News · via SecurityWeek
Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.
Malware
Coverage tagged "Malware".
News · via The Record
AOMEI yet to notify customers after hackers hijacked its software updates
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the…
News · via The Hacker News
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and…
News · via The Hacker News
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere…
News · via arXiv cs.CR
LLM Trojans that Increase Response Lengths and Cost
arXiv:2610.24784v1 Announce Type: new Abstract: Management of the token-based costs of using LLMs has emerged as a significant problem. Some frontier-model providers charge five times per response…
News · via BleepingComputer
Hackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to…
News · via The Hacker News
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on…
News · via SecurityWeek
Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.
News · via Emsisoft
Emsisoft Blocks 100% in AVLab’s Latest Advanced In-The-Wild Malware Test
AVLab's September test evaluated 16 products against live in-the-wild malware. Emsisoft blocked all 417 samples and averaged 3.365 seconds from execution attempt to full cleanup.
News · via oss-security
Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10)
Posted by eddyflores100 on Oct 16 Alexander, Fair on both counts, and thank you for verifying the domain state yourself before responding - that is more diligence than the posting deserved in the…
News · via Help Net Security
Fake Arch Linux AUR packages exploit typos to run malware with root privileges
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community…
News · via oss-security
Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10)
Posted by Solar Designer on Oct 15 This looks like an AI slop. Nothing was previously disclosed here, so I assume an LLM hallucinated that. The message looks AI-generated.
News · via oss-security
FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10)
Posted by eddyflores100 on Oct 15 Follow-up: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) Summary for the list: the campaign previously disclosed here (fake…
News · via BleepingComputer
Fake Arch Linux packages push malware with root privileges
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru.
News · via Help Net Security
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features…
News · via Help Net Security
Fake CAPTCHAs are tricking users into running malware on their own devices
Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, malicious browser…
News · via Emsisoft
Emsisoft Anti-Malware for macOS stable release
Emsisoft Anti-Malware for macOS is now officially available in a stable release, supported on all product editions.
News · via The Hacker News
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns…
News · via SecurityWeek
CikaBika Bot RAT Uses Discord for C&C
Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.
News · via SecurityWeek
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.