A new malware masquerading as ClearMic, a legitimate microphone noise suppression application, has been identified. This malicious software is a Remote Access Trojan (RAT) that logs keystrokes, captures screens, hijacks clipboard data, records microphone audio, and exfiltrates this information to a remote server. It also deletes Windows Shadow Copies to hinder file recovery, a behavior typical of ransomware. The malware detects sandbox environments to evade analysis. Users who have installed this malware are advised to disconnect from the internet, run anti-malware tools, and change passwords from a clean device.
Cybercriminals conducted a campaign abusing GitHub, YouTube, and VirusTotal to distribute crypto-stealing malware disguised as legitimate cryptocurrency trading and gambling tools. The malware, targeting Windows and macOS, is a Rust-based clipboard hijacker that replaces copied cryptocurrency wallet addresses with attacker-controlled ones. The campaign used fake GitHub stars, coordinated accounts, inflated download counts, AI-narrated YouTube tutorials, and manipulated VirusTotal feedback to build trust and appear legitimate. Over 5,000 GitHub downloads and more than 44,000 SourceForge downloads were recorded, with significant activity from Pakistan and India. The attackers frequently rotated wallet addresses to evade detection. The campaign demonstrates advanced reputation manipulation techniques to spread malware beyond classic distribution methods.
The entire @mastra npm scope was hijacked, affecting 141 packages including @mastra/core. The attacker did not modify the original source code but added a malicious dependency named easy-day-js, a seemingly benign dayjs clone. The attack exploited semantic versioning by specifying a dependency version range (^1.11.21) while the latest tag pointed to a newer version (1.11.22) containing a malicious postinstall hook. This allowed the malicious code to execute during package installation without immediate detection.
This entry describes a Discord server community focused on binary security research topics such as reverse engineering, binary obfuscation, exploit development, and malware analysis. It is a community resource rather than a security threat or vulnerability. No specific vulnerability, exploit, or attack vector is described.
Remus Stealer is a 64-bit malware-as-a-service infostealer that emerged in 2026 as an evolution of Lumma Stealer. It targets credentials, browser cookies, authentication tokens, and cryptocurrency wallets, with a notable capability to steal active session cookies to bypass multi-factor authentication. The malware employs advanced evasion techniques including EtherHiding, which stores command-and-control addresses in Ethereum smart contracts to evade takedown efforts, and enhanced anti-analysis features such as sandbox DLL checks and honeypot detection. Infection vectors include phishing, fake software downloads, malvertising, fake CAPTCHA campaigns, SEO poisoning, and fake GitHub projects. It targets sectors such as financial services, healthcare, government, technology firms, and managed service providers. No official patch or remediation is indicated, and no known exploits in the wild have been reported yet.
HallWatch is a user-mode detection tool designed to identify indirect syscalls by patching the syscall instruction itself to trigger breakpoints. It targets modern syscall bypass techniques such as Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls that evade traditional user-mode hooks. The tool is currently a research proof-of-concept and aims to provide lightweight syscall detection for system libraries in Windows environments.
This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-06-16 related to malware activity observed through network monitoring. It is an OSINT observation from the CIRCL OSINT Feed with a medium risk level. No specific affected software versions or detailed technical indicators are provided. No known exploits or patches are associated with this IOC.
This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-06-15 related to malware activity. It is an OSINT observation from the CIRCL OSINT Feed with a medium risk threat level. No specific affected software versions or detailed technical indicators are provided. No patch or remediation is available or applicable. The threat is categorized under network activity and external analysis.
This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-06-14 related to malware activity observed via the CIRCL OSINT feed. It is categorized as an external network activity observation with medium risk. No specific affected software versions or detailed technical indicators are provided. No patches or fixes are available, and there are no known exploits in the wild associated with this IOC.
The Sameboy Game Boy Color emulator was flagged as malware by one scanner on VirusTotal, while other antivirus tools including Windows Defender reported it as clean. The detection appears to be a potential false positive reported by a single source on VirusTotal. There is no evidence of confirmed malware behavior or exploitation associated with this file. The discussion originates from a Reddit post in the r/Malware subreddit, with minimal community engagement and no known exploits in the wild.
A malspam infrastructure is distributing a JavaScript backdoor malware targeting various sectors globally, including energy and finance ministries in the CIS region. The campaigns appear financially motivated, aiming at email account compromise and business email compromise. The malicious infrastructure uses two bulletproof hosting networks: GHOSTYNETWORKS (a rebrand of OPTIBOUNCE linked to AnonRDP) and OMEGATECH (associated with Virtualine). These networks provide resilient hosting for both spam sending IPs and command-and-control servers. Historical analysis shows this threat actor has been active since late 2025 with related malspam and malware operations supported by similar bulletproof hosting services.
This entry reports an Indicator of Compromise (IOC) related to Maltrail dated 2026-06-13. It is categorized as malware and is based on open-source intelligence (OSINT) from the CIRCL OSINT Feed. No specific affected software versions or detailed technical indicators are provided. There is no known exploit in the wild and no patch or remediation is applicable.