The Harvester APT group has developed a highly-evasive Linux version of its GoGra backdoor that leverages Microsoft Graph API and Outlook mailboxes as a covert command-and-control channel to bypass traditional network defenses. Initial VirusTotal submissions originated from India and Afghanistan, indicating these regions as primary targets. The attackers use social engineering with tailored decoy documents masquerading as legitimate files, including references to Indian food delivery services. The backdoor uses hardcoded Azure AD credentials to poll mailboxes every two seconds, executing commands received via email and exfiltrating results back to operators. Analysis confirms this Linux variant shares nearly identical code with a previously known Windows version, including matching spelling errors, demonstrating the group's multi-platform development strategy and continued expansion of capabilities targeting South Asia for espionage purposes.
A new variant of the LOTUSLITE backdoor, version 1.1, has been identified targeting India's banking sector and South Korean diplomatic circles. The backdoor is delivered via DLL sideloading using legitimate Microsoft-signed executables and initially through CHM files containing malicious JavaScript. It communicates with dynamic DNS-based command-and-control servers over HTTPS, supporting remote shell access, file operations and session management. Code-level analysis reveals direct lineage to LOTUSLITE v1.0, including identical command structures, shared persistence mechanisms, and residual exports from the original codebase. The campaign demonstrates incremental improvements including updated magic values, API resolution techniques, and delivery mechanisms evolving from CHM-based to JavaScript loaders to DLL sideloading. Infrastructure hosted under Dynu Systems shows continuity with previous operations.
A newly uncovered campaign abuses the Trillion (formerly Trellian) AdTech network, mimicking the flow of a Traffic Direction System (TDS) to trick visitors of typo-squatted domains into downloading Microsoft Store apps that contain browser hijacking malware. While the abuse of AdTech networks to deliver malware isn’t new, this campaign highlights incredibly similar tactics to VexTrio and previous TDS networks; further blurring the line between AdTech and malicious TDS systems.
The DarkSword exploit kit has been used by both state-sponsored hackers and commercial spyware vendors. The post Apple Rolls Out DarkSword Exploit Protection to More Devices appeared first on SecurityWeek .
The CrystalX Remote Access Trojan (RAT) is a newly identified malware capable of spying on victims, stealing sensitive information, and modifying device configurations. Although it is described as sophisticated, there are currently no known exploits in the wild and no specific affected software versions have been identified. The malware's capabilities suggest it targets confidentiality and integrity by enabling unauthorized surveillance and data theft. The threat is assessed as medium severity due to the lack of widespread exploitation and limited technical details. Organizations should monitor for unusual device behavior and implement strong endpoint detection measures. Countries with significant use of Windows-based systems and high-value targets in sectors like finance, government, and critical infrastructure are most at risk. Proactive threat hunting and network segmentation can help mitigate potential impacts. Immediate patching recommendations are unavailable, so focus should be on detection and containment strategies.
Today, most malware are called “fileless” because they try to reduce their footprint on the infected computer filesystem to the bare minimum. But they need to write something… think about persistence. They can use the registry as an alternative storage location.
The new CrystalX remote access Trojan combines pranks with full control over the victim’s computer. It also spies on its victims, steals their cryptocurrency and accounts, and uses advanced methods to bypass protection. We explain how it works, and how to avoid infection.
DeepLoad is a newly identified malware involved in ClickFix attacks that primarily steals user credentials, installs malicious browser extensions, and propagates through USB drives. It leverages social engineering or phishing to infect systems, then harvests sensitive information and potentially facilitates further compromise via browser manipulation. The malware’s ability to spread via removable media increases its risk of lateral movement within organizations. Although no known exploits are currently reported in the wild, the malware’s credential theft and persistence mechanisms pose a significant threat to confidentiality and integrity. Exploitation does not appear to require advanced privileges or complex exploits, but likely involves user interaction such as opening malicious attachments or USB devices. Organizations with high reliance on browser-based workflows and removable media are particularly vulnerable. Mitigation requires targeted controls including endpoint detection, strict USB device policies, and monitoring for unusual browser extension installations. Countries with large enterprise sectors and high internet usage, especially in North America, Europe, and parts of Asia, are most at risk. Given the malware’s impact on credential security and propagation ease, the threat severity is assessed as high.
The FBI has issued a warning about data security risks associated with mobile applications developed in China, highlighting concerns over potential unauthorized data access and privacy violations. Although specific apps were not named, popular applications like TikTok and Temu are implied as examples. These apps may collect extensive user data, which could be accessed or exploited by foreign entities, raising national security and privacy concerns. The threat primarily targets mobile users globally, with a focus on apps that have significant user bases and data collection capabilities. Exploitation does not require known vulnerabilities but stems from inherent risks in data handling and potential government influence over app developers. The FBI's warning underscores the need for organizations and individuals to scrutinize the apps they use, especially those originating from jurisdictions with adversarial geopolitical relations. Mitigation involves restricting or monitoring the use of such apps within sensitive environments, implementing strict data access controls, and enhancing user awareness. Countries with high adoption rates of these apps and strategic geopolitical tensions with China are at greater risk. The threat is assessed as medium severity due to the potential impact on confidentiality and privacy, moderate ease of exploitation through data collection practices, and the broad scope of affected users without requiring direct exploitation of software vulnerabilities.
Google Threat Intelligence Group (GTIG) is tracking an active software supply chain attack targeting the popular Node Package Manager (NPM) package "axios." Between March 31, 2026, 00:21 and 03:20 UTC, an attacker introduced a malicious dependency named "plain-crypto-js" into axios NPM releases versions 1.14.1 and 0.30.4. Axios is the most popular JavaScript library used to simplify HTTP requests, and these packages typically have over 100 million and 83 million weekly downloads, respectively. This malicious dependency is an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.
Elastic Security Labs identified a supply chain compromise of the axios npm package, one of the most depended-upon packages in the JavaScript ecosystem with approximately 100 million weekly downloads. The attacker compromised a maintainer account and published backdoored versions that delivered a cross-platform Remote Access Trojan to macOS, Windows, and Linux systems through a malicious postinstall hook.
Xloader is an information stealing malware family that evolved from Formbook and targets web browsers, email clients, and File Transfer Protocol (FTP) applications. Additionally, Xloader may execute arbitrary commands and download second-stage payloads on an infected system. The author of Xloader continues to update the codebase, with the most recent observed version being 8.7. Since version 8.1, the Xloader developer applied several changes to the code obfuscation. The purpose of this blog is to describe the latest obfuscation methods and provide an in-depth analysis of the network communication protocol. We highly recommend reading our previous blogs about Xloader in order to get a better understanding of the malware’s internals.
This multi-stage fileless Remcos RAT attack leverages a phishing-delivered JavaScript dropper to trigger a reflective PowerShell loader that executes payloads entirely in memory. The infection chain utilizes obfuscation techniques like rotational XOR and Base64 encoding to reconstruct .NET payloads, significantly reducing the disk-based detection footprint. Stealth is maintained by using aspnet_compiler.exe as a LOLBin to proxy malicious execution and dynamically retrieving the final payload from a remote C2 server.
On March 31, NSFOCUS CERT detected that the npm repository of the HTTP client library Axios was poisoned by the supply chain. The attacker bypassed the normal GitHub Actions CI/CD pipeline of the project, changed the account email address of the axios maintainer to an anonymous ProtonMail address, and manually released a malicious version with a Trojan backdoor through the npm CLI. When the user installs it, a persistent remote control will be established on the host. The impact is wide-ranging, and relevant users are requested to take measures for investigation and protection as soon as possible.
The Axios NPM package was compromised through a supply chain attack attributed to North Korean threat actors. Attackers exploited a long-lived NPM access token to bypass GitHub Actions' OIDC-based CI/CD publishing workflow, enabling them to push backdoored versions of the package. This breach allows malicious code to be distributed to developers and applications relying on Axios, a widely used HTTP client library in JavaScript environments. Although no known exploits in the wild have been reported yet, the potential for widespread impact exists due to Axios's extensive use in web and mobile applications. The attack highlights vulnerabilities in CI/CD pipeline security and token management. Mitigation requires immediate revocation of compromised tokens, strengthening CI/CD authentication mechanisms, and vigilant monitoring of package integrity. Countries with significant software development sectors and heavy reliance on JavaScript ecosystems, including the United States, India, Germany, South Korea, Japan, and the United Kingdom, are most at risk. Given the ease of exploitation and potential for supply chain compromise, the severity is assessed as high despite the current low severity rating. Defenders must prioritize securing CI/CD workflows and verifying package authenticity to prevent similar attacks.
In March 2026, a new MaaS active campaign was discovered promoting previously unknown malware in private Telegram chats. The Trojan features an extensive arsenal of capabilities. On the panel provided to third‑party actors, in addition to the standard features of RAT‑like malware, a stealer, keylogger, clipper, and spyware are also available.
A sophisticated malware campaign targeting WhatsApp users has been observed since February 2026. The attack chain begins with malicious Visual Basic Script files sent via WhatsApp messages, which, when executed, initiate a multi-stage infection process. The malware uses renamed Windows utilities, retrieves payloads from trusted cloud services, and installs malicious MSI packages. The campaign employs social engineering, stealth techniques, and cloud-based payload hosting to establish persistence and escalate privileges on victim systems. The attackers utilize legitimate tools and trusted platforms to reduce visibility and increase the likelihood of successful execution. The final stage involves the delivery of unsigned MSI installers that enable remote access to compromised systems.
A coordinated supply chain attack targeted the axios npm package, compromising two versions (1.14.1 and 0.30.4) by injecting a malicious dependency. The attack delivered a cross-platform Remote Access Trojan to macOS, Windows, and Linux systems. The compromise occurred through the lead maintainer's npm account, bypassing normal publishing workflows. The malicious payload performed system reconnaissance, established persistence on Windows, and provided remote access capabilities. The attack affected numerous organizations and potentially exposed sensitive credentials. Immediate mitigation steps include pinning to safe versions, removing malicious dependencies, rotating credentials, and blocking the command and control server.
EvilTokens is a new Phishing-as-a-Service offering a turnkey Microsoft device code phishing kit. It enables attackers to harvest access and refresh tokens, granting unauthorized access to victims' Microsoft accounts. The kit supports post-compromise operations, allowing data exfiltration from various Microsoft services. EvilTokens has been rapidly adopted by cybercriminals since March 2026, impacting organizations globally. The service provides advanced capabilities for account takeover, including token conversion to Primary Refresh Tokens and browser cookies for persistent access. Phishing campaigns using EvilTokens target employees in finance, HR, logistics, and sales, primarily for Business Email Compromise attacks.
