MalwareTips Newswire

Security updates, independent AV tests and useful news for the MalwareTips community.
Everything in one placeAll security news, as it happensMalwareTips articles, community discussions and the security industry, newest first.
Industry
Image from Security Affairs for SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 116
Security AffairsMalware & threats

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 116

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign   Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO   ChainScript: Tracing a Node.js RAT […]
Read at Security Affairs
Industry
Industry
Industry
Image from Security Affairs for Security Affairs newsletter Round 597 by Pierluigi Paganini – INTERNATIONAL EDITION
Security AffairsMalware & threats

Security Affairs newsletter Round 597 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. OpenAI Agents Accessed US Government Websites Without Authorization Exploit.in Database Reveals the Roots of Today’s Ransomware Ecosystem […]
Read at Security Affairs
Industry
Image from The Hacker News for Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
The Hacker NewsMalware & threats

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploited in the wild, security firm watchTowr said on September 26. Citrix has not confirmed the flaws or published a fix. Some administrators say they have taken appliances offline rather than wait for one to be available. NetScaler ADC and
Read at The Hacker News
Newswire
Industry
Image from Security Affairs for Exploit.in Database Reveals the Roots of Today’s Ransomware Ecosystem
Security AffairsMalware & threats

Exploit.in Database Reveals the Roots of Today’s Ransomware Ecosystem

Exploit.in data shows how a 2005 cybercrime forum helped shape today’s ransomware ecosystem, with users and practices surviving for decades. Ransomnews researcher Dancho Danchev dug up a database dump of Exploit.in covering its first three years, from February 2005 to May 2008, and the numbers inside it tell a story about Russian cybercrime that enforcement […]
Read at Security Affairs
Industry
Industry
Image from The Hacker News for Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
The Hacker NewsMalware & threats

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8.8 out of 10.0. It only affects versions
Read at The Hacker News
Industry
Industry
Industry
Industry
Industry
Image from SecurityWeek for In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
SecurityWeekMalware & threats

In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure

Noteworthy stories that might have slipped under the radar: BragJack attack against browser AI assistants, TDengine flaw threatens industrial telemetry uptime, Ubuntu update overhaul. The post In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure appeared first on SecurityWeek.
Read at SecurityWeek Join the MalwareTips discussion
Industry
Industry
Image from The Hacker News for Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
The Hacker NewsMalware & threats

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this
Read at The Hacker News
Industry
Image from Security Affairs for ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer
Security AffairsMalware & threats

ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer

Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials. Psychedelic Stealer is being distributed through compromised Ukrainian business websites. Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors. The affected sites included a hair-treatment […]
Read at Security Affairs
Industry
Industry
Image from The Hacker News for PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
The Hacker NewsMalware & threats

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embedded their payload key material
Read at The Hacker News
Industry
Industry
Image from The Hacker News for The SOC Doesn't Need to Start Over with Every Alert
The Hacker NewsMalware & threats

The SOC Doesn't Need to Start Over with Every Alert

Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry. The routine version looks like this. An attacker lands on a low-privilege cloud account, and the first try at privilege escalation goes nowhere. That dead end used to cost hours of documentation reading,
Read at The Hacker News
Industry
Schneier on Security
Schneier on SecurityMalware & threats

On Anthropic’s AI Misuse Report

Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs. The report describes attackers using AI to industrialize credential theft, cloud compromise, phishing, vulnerability research, and the extraction of sensitive data from downstream organizations. ...
Read at Schneier on Security
Industry
Image from Security Affairs for AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
Security AffairsMalware & threats

AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

CARBONATO exploits exposed Docker daemons, installs an AI agent, steals API keys and spreads across networks with autonomous command execution. CARBONATO is a Docker-based botnet that has been active since at least October 2024. ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet. The registry contained the attackers’ entire toolchain […]
Read at Security Affairs
Industry
Back
Top