Operation Endgame malware takedown hits Gootloader, CastleRAT and StealC, seizing 235 servers and finding over 6 million stolen credentials.

Malware peddlers are using sponsored Google results to push a malicious ChatGPT Custom GPT named "Plus 5.6".

A simple phishing email now delivers DarkMe RAT, as attackers swap costly zero-day exploits for high-volume attacks on corporate targets.

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan (RAT) called Spark RAT. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government notices, public health materials, real estate-related content, and other topics," Acronis Threat

The China-linked cybercrime group known as Silver Fox has been attributed to a new Rust-based remote access trojan (RAR) called MODBEACON. Chinese cybersecurity company QiAnXin said that while the threat cluster may appear like a low-sophistication, high-activity operation that propagates malware via counterfeit installers using SEO poisoning techniques, it belies their true organizational

Op 31 maart 2026 ontdekte StepSecurity twee kwaadaardige versies van axios, een veelgebruikte JavaScript-bibliotheek. De aanvaller hackte het npm-account van een hoofdontwikkelaar. Daarna publiceerde hij ... Lees verder

YouTube video by Bellular News

Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. "LabubaRAT creates a reusable foothold for hands-on activity," Blackpoint Cyber researchers Sam Decker and Nevan Beal said in an analysis published today. "Once deployed, it can profile the host,

An unknown threat actor cloned the CERT-UA website and sent phishing emails distributing a password‑protected archive that installed AGEWHEEZE, a Go‑based remote access trojan. The campaign—claimed by CyberSerp and using OVH‑hosted WebSocket C2 infrastructure—was largely unsuccessful according to CERT‑UA, which published IOCs and mitigation guidance. #CERT-UA #AGEWHEEZE...