29 casos · pág. 2/2
Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attacke…
Episode 485 of the Smashing Security podcast, hosted by Graham Cluley with guest Lianne Potter, covers several security stories. Researchers who wanted to test LG smart TVs for security risks got around the terms and conditions by setting up the TV while drunk, on the reasoning that they could not be bound by a contract agreed to while in…
Silent Lynx, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future Insikt Group, has been linked to a new set of attacks on government organizations across the Commonwealth of Independent States. The activity ran from June 2025 through August 2026 and used four infection chains to deploy custom reverse shells (FoalShell, Chvos…
Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive …
FortiGuard Labs describes a large-scale, global campaign that uses heavily obfuscated JScript droppers to launch an AutoIt/Lua-based loader with low detection rates. The loader delivers several popular RATs and infostealers, including a version of Snake Keylogger. The infection chain relies on business email compromise tactics, impersonat…
Kaspersky researchers report that the APT group Mirage Kitten has moved from native C/C++/Go malware to Node.js and JavaScript implants, NodeRabbit and PollCat. Both are cross-platform RATs delivered through spear-phishing by fake recruiters on LinkedIn and other job platforms, using trojanized coding-challenge archives hosted on Amazon S…
Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Cl…
The LiteLLM release 1.107.0 (a widely used open source LLM proxy) was trojanized on PyPI on 21 October 2026 and carries a credential stealer plus a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) drop three extra files in site-packages, two of which run whenever any Python process starts, even one that never impor…
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
