grep -rl "malware" ./articles
Check Point found fake GitHub projects offering desktop apps for ChatGPT and Claude. The installers inside are genuinely signed. The DLL next to them reads a Telegram profile picture to work out where to call home.
Talos published VOLTA on 31 October. It sends the victim's stolen life to a model and asks for a ranked dossier, and when the model declines it reads the refusal and moves to the next provider in the chain.
Talos published NIK C2 on 29 October. If the operator supplies no key, the implant reads OPENAI_API_KEY from the infected machine, so the inference is billed to the victim and the provider's logs point at the victim.
Days after the leak, an ISO began circulating claiming to be the leaked build. Testers report it is 99.99% empty zeroes padded around roughly 50KB of malware, and that the installer whitelists the entire C: drive in Windows Defender before it runs. The file size was the disguise: 113GB is what a real game looks like.
A 27-year-old Venezuelan national got 96 months in federal prison for a scheme that pried open ATM casings, plugged in a laptop, and told the machine to dispense everything. Over $3.5 million is attributed to him. He is one of 119 people charged in Nebraska alone, and roughly 1,900 of these attacks have been reported since 2020.
McAfee blocked more than 6,300 attempts to reach sites distributing Weedhack, malware posing as popular Minecraft clients. SEO poisoning put the fake pages above the official projects in Google, Bing, Brave and DuckDuckGo, and nearly half the malicious links were hosted on Discord. The payload sets Microsoft Defender exclusions before doing anything else.
MalwareHunterTeam spotted the technique in July and SOCRadar says it is still running. A phishing ZIP drops a shortcut file, the shortcut connects to an FTP server and takes commands from the greeting banner, and either E4del or PINHOLE lands. Novel — and SOCRadar notes that being novel is also what makes it visible.
TrendAI found 14 npm packages posing as calendar utilities and carrying RedC2 4.0, a Linux implant sold on Hack Forums. There is no install hook: the payload launches when the module loads, so one transitive import runs it. The framework's Red Agent turns natural-language prompts into intrusion command sequences.
arrayref has over 245 million downloads. On 20 August a malicious 0.3.7 appeared on crates.io with a dependency impersonating proc-macro2, whose build script fetched a second stage over TLS with certificate validation switched off. Wiz attributes it to a North Korean actor on infrastructure overlaps with two earlier campaigns.
Group-IB's WindRelay pairs a reader on the victim's Android with an emulator at the attacker's terminal, relaying EMV commands over WebSocket in real time. SpyNote installs it silently; the victim is talked into the tap.
GTIG's threat tracker names five PRC-nexus groups, six malware families and a 2FA bypass in an open-source admin tool. The interesting part is why an LLM found it: fuzzers look for crashes, and this was a hardcoded trust assumption.
Infoblox tracked Sable Squirrel across 10,000-plus domains, including former General Electric, Procter & Gamble and Sony developer addresses. 31,000 malware samples talked to the infrastructure. Roughly 65,000 expired domains are re-registered every day.
Shai-Hulud's second wave hit somewhere between 600 and 800 packages depending on who counted. The packages were pulled within days. The credentials it published to public GitHub repos are what produced breaches months later — including Suno's.
'AI Sidebar with DeepSeek, ChatGPT, Claude and more' had 300,000 installs and a 4.6-star rating before Google removed it in January. It returned in August, clean for eleven days, then shipped a 21-line addition.
Unit 42's analysis of Kimwolf v7 describes HTTP/2 floods that mirror real browser behaviour at the protocol and header level. It runs on Android TV boxes with port 5555 open, and resolves its C2 through Ethereum Name Service.
CERT-UA describes UAC-0145 posing as recruiters for a real consulting firm, running Zoom interviews, then handing over a WireGuard config that fails on purpose — so the candidate downloads 'SopraVPN' instead.
Attackers took credentials for a DigitalOcean Spaces bucket that BdThemes' promotional banner fetches JSON from. The plugin source stayed clean. Every admin page load ran the attacker's JavaScript anyway.
Sonatype tracked a campaign flooding npm with 846 packages carrying a multi-stage JavaScript loader. It fingerprints the operating system, fetches a matching payload, and on Windows patches security functions before establishing persistence through a scheduled task.