17 casos · pág. 1/1
The weekly InfoStealers report for 12-19 October 2026 summarises stealer-log telemetry on compromised machines, credentials and sessions. The United States ranks 8 by country of infection with 438 machines. Gmail is the most affected email provider with 1,225,748 users, followed by Hotmail (90,554) and Yahoo (33,493). Sessions and saved c…
Symantec's Threat Hunter Team reports that new versions of the Aoki infostealer now target credential and session files used by AI coding assistants. Earlier versions focused on browser, cryptocurrency wallet and password manager data. Aoki is a relatively new and sparsely documented stealer, first observed earlier in 2026, and its AI-rel…
OVHcloud disclosed a supply-chain attack on its command-line interface (CLI) repository on GitHub. An attacker used a compromised developer's GitHub account to insert a malicious binary designed to retrieve secrets from users' disks. CEO Octave Klaba confirmed the incident on 19 October 2026 after a customer report. The compromised releas…
OVHcloud disclosed that attackers hijacked a developer's GitHub account and used it to modify the open-source OVHcloud CLI repository, publishing trojanized releases 0.11.0 through 0.15.0 that carry information-stealing malware. According to CEO Octave Klaba, the malicious release appeared at 14:47 on October 19 and was detected and block…
Cisco and Splunk ran a live Agentic SOC at Splunk .conf26, combining Cisco Cloud Control, Splunk Enterprise Security (ES), Cisco Talos intelligence and Endace continuous packet capture, with Jamf engineers also on the team. The article is largely a product and event retrospective. Its one security incident was a fake-Corepack npm credenti…
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
The threat actor behind the GhostAction supply chain campaign has expanded beyond malicious GitHub Actions workflows. According to OpenSourceMalware, it now phishes open-source maintainers and plants a second-stage credential stealer disguised as a font file. The shift appears to follow GitHub's October 9 block on the malicious workflow, …
Researchers at SafeDep analyzed a macOS implant recovered from a compromised workstation. Infection began on 2026-07-26 with a paid YouTube video ad impersonating TradingView that led to a fake .pkg installer. The malware is a remote-controlled task runner, not a single-purpose stealer. It persists via a LaunchAgent that re-fetches a shel…
In September 2026, researchers reported an attack that began inside a live AI coding assistant session at a software company. The attacker gained control of a developer's session, and the assistant recommended a PyPI package that looked normal. The developer installed it, and a hidden infostealer took source code, repository secrets and h…
SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …
FortiGuard Labs describes a large-scale, global campaign that uses heavily obfuscated JScript droppers to launch an AutoIt/Lua-based loader with low detection rates. The loader delivers several popular RATs and infostealers, including a version of Snake Keylogger. The infection chain relies on business email compromise tactics, impersonat…
The Security Affairs Malware Newsletter Round 119 is a weekly digest of malware research published by Pierluigi Paganini. It lists reports on IronChain ransomware, the evolution of XWorm from infostealer to surveillance platform, and the Hirudo banking malware spread through fake updates and patched banking apps. It also covers PEERSTITCH…
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Cl…
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
