News · via BleepingComputer
PoeLLM malware infects exposed AI servers in cryptomining attacks
A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads.
Malware
Coverage tagged "Malware".
News · via Help Net Security
Tanium adds endpoint behavior detection and AI-assisted threat hunting
Tanium has relaunched Tanium Security Operations to address AI-assisted attacks in which adversaries use legitimate administrative tools to blend into normal activity and spread across endpoints. The…
News · via DataBreaches.net
Alleged ATM malware creator appears in Nebraska court after arrest
Jonathan Greig reports: The alleged mastermind behind a strain of malware used to empty ATMs of millions of dollars appeared in court for the first time after being apprehended by federal…
News · via Help Net Security
Anthropic loosens Claude’s cyber restrictions for verified defenders
Anthropic expanded its Cyber Verification Program (CVP), giving approved security professionals access to advanced Claude capabilities with fewer automated blocks on work such as malware analysis and…
News · via The Hacker News
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware…
News · via arXiv cs.CR
From Sandbox to Enforcement: Confidence-Qualified Threat Intelligence for Critical Infrastructure
arXiv:2610.07310v1 Announce Type: new Abstract: Security operations centres and national incident-response teams defending critical infrastructure collect abundant threat data yet struggle to turn it…
News · via Halcyon
The AI Malware Panic Has a Measurement Problem
Of 405 AI malware samples in one vendor study, only 12 ever reached a real network. Here's the test that cuts through the AI malware panic.
News · via The Record
Alleged ATM malware creator appears in Nebraska court after arrest
Aguirre was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March, becoming the first cybercriminal added to the list.
News · via SecurityWeek
FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026.
News · via SecurityWeek
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign.
News · via Group-IB
From Detonation to Detection: The Sandbox Now Writes the Rules
Understanding what a malware sample does and being able to detect it are two different jobs, and the second one needs a skill many teams are short of. The Group-IB Malware Detonation Platform now…
News · via arXiv cs.CR
GrayShield: Bit-Level Sanitization for Transformer Model Supply-Chain Security
arXiv:2610.04319v1 Announce Type: new Abstract: Transformer models such as BERT and Vision Transformer~(ViT) achieve strong performance via densely parameterized attention backbones. However, the…
News · via BleepingComputer
Alleged dev of Ploutus ATM malware appears in US court after arrest
The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States.
News · via Security Affairs
Fake Zoom installer hides macOS backdoor CloudSyncD
Jamf Threat Labs details CloudSyncD, a fake macOS Zoom installer that hides a phished password using invisible zero-width Unicode characters. Jamf Threat Labs found CloudSyncD while doing routine…
News · via Help Net Security
AI is giving attackers a head start, Microsoft warns
Threat actors are using AI to find bugs, build malware and run intrusions faster than defenders can keep up. Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, describes a…
News · via arXiv cs.CR
Characterizing and Codifying Malware Sophistication
arXiv:2610.00098v1 Announce Type: new Abstract: 'Sophisticated' is widely used to describe malware, yet it lacks a consistent definition within academic literature. While existing software quality…
News · via Group-IB
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace clandestino único, mejorado con…
News · via BleepingComputer
Microsoft says threat actors are ahead in the early AI race
Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and…
News · via The Hacker News
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to…
News · via SecurityWeek
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network
The US government continues its crackdown on Tren de Aragua over its ATM jackpotting scheme.