure are most at risk. Proactive threat hunting and network segmentation can help mitigate potential impacts. Immediate patching recommendations are unavailable, so focus should be on detection and containment strategies.
Today, most malware are called “fileless” because they try to reduce their footprint on the infected computer filesystem to the bare minimum. But they need to write something… think about persistence. They can use the registry as an alternative storage location.
Active since September 2025, Yurei is a double extortion ransomware campaign. The operators run their own Tor data leak site with a low number of victims listed at the time of writing. It is reportedly derived from Prince Ransomware, an open-source ransomware family written in Go. Check Point researchers noted that all samples were first submitted to VirusTotal from Morocco, and that one sample did not include a ticket ID, indicating that this could be a test build, possibly uploaded by the developer themselves. Yurei ransomware samples also contained a link to SatanLockv2, based on the presence of the PDB path string “D:\satanlockv2” present in the Yurei samples.
Hasbro, a major toy manufacturer, has been targeted by a cyberattack currently under investigation. The company is assessing the full extent of the incident, including whether any sensitive files or data have been compromised. No specific technical details, attack vectors, or exploited vulnerabilities have been disclosed yet. There are no known exploits in the wild related to this incident at this time. The severity is currently assessed as medium based on limited information. Organizations should monitor for updates and review their security posture, especially those in the toy and manufacturing sectors. The attack highlights the ongoing risk of cyber threats to large consumer goods companies. Immediate containment and forensic analysis are critical to understand the breach scope. This incident may have implications for supply chain security and customer data protection. Defenders should prioritize incident response readiness and data protection strategies.
The new CrystalX remote access Trojan combines pranks with full control over the victim’s computer. It also spies on its victims, steals their cryptocurrency and accounts, and uses advanced methods to bypass protection. We explain how it works, and how to avoid infection.
DeepLoad is a newly identified malware involved in ClickFix attacks that primarily steals user credentials, installs malicious browser extensions, and propagates through USB drives. It leverages social engineering or phishing to infect systems, then harvests sensitive information and potentially facilitates further compromise via browser manipulation. The malware’s ability to spread via removable media increases its risk of lateral movement within organizations. Although no known exploits are currently reported in the wild, the malware’s credential theft and persistence mechanisms pose a significant threat to confidentiality and integrity. Exploitation does not appear to require advanced privileges or complex exploits, but likely involves user interaction such as opening malicious attachments or USB devices. Organizations with high reliance on browser-based workflows and removable media are particularly vulnerable. Mitigation requires targeted controls including endpoint detection, strict USB device policies, and monitoring for unusual browser extension installations. Countries with large enterprise sectors and high internet usage, especially in North America, Europe, and parts of Asia, are most at risk. Given the malware’s impact on credential security and propagation ease, the threat severity is assessed as high.
The FBI has issued a warning about data security risks associated with mobile applications developed in China, highlighting concerns over potential unauthorized data access and privacy violations. Although specific apps were not named, popular applications like TikTok and Temu are implied as examples. These apps may collect extensive user data, which could be accessed or exploited by foreign entities, raising national security and privacy concerns. The threat primarily targets mobile users globally, with a focus on apps that have significant user bases and data collection capabilities. Exploitation does not require known vulnerabilities but stems from inherent risks in data handling and potential government influence over app developers. The FBI's warning underscores the need for organizations and individuals to scrutinize the apps they use, especially those originating from jurisdictions with adversarial geopolitical relations. Mitigation involves restricting or monitoring the use of such apps within sensitive environments, implementing strict data access controls, and enhancing user awareness. Countries with high adoption rates of these apps and strategic geopolitical tensions with China are at greater risk. The threat is assessed as medium severity due to the potential impact on confidentiality and privacy, moderate ease of exploitation through data collection practices, and the broad scope of affected users without requiring direct exploitation of software vulnerabilities.
Google Threat Intelligence Group (GTIG) is tracking an active software supply chain attack targeting the popular Node Package Manager (NPM) package "axios." Between March 31, 2026, 00:21 and 03:20 UTC, an attacker introduced a malicious dependency named "plain-crypto-js" into axios NPM releases versions 1.14.1 and 0.30.4. Axios is the most popular JavaScript library used to simplify HTTP requests, and these packages typically have over 100 million and 83 million weekly downloads, respectively. This malicious dependency is an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.
Elastic Security Labs identified a supply chain compromise of the axios npm package, one of the most depended-upon packages in the JavaScript ecosystem with approximately 100 million weekly downloads. The attacker compromised a maintainer account and published backdoored versions that delivered a cross-platform Remote Access Trojan to macOS, Windows, and Linux systems through a malicious postinstall hook.
Xloader is an information stealing malware family that evolved from Formbook and targets web browsers, email clients, and File Transfer Protocol (FTP) applications. Additionally, Xloader may execute arbitrary commands and download second-stage payloads on an infected system. The author of Xloader continues to update the codebase, with the most recent observed version being 8.7. Since version 8.1, the Xloader developer applied several changes to the code obfuscation. The purpose of this blog is to describe the latest obfuscation methods and provide an in-depth analysis of the network communication protocol. We highly recommend reading our previous blogs about Xloader in order to get a better understanding of the malware’s internals.
This multi-stage fileless Remcos RAT attack leverages a phishing-delivered JavaScript dropper to trigger a reflective PowerShell loader that executes payloads entirely in memory. The infection chain utilizes obfuscation techniques like rotational XOR and Base64 encoding to reconstruct .NET payloads, significantly reducing the disk-based detection footprint. Stealth is maintained by using aspnet_compiler.exe as a LOLBin to proxy malicious execution and dynamically retrieving the final payload from a remote C2 server.
