The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands. [...]
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. [...]
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware. The post Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight appeared first on SecurityWeek .
A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]
In June 2026, Kaspersky discovered malware targeting Android-based car infotainment systems (head units) developed by the Chinese company DoFun. The malware is delivered via the legitimate TWCore system app responsible for firmware updates, which attackers exploit to install a Trojan dropper called JarService without user interaction. JarService decrypts and launches a downloader that connects to a command-and-control server to fetch and execute additional payloads, including a clicker for ad fraud and a module that adds the device to a botnet used as a residential proxy service. The malware consumes system resources, potentially slowing the infotainment system and degrading internet performance. The infection is linked to the MoYu Group threat actor and the BADBOX malicious platform. The developer was informed and addressed the security issues.
Threat actors are abusing FTP server banners to deliver two previously undocumented remote access trojans (RATs) named E4del and PINHOLE. These malware samples are distributed by embedding commands within FTP banners, a technique that leverages the FTP protocol's banner messages to hide malicious payload delivery. The malware targets Windows systems and enables remote access capabilities for attackers.
The Head Mare hacktivist group has been exploiting the bugs to deploy the PhantomCore malware. The post CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities appeared first on SecurityWeek .
A supply-chain attack compromised the maintainer account of the popular Rust crate arrayref, introducing malware that executed during compilation. The attacker also poisoned two other crates, append-only-vec and internment, within a short window. The malicious code included a typosquatted dependency that executed a payload tailored to the host OS, capable of stealing credentials and establishing persistence. The attack affected widely used Rust projects, including cryptography and blockchain tools. The compromised versions were quickly removed from the registry after discovery. Developers who used these versions during the exposure window should assume compromise and take remediation steps.
Manic is a sophisticated Android malware active since at least February 2026, targeting users primarily in Ukraine and multiple European countries. It combines spyware, banking fraud, and remote control capabilities, targeting numerous banking, government/eID, payment, crypto wallet, messaging, and authenticator apps. The malware uses Android Accessibility services to capture sensitive inputs like PINs, passwords, and SMS codes via transparent overlays. Uniquely, it can exfiltrate data through nearby infected devices using Wi-Fi Direct or Bluetooth when direct internet access to its command-and-control server is unavailable, enabling multi-hop data relays. Infection vectors remain unknown, but the malware employs anti-analysis techniques and in-memory payload loading. Users are advised to avoid unofficial APK sources and restrict Accessibility permissions.
UAT-10147 is a sophisticated Chinese-speaking intrusion actor deploying a cross-platform backdoor named SPECTRE targeting IIS and Linux servers. SPECTRE integrates advanced post-exploitation features including process injection, credential theft, anti-analysis, and kernel-level EDR bypass via Bring Your Own Virtual Driver (BYOVD) techniques. The campaign combines SEO fraud monetization with custom malware, open-source tools, and AI-assisted development workflows. The Windows variant of SPECTRE uses runtime API resolution and string encryption to evade static detection and includes a comprehensive command set for system control and persistence. The Linux variant incorporates a kernel rootkit with similar advanced capabilities. The actor also uses in-memory web shells and sophisticated evasion methods. No patch or remediation is indicated in the available data.
Cisco Talos identified a Chinese-speaking cybercrime group, UAT-10147, conducting large-scale attacks against Windows and Linux web servers globally. The group exploits publicly disclosed vulnerabilities to gain initial access and integrates AI-driven tools to automate exploitation, reconnaissance, payload generation, validation, and persistence. Targets include organizations in government, education, media, technology, and gaming sectors across Brazil, Bolivia, China, Canada, and Vietnam. The actor deploys malware for SEO fraud and data theft, using multiple open-source offensive frameworks and privilege escalation tools. The infection chains involve multi-stage scripts that evade detection and establish persistence via backdoors and rogue accounts. Talos assesses this as a financially motivated campaign leveraging semi-autonomous AI orchestration to scale complex intrusions efficiently.
Fnprint is a tool that identifies functions in stripped x86-64 binaries by their runtime behavior rather than byte signatures or control-flow graphs. It microexecutes each function with synthetic inputs, records side effects, and generates behavioral fingerprints to match functions across different builds or optimization levels. This approach is more resilient to recompilation and optimization changes than traditional signature or graph-based methods. Fnprint can also diff two binaries to detect behavioral changes in functions. It currently supports only x86-64 ELF binaries and is open source under the MIT license.
A security researcher gained unauthorized access to a server involved in distributing a modular malware campaign targeting Brazilian users. The malware includes a Trojan with keylogging, desktop capture, shellcode injection, a cryptominer, and a Tor-based command and control infrastructure. The infection chain uses multiple payload layers designed to maintain persistence even if one stage is disrupted. The researcher published a detailed report describing the infection chain and malware components.
MacSync Stealer is a macOS-targeted information stealer that uses rapidly rotating infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate stolen data. It employs social engineering to trick users into executing commands that retrieve and run malicious payloads. The malware collects sensitive information including macOS Keychain data, browser credentials, SSH keys, and files from user directories. Data is staged, compressed, split into chunks, and exfiltrated via HTTP PUT requests to attacker-controlled domains that frequently change. Despite domain rotation, consistent behavioral patterns in network requests, command-line usage, and process execution provide reliable detection and hunting opportunities. Microsoft Defender Experts identified over 30 related domains by correlating these recurring traits across the attack chain. The attack chain includes payload retrieval, command-and-control communication, data collection, staging, exfiltration, and cleanup.
StopAndProtect is a large-scale malware operation abusing thousands of hacked WordPress sites as infrastructure to spread malware, control infected machines, and store stolen data. It uses a multi-stage infection chain initiated by a social engineering ClickFix prompt leading to PowerShell scripts and .NET loaders. The operation includes ransomware, data theft, screen locking, credential stealing, and a chat utility. Operational security failures exposed extensive logs, screenshots, and source code, revealing the scale and tools used. Many compromised WordPress sites are outdated and vulnerable, facilitating the attackers' control. The campaign affects victims globally, with many IPs from the US, Russia, and India. No official patch or fix is applicable as this is a malware campaign leveraging vulnerable third-party sites.
Attackers are exploiting Steam forums by posting malicious PowerShell commands disguised as troubleshooting advice. The command downloads and executes a script that installs a crypto miner (XMRig) on victims' Windows machines. The script mimics a system optimization tool to deceive users and disables antivirus scanning on the miner's folder. The miner hijacks system resources to mine Monero cryptocurrency without user consent, degrading performance and hardware lifespan. The attack relies on social engineering to trick gamers into running the harmful command with administrator privileges.
Storm-0501 is a financially motivated cybercrime group conducting sophisticated ransomware campaigns targeting Microsoft Azure cloud environments. Unlike traditional ransomware that encrypts local endpoints, Storm-0501 hijacks cloud tenants by compromising high-privilege administrative identities, dismantling defensive controls such as resource locks and backups, and weaponizing native cloud tools. This cloud ransomware campaign involves evading detection, exfiltrating data, destroying backups, and demanding ransom payments. Detection requires cloud detection and response (CDR) capabilities that provide full visibility into the attack chain and connect disparate cloud activity logs into a unified threat story. Tenable One Cloud Exposure offers AI-powered threat detection tailored to Storm-0501’s tactics, enabling rapid triage, containment, and recovery actions to mitigate the impact of these attacks.
Anthropic has been conducting tests to identify issues in how AI agents interact with each other. The post Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating Malware appeared first on SecurityWeek .
A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. [...]
A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes. [...]
