Pakistan-based threat actor APT36, also known as Transparent Tribe, has significantly evolved its cyber-espionage capabilities by launching a sophisticated campaign specifically targeting Indian defense personnel through weaponized ZIP files designed to compromise BOSS Linux systems. The malware duo works in tandem to steal sensitive data from infected Windows computers. A dangerous two-stage malware threat, LeakyInjector and LeakyStealer, that targets cryptocurrency wallets and personal browser information explicitly. The malware, an evolved version of “Shai-Hulud,” contains a dangerous feature that threatens to destroy user data if attackers lose… Global malware activity climbed sharply over the past week, with remote access trojans (RATs), information stealers, and loaders all posting significant week-over-week gains, according to threat sample uploads tracked by ANY.RUN. Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers.
One Console, Three Versions The malware on victims’ phones has changed https://dragonsupport-number.com/embedded-systems-programming-mastering-efficient-coding/ little since late 2025, Cleafy said. Its role is “deciding which victims are worth an operator’s time,” the company said. Cleafy has traced nearly 100 deployments of that console since April 2026. RatHat’s operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. These packages have been collectively downloaded 490,000 times, out of which 116,000 occurred in the last 30 days.
Domino’s is warning https://www.athenadesignstudio.com/what-are-the-key-features-of-an-effective-e-commerce-website/ customers by email that their accounts have been compromised in a credential stuffing attack. ASOS customers received a push notification regarding a breach of the company. Ransom notes by n0n ransomware claim to take double extortion to a new level of danger for victims
Hackers steal protective order and foster care records from Arizona courts
Recent campaigns have shown AsyncRAT operators abusing trusted cloud infrastructure such as Cloudflare’s free-tier services and TryCloudflare tunnels to host payload delivery servers, making detection significantly harder for conventional security tools. A sophisticated evolution of the ClickFix social engineering campaign, in which threat actors are now abusing the legitimate Windows utility nslookup.exe to deploy malicious payloads via DNS queries. Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. Revolut customers received phishing texts only days after the digital bank acknowledged disclosing customer data to a government impostor. The malware is typically delivered through phishing email attacks containing malicious attachments or links. The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors.
Beyond typical RAT functions like keylogging and webcam access, newer Xworm builds also incorporate destructive capabilities to deploy stealthy infostealer payloads, file encryption, and distributed denial-of-service (DDoS) features. Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that’s targeting exposed Docker daemons to deploy an open-source artificial intelligence (AI) agent framework called Hermes Agent . The console stores what the malware collects from each phone, including text messages and passwords entered into fake login screens overlaid on banking apps. Unknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe.
Learn malware and hardware security best practices in several areas, including anti-virus and anti-spam. Infostealer malware has quietly become the single most important… Learn where to get relevant threat data for free and how… Building analyst expertise is a race against time that many Security Operations Centers (SOCs) are losing.
Top 10 Malware Threats of the Week
— Software production is accelerating beyond the growth assumptions that shaped many of today’s security controls. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. This week’s threats keep finding leverage in small things that were easy to overlook.
- Global malware activity climbed sharply over the past week,…
- GitLab’s Vulnerability Research team has uncovered a large-scale supply chain attack spreading a destructive malware variant through the npm ecosystem.
- Reverse-proxy adversary-in-the-middle (AiTM) kits like Tycoon2FA, Sneaky2FA, and Evilginx relay credentials and session tokens in real time, bypassing most forms of MFA.
- Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist.
- Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team.
At the same time, phishing delivery has moved well beyond email — attackers deliver link… Phishing for credentials and sessions Modern phishing kits don’t just steal passwords — they intercept live sessions. Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. Snake was the only family among the top ten to decline, dropping two samples to close the week at 93 total uploads, a modest but notable exception amid an otherwise broad surge across nearly every major malware category. Once installed, it grants attackers full remote command execution, keylogging, screen capture, and data exfiltration capabilities. AsyncRAT held the number one position with 211 total uploads and a modest weekly increase of two samples, reflecting its status as one of the most consistently deployed .NET-based remote access trojans in the current threat landscape.
Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge
GitLab’s Vulnerability Research team has uncovered a large-scale supply chain attack spreading a destructive malware variant through the npm ecosystem. Threat actors have begun leveraging Google’s Gemini API to dynamically generate C# code for multi-stage malware, evading traditional detection methods. Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free.
