Wired has the story of a superuser cheating scandal.

Rank Math PRO was compromised in a supply chain attack affecting certain version 3.0.123 downloads in October 2026. Discover how the malware works, the risks to WordPress websites, and the essential steps to secure compromised installations.

Likeliest path into LiteLLM servers was a bug with a fix since April.

https://www.osintinvestigate.com A major cybersecurity incident involving Brevo exposed more than 100,000 websites to malicious code. In this episode, we examine how attackers compromised Brevo, abused a long-lived Cloudflare API key, and used a malicious Cloudflare Worker to inject scripts into Brevo services and JavaScript assets embedded by customers. The attack also involved ClickFix social engineering and attempts to install malicious WordPress plugins when administrators visited affected websites. We explain the September 2026 timeline, how the attack worked, why supply chain compromises can have such a wide impact, and what website administrators should check after the incident.

A routine connection to hotel Wi-Fi can end in the theft of corporate email, passwords, and sensitive files - all before the traveler ever clicks a suspicious link. In the CaptiveCrunch campaign, threat actors compromise guest network gateways and redirect connected devices to phishing pages or malware-serving infrastructure. Scope and Timeline of the Campaign Attacks against Wi-Fi networks began in early May 2026 and have since affected multiple countries.

YouTube video by ReconBee

Private companies and international authorities have disrupted a malicious “assembly line” that let hackers steal millions of login details and theft of $47 million in ransom payments via extortion. The operation aimed at catching two tools that are used in online scams. The first tool is called Amadey, a malware-as-a-service platform for disrupting devices and deploying infected payloads for ransomware and related attacks. Amadey was first discovered in 2018 and in 2025, it exploited GitHub as it stored system info from malicious devices and deployed custom payloads. The second tool is called StealC, it is an infostealer-as-a-service tool that steals cryptocurrency wallets, browser extensions, authentication cookies, and login credentials. Disrupting a crucial link in the cyberattacks chain Amadey and StealC are distinct tools that function autonomously. They are widely used, but many people use them in their personal cybercrime operations.  The tools depend on the same infrastructure to function. Microsoft made this link after analyzing the tools using AI. The discovery allowed Microsoft to stop both tools simultaneously. “This action goes after the cybercrime ‘assembly line,’ where coordinated tools drive ransomware, financial fraud, and disruptions to public services. Amadey and StealC are often used alongside each other: Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information. Together, they form a critical link in the chain,” Microsoft said. About the investigation Companies gathered proof that the tools shared the same infrastructure and invoked RICO statutes against organized crime. This resulted in treating the two tools as part of a single scam.  Microsoft has disrupted over 200 C2 servers and shut down criminal control of over 18,000 compromised computers. Europol also assisted in the operation to track down the culprits and recovered around 27 million stolen login details and found $47 million worth of crypto assets tied to cybercriminals. “During this action, 326 servers and 142 domains were actioned by law enforcement and the private sector partners, severely crippling the malware’s distribution network. By taking down these tools simultaneously, the collaboration between law enforcement and private parties has increased friction for cybercriminals, making it harder for attacks to succeed, spread, or recover,”  Europol said. Operation Endgame Other firms that helped in “Operation Endgame” are ESET, IBM X-Force, ESET, Mitsui Bussan Secure Directions, and Bitsight.  According to Europol, another tool that disrupted Operation Endgame was SocGholish. It is a malware installer tied to the Russian cybercrime group Evil Corp. that distributes via hacked websites. If you visit such sites, you will be tricked into installing malware apps mimicking as browser extensions or genuine software.  

A malware URL scanner has become an essential security tool as cybercriminals continue to refine their phishing tactics and malware delivery methods. Researchers recently uncovered a sophis...

executes a command to start an MSBuild project read more about New Avalon Malware Framework Packs CrownX Ransomware Capabilities

how it spreads, the damage it causes and you will get complete information about What is Malware ? Its Types and How to Prevent It

A supply chain attack has trojanized DAEMON Tools installers (versions 12.5.0.2421–12.5.0.2434) distributed from the official site and signed with legitimate developer certificates, activating an implant when DTHelper.exe, DiscSoftBusServiceLite.exe, or DTShellHlp.exe run. The implant contacts env-check.daemontools[.]cc to fetch commands that download and execute payloads including envchk.exe, a shellcode loader (cdg.exe/cdg.tmp), and a...

Ukrainian police in Lviv arrested three suspects who hacked over 610,000 Roblox accounts and sold them for about $225,000. Authorities seized cash and multiple devices after searches and say the group used info‑stealing malware disguised as a game‑enhancer to harvest credentials, targeting at least 357 elite accounts. #Roblox #Robux

compromise is currently unknown read more about JanelaRAT Malware Targets Latin American Banks with 14739 Attacks in Brazil in 2025

CPUID, maker of CPU-Z and HWMonitor, was compromised via a secondary API that redirected legitimate update requests to a malicious domain for about six hours between April 9 and April 10, delivering a trojanized installer. The multi-stage, in-memory info-stealer used a fake CRYPTBASE.dll and shared infrastructure with a prior FileZilla campaign;...

Pawn Storm (APT28/Fancy Bear) has escalated operations in early 2026 by deploying a coordinated malware suite called PRISMEX to disrupt Ukrainian defense and Western military aid infrastructure. Trend Micro finds the campaign exploits CVE-2026-21513 and CVE-2026-21509, leverages advanced steganography, fileless techniques, COM hijacking, and Filen.io for C2 to strike NATO logistics...

probably in an effort to trick security tools read more about DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

A fake Avast-branded website performs a staged “virus scan” that prompts users to download a malicious file (Avast_system_cleaner.exe) which is actually Venom Stealer, a data-stealing payload that harvests browser credentials, session cookies, and cryptocurrency wallet data. The malware masquerades as a Chrome service (v20svc.exe), is packed with a crypter to evade...

Threat actors used SEO poisoning to place fake KakaoTalk download pages at the top of search results and distributed a malicious installer that infected over 5,000 PCs. The installer uses an invalid NetEase signature, decrypts and drops components (Verifier.exe, AutoRecoverDat.dll, GPUCache.xml/GPUCache2.xml) to establish persistence, add Windows Defender exclusions, and connect to...

how the attack is carried out read more about GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos

considered distribution strategies read more about Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

AdvancedProtectionManager API read more about Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse

malware families the researchers discovered read more about Chinese state hackers target telcos with new malware toolkit

infrastructure to stage harmful payloads read more about Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

Passaic County, N.J., says malware hit IT systems, taking county phone lines down. Officials working with state and federal partners.