Malware 2025 2025 2024 2023 2022 2021 2020 2019 Viry znalosti Programy Virus Calendar MALWARE TRAFFIC Ransom Database Znalosti Programy Banking Mobil RAT Evolution MALWARE DATABAZE Malware Families CoinMiner RAT Banking Malware Mobil malware RAT ROOTKIT UPDATE
DATE |
NAME |
INFO |
CATEGORY |
SUBCATE |
| 31.12.25 | Shai Hulud | Shai Hulud strikes again - The golden path | MALWARE | PYTHON |
|
25.12.25 |
Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers |
STEALER |
||
|
25.12.25 |
SantaStealer is Coming to Town: A New, Ambitious Infostealer Advertised on Underground Forums |
INFOSTEALER |
||
|
25.12.25 |
From ClickFix to code signed: the quiet shift of MacSync Stealer malware |
Mac OS |
||
|
24.12.25 |
Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan |
ANDROID |
||
|
24.12.25 |
NexusRoute | NexusRoute: Attempting to Disrupt an Indian Government Ministry | MALWARE | ANDROID |
|
24.12.25 |
Frogblight threatens you with a court case: a new Android banker targets Turkish users |
ANDROID BANKING |
||
|
24.12.25 |
Meet Cellik - A New Android RAT With Play Store Integration |
ANDROID RAT |
||
|
20.12.25 |
The YouTube Ghost Network is a malware distribution network that uses compromised accounts to promote malicious videos and spread malware, such as infostealers. |
LOADER |
||
|
20.12.25 |
From Loader to Looter: ACR Stealer Rides on Upgraded CountLoader |
LOADER |
||
|
18.12.25 |
Kimsuky Distributing Malicious Mobile App via QR Code |
ANDROID |
||
| 17.12.25 | GhostPoster | Inside GhostPoster: How a PNG Icon Infected 50,000 Firefox Users | MALWARE | JAVASCRIPT |
| 17.12.25 | Effluence | Remediating Atlassian Confluence servers fails to thwart Effluence backdoor | MALWARE | BACKDOOR |
| 17.12.25 | RCE backdoor | 4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign | MALWARE | BACKDOOR |
| 13.12.25 | Golang Stealer | This week, SonicWall Capture Labs Threat Research Team analyzed a sample of SalatStealer. This is a Golang malware capable of infiltrating a system and enumerating through browsers, files, cryptowallets and systems while embedding a complete array of monitoring tools to push and pull any data on disk. | MALWARE | STEALER |
| 13.12.25 | ValleyRAT | Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits | MALWARE | RAT |
| 13.12.25 | SetcodeRat | SetcodeRat Exposed: A Telegram Secret Stealing Trojan Customized for Chinese-speaking Regions | MALWARE | RAT |
| 13.12.25 | PyStoreRAT | PyStoreRAT: A New AI-Driven Supply Chain Malware Campaign Targeting IT & OSINT Professionals | MALWARE | RAT |
| 12.12.25 | AshTag | Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite | MALWARE | MALWARE |
| 12.12.25 | NANOREMOTE | The fully-featured backdoor we call NANOREMOTE shares characteristics with malware described in REF7707 and is similar to the FINALDRAFT implant. | MALWARE | BACKDOOR |
| 12.12.25 | PeerBlight | PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182 | MALWARE | BACKDOOR |
| 10.12.25 | JS#SMUGGLER | JS#SMUGGLER: Multi-Stage - Hidden Iframes, Obfuscated JavaScript, Silent Redirectors & NetSupport RAT Delivery | MALWARE | JAVASCRIPT |
| 10.12.25 | EtherRAT | EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks | MALWARE | RAT |
| 10.12.25 | CastleLoader | GrayBravo’s CastleLoader Activity Clusters Target Multiple Industries | MALWARE | LOADER |
| 8.12.25 | SEEDSNATCHER | Dissecting an Android Malware Targeting Multiple Crypto Wallet Mnemonic Phrases | MALWARE | ANDROID |
| 8.12.25 | ClayRat | Return of ClayRat: Expanded Features and Techniques | MALWARE | RAT |
| 8.12.25 | FvncBot | New FvncBot Android banking trojan targets Poland | MALWARE | ANDROID |
| 7.12.25 | Snowlight | A malware dropper that allows remote attackers to drop additional payloads on breached devices. | MALWARE | Dropper |
| 7.12.25 | Vshell | A backdoor commonly used by Chinese hacking groups for remote access, post-exploitation activity, and to move laterally through a compromised network. | MALWARE | Backdoor |
| 6.12.25 | RondoDox | Tracking RondoDox: Malware Exploiting Many IoT Vulnerabilities | MALWARE | IOT |
| 5.12.25 | ValleyRAT | Silver Fox’s Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack | MALWARE | RAT |
| 5.12.25 | BRICKSTORM Backdoor | The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) assess People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems. V | MALWARE | BACKDOOR |
| 3.12.25 | Glassworm's resurgence | Security can't take holidays off, but the code marketplace scanners just might. Over the past week, we've identified and tracked an unprecedented 23 extensions which copy other popular extensions, update after publishing with malware, manipulate download counts, and use KNOWN attack signatures which have been in use for months. Many of these relate to Glassworm malware, but there could be mulitple campaigns at work also. | MALWARE | Worm |
| 2.12.25 | Albiriox | Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets | MALWARE | Android |
| 25.11.25 | StealC V2 infostealer | Morphisec Thwarts Russian-Linked StealC V2 Campaign Targeting Blender Users via Malicious .blend Files | MALWARE | Stealer |
| 20.11.25 | Sturnus | Sturnus: Mobile Banking Malware bypassing WhatsApp, Telegram and Signal Encryption | MALWARE | Andorid banking |
|
19.11.25 |
Eternidade Stealer | Advanced Banking Trojan Maverick Uses WhatsApp to Prey on Brazilian Users | MALWARE | Stealer |
|
18.11.25 |
Pure Crypter Malware Analysis: 99 Problems but Detection Ain’t One |
Crypter |
||
|
17.11.25 |
RONINGLOADER: DragonBreath’s New Path to PPL Abuse |
Loader |
||
|
15.11.25 |
Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery |
JSON |
||
|
15.11.25 |
This week, the SonicWall Capture Labs Threat Research Team analyzed a sample of RondoDox, a Linux botnet infector. |
Botnet |
||
| 12.11.25 | Maverick | Maverick: a new banking Trojan abusing WhatsApp in a mass-scale distribution | MALWARE | Banking Trojan |
| 12.11.25 | Coyote Banking Trojan | Coyote Banking Trojan Extends Reach & Targets Users through WhatsApp | MALWARE | Banking Trojan |
| 12.11.25 | Gootloader | Gootloader Returns: What Goodies Did They Bring? | MALWARE | Loader |
| 11.11.25 | EndClient RAT | New Kimsuky Malware “EndClient RAT”: First Technical Report and IOCs | MALWARE | RAT |
| 11.11.25 | Fantasy Hub | Fantasy Hub: Another Russian Based RAT as M-a-a-S | MALWARE | M-a-a-S |
| 11.11.25 | Comebacker | Lazarus Group targets Aerospace and Defense with new Comebacker variant | MALWARE | Loader |
| 9.11.25 | Line Dancer | In-memory shellcode loader targeting Cisco Adaptive Security Appliance (ASA) devices | MALWARE | Loader |
| 9.11.25 | Line Runner | Persistent webshell targeting Cisco Adaptive Security Appliance (ASA) devices. | MALWARE | Loader |
| 8.11.25 | XLoader 8.0 | Cracking XLoader with AI: How Generative Models Accelerate Malware Analysis | MALWARE | Loader |
| 8.11.25 | LANDFALL | LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices | MALWARE | ANDROID |
| 8.11.25 | TOLLBOOTH | REF3927 abuses publicly disclosed ASP.NET machine keys to compromise IIS servers and deploy TOLLBOOTH SEO cloaking modules globally. | MALWARE | FRAMEWORK |
| 6.11.25 | PROMPTFLUX | GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools | MALWARE | AI |
| 4.11.25 | SesameOp | SesameOp: Novel backdoor uses OpenAI Assistants API for command and control | MALWARE | Backdoor |
| 4.11.25 | SleepyDuck | SleepyDuck malware invades Cursor through Open VSX | MALWARE | RAT |
| 4.11.25 | HttpTroy | DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant | MALWARE | Dropper |
| 4.11.25 | BLINDINGCAN | DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant | MALWARE | Tool |
| 1.11.25 | Minecraft RAT | RL's analysis of an STD Group-operated RAT yielded file indicators to better detect the malware and two YARA rules. | MALWARE | RAT |
| 1.11.25 | Android/BankBot-YNRK | Investigation Report: Android/BankBot-YNRK Mobile Banking Trojan Executive Summary This report covers the analysis and findings related to three Android application packages (APKs) | MALWARE | Android |
| 1.11.25 | HijackLoader | The SonicWall Capture Labs threat research team has recently been monitoring new variants of the HijackLoader malware that are being delivered through SVG files. | MALWARE | Loader |
| 1.11.25 | Airstalk | Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack | MALWARE | MALWARE |
| 1.11.25 | gokcpdoor | The sophisticated campaign, observed by Sophos, involved the exploitation of CVE-2025-61932 to deliver a known backdoor referred to as | MALWARE | Backdoor |
| 30.10.25 | NetSupport RAT | Unpacking NetSupport RAT Loaders Delivered via ClickFix | MALWARE | RAT |
| 30.10.25 | Remcos | Fileless Remcos Attacks on the Rise | MALWARE | Fileless |
| 30.10.25 | Atroposia | Atroposia is a stealthy RAT with HRDP, credential theft, DNS hijacking & fileless exfiltration — aka cybercrime made easy for low-skill attackers. | MALWARE | RAT |
| 30.10.25 | PureHVNC | LATAM baited into the delivery of PureHVNC | MALWARE | RAT |
| 30.10.25 | PhantomRaven | PhantomRaven: NPM Malware Hidden in Invisible Dependencies | MALWARE | nmp |
| 29.10.25 | Herodotus | New Android Malware Herodotus Mimics Human Behaviour to Evade Detection | MALWARE | Android |
| 26.10.25 | ODYSSEY STEALER | ODYSSEY STEALER : THE REBRAND OF POSEIDON STEALER | MALWARE | Stealer |
| 26.10.25 | Oyster | Rhysida using Oyster Backdoor to deliver ransomware | MALWARE | Backdoor |
| 26.10.25 | WebSocket RAT | PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation | MALWARE | RAT |
| 26.10.25 | PXA | Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem | MALWARE | Stealer |
| 25.10.25 | GHOSTGRAB | Sophisticated Android malware that mines crypto and silently steals banking credentials. EXECUTIVE SUMMARY CYFIRMA is dedicated to providing advanced warning and strategic | MALWARE | Android |
| 25.10.25 | Vidar Stealer 2.0 | Trend™ Research examines the latest version of the Vidar stealer, which features a full rewrite in C, a multithreaded architecture, and several enhancements that warrant attention. Its timely evolution suggests that Vidar is positioning itself to occupy the space left after Lumma Stealer’s decline. | MALWARE | Stealer |
| 25.10.25 | SnakeStealer | Here’s what to know about the malware with an insatiable appetite for valuable data, so much so that it tops this year's infostealer detection charts | MALWARE | Stealer |
| 25.10.25 | DeskRAT | TransparentTribe targets Indian military organisations with DeskRAT | MALWARE | RAT |
| 25.10.25 | GlassWorm | GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace | MALWARE | Worm |
| 25.10.25 | PhantomCaptcha | PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation | MALWARE | RAT |
| 22.10.25 | GhostSocks | GhostSocks: From Initial Access to Residential Proxy | MALWARE | Maas |
| 22.10.25 | PolarEdge | Defrosting PolarEdge’s Backdoor | MALWARE | Backdoor |
| 21.10.25 | COLDRIVER | To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER | MALWARE | Malware |
| 21.10.25 | SNAPPYBEE | Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion | MALWARE | RAT |
| 20.10.25 | Winos 4.0 | From China to Malaysia, FortiGuard Labs traces a hacker group’s shifting campaigns and evolving malware delivery tactics across Asia | MALWARE | RAT |
|
18.10.25 |
Unit 42 researchers have been tracking phishing campaigns that use PhantomVAI Loader to deliver information-stealing malware through a multi-stage, evasive infection chain. |
Loader |
||
| 17.10.25 | BeaverTail | BeaverTail and OtterCookie evolve with a new Javascript module | MALWARE | JavaScipt |
| 17.10.25 | LinkPro | LinkPro: eBPF rootkit analysis | MALWARE | Rootkit |
|
13.10.25 |
Astaroth | Astaroth: Banking Trojan Abusing GitHub for Resilience | MALWARE | Banking |
|
13.10.25 |
ChaosBot | New Rust Malware "ChaosBot" Uses Discord for Command and Control | MALWARE | Bot |
|
11.10.25 |
Stealit | New Stealit Campaign Abuses Node.js Single Executable Application | MALWARE | RAT |
|
11.10.25 |
Stealit | New Stealit Campaign Abuses Node.js Single Executable Application | MALWARE | RAT |
|
10.10.25 |
ClayRat | ClayRat: A New Android Spyware Targeting Russia | MALWARE | RAT |
|
10.10.25 |
WRECKSTEEL | According to CERT-UA, this is a stealer targeting a range of file extensions and creating screenshots of the compromised machine to be then uploaded via cURL. | MALWARE | Stealer |
|
5.10.25 |
Klopatra | Klopatra: exposing a new Android banking trojan operation with roots in Turkey | MALWARE | Android |
|
5.10.25 |
MatrixPDF | MatrixPDF Puts Gmail Users at Risk with Malicious PDF Attachments | MALWARE | Toolkit |
|
5.10.25 |
RayInitiator & LINE VIP | A sophisticated bootkit and user-mode capability, targeting Cisco ASA devices. A significant advancement over LINE DANCER and LINE RUNNER. | MALWARE | Bookit |
| 4.10.25 | Oyster/Broomstick | Arctic Wolf has observed a search engine optimization (SEO) poisoning and malvertising campaign promoting malicious websites hosting trojanized versions of legitimate IT tools such as PuTTY and WinSCP. | MALWARE | Backdoor |
| 4.10.25 | XWorm V6 | XWorm V6, a potent malware, has resurfaced with new plugins and persistence methods. Stay informed and enhance your defenses against evolving cyber threats. Protect your organization now! | MALWARE | Worm |
| 4.10.25 | Rhadamanthys 0.9.x | Rhadamanthys is a popular, multi-modular stealer, released in 2022. Since then, it has been used in multiple campaigns by various actors. Most recently, it is being observed in the ClickFix campaigns. | MALWARE | Stealer |
| 3.10.25 | SORVEPOTEL | Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users | MALWARE | Malware |
| 3.10.25 | Klopatra | Klopatra: exposing a new Android banking trojan operation with roots in Turkey | MALWARE | Banking |
| 3.10.25 | EvilAI | EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks | MALWARE | AI |
| 3.10.25 | Datzbro | Datzbro: RAT Hiding Behind Senior Travel Scams | MALWARE | RAT |
| 3.10.25 | Postmark | First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails | MALWARE | Backdoor |
| 27.9.25 | RainyDay | How RainyDay, Turian and a new PlugX variant abuse DLL search order hijacking | MALWARE | Backdoor |
| 27.9.25 | Amatera | SVG Phishing hits Ukraine with Amatera Stealer, PureMiner | MALWARE | Stealer |
| 26.9.25 | XCSSET | XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory | MALWARE | MacOS |
| 26.9.25 | Line Runn | Persistent webshell targeting Cisco Adaptive Security Appliance (ASA) devices. | MALWARE | Loader |
| 26.9.25 | Line Danc | In-memory shellcode loader targeting Cisco Adaptive Security Appliance (ASA) devices. | MALWARE | Loader |
| 25.9.25 | BRICKSTORM | Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | MALWARE | BACKDOOR |
| 25.9.25 | DeceptiveDevelopment | DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception | MALWARE | AI |
| 24.9.25 | YiBackdoor | YiBackdoor: A New Malware Family With Links to IcedID and Latrodectus | MALWARE | BACKDOOR |
| 23.9.25 | fezbox | Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique | MALWARE | nmp |
| 22.9.25 | BeaverTail | Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure | MALWARE | JavaScript |
| 20.9.25 | CountLoader | Silent Push has discovered a new malware loader that is strongly associated with Russian ransomware gangs that we are naming: “CountLoader.” | MALWARE | LOADER |
| 20.9.25 | Maranhão Stealer | Cyble Research & Intelligence Labs detected Maranhão Stealer, a Node.js–based credential stealer leveraging reflective DLL injection. | MALWARE | STEALER |
| 20.9.25 | DeerStealer | DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities | MALWARE | STEALER |
| 20.9.25 | XillenStealer | UNMASKING A PYTHON STEALER – “XillenStealer” | MALWARE | STEALER |
| 20.9.25 | Shai-Hulud | "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated September 19) | MALWARE | PYTHON |
| 16.9.25 | SnakeDisk | Hive0154, aka Mustang Panda, drops updated Toneshell backdoor and novel SnakeDisk USB worm | MALWARE | USB |
| 13.9.25 | MostereRAT | FortiGuard Labs uncovers MostereRAT’s use of phishing, EPL code, and remote access tools like AnyDesk and TightVNC to evade defenses and seize full system control. | MALWARE | RAT |
| 12.9.25 | VBShower | The script uses the same method to erase both its own contents and the contents of the VBShower Launcher copy, which is used solely for the malware’s first run. | MALWARE | BACKDOOR |
| 11.9.25 | AsyncRAT | AsyncRAT in Action: Fileless Malware Techniques and Analysis of a Remote Access Trojan | MALWARE | RAT |
| 11.9.25 | EggStreme | EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company | MALWARE | Keylogger |
| 10.9.25 | ChillyHell | ChillyHell: A Deep Dive into a Modular macOS Backdoor | MALWARE | MacOS |
| 10.9.25 | ZynorRAT | ZynorRAT technical analysis: Reverse engineering a novel, Turkish Go-based RAT | MALWARE | RAT |
| 9.9.25 | Strain | Off Your Docker: Exposed APIs Are Targeted in New Malware Strain | MALWARE | CRYPTOCURRENCY |
| 9.9.25 | RatOn | The Rise of RatOn: From NFC heists to remote control and ATS | MALWARE | ANDROID |
| 9.9.25 | MostereRAT | MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access | MALWARE | RAT |
| 9.9.25 | GPUGate | GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe | MALWARE | GPU |
| 5.9.25 | CastleRAT | From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure | MALWARE | RAT |
| 5.9.25 | AMOS Stealer | An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via ‘Cracked’ Apps | MALWARE | Stealer |
| 5.9.25 | GhostRedirector | GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes | MALWARE | Backdoor |
| 4.9.25 | RapperBot | RapperBot: From Infection to DDoS in a Split Second | MALWARE | Bot |
| 2.9.25 | Nodemailer | Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions | MALWARE | Python |
| 2.9.25 | Silent Gatekeepers | Android Droppers: The Silent Gatekeepers of Malware | MALWARE | Android |
| 2.9.25 | ROKRAT | Operation HanKook Phantom: North Korean APT37 targeting South Korea | MALWARE | RAT |
| 30.8.25 | Anatsa | Android Document Readers and Deception: Tracking the Latest Updates to Anatsa | MALWARE | Android |
| 30.8.25 | Android.Backdoor.916.origin | Android backdoor spies on employees of Russian businesses | MALWARE | Android |
| 30.8.25 | SikkahBot Malware | Executive Summary Cyble Research and Intelligence Labs (CRIL) has uncovered an ongoing Android malware tracker named “SikkahBot,” active since July 2024 and explicitly targeting students in Bangladesh. | MALWARE | Bot |
| 30.8.25 | INF0S3C STEALER | EXECUTIVE SUMMARY Cyfirma’s threat intelligence assessment reveals Inf0s3c Stealer, a Python-based grabber designed to collect system information and user data. The executable | MALWARE | Stealer |
| 30.8.25 | TINKYWINKEY KEYLOGGER | EXECUTIVE SUMMARY At CYFIRMA, we are dedicated to providing timely intelligence on emerging cyber threats and adversarial tactics that target both individuals and organizations. | MALWARE | Keylogger |
| 29.8.25 | Xiangoop | Pirates of The Nang Hai: Follow the Artifacts No One Know | MALWARE | Loader |
| 29.8.25 | TamperedChef | Truesec has observed what appears to be a large cybercrime campaign, involving multiple fraudulent websites promoted through a Google advertising campaign. | MALWARE | Stealer |
| 26.8.25 | Hook Version 3 | Hook Version 3: The Banking Trojan with The Most Advanced Capabilities | MALWARE | Banking |
| 26.8.25 | UpCrypter | Phishing Campaign Targeting Companies via UpCrypter | MALWARE | Crypter |
| 24.8.25 | XenoRAT | XenoRAT malware campaign hits multiple embassies in South Korea | MALWARE | RAT |
| 23.8.25 | Chihuahua Stealer | Chihuahua Stealer: Disguising Data Theft in Plain Lyrics | MALWARE | Stealer |
| 22.8.25 | VShell | The Silent, Fileless Threat of VShell | MALWARE | Linux |
| 22.8.25 | CORNFLAKE.V3 | A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor | MALWARE | Backdoor |
| 21.8.25 | QuirkyLoader | A new malware loader delivering infostealers and RATs | MALWARE | RAT |
| 20.8.25 | DripDropper | Patching for persistence: How DripDropper Linux malware moves through the cloud | MALWARE | Linux |
| 19.8.25 | GodRAT | GodRAT – New RAT targeting financial institutions | MALWARE | RAT |
| 19.8.25 | Noodlophile | Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints | MALWARE | STEALER |
| 17.8.25 | DarkCloud | New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer | MALWARE | STEALER |
| 17.8.25 | ERMAC V3.0 | Hunt.io Exposes and Analyzes ERMAC V3.0 Banking Trojan Full Source Code Leak | MALWARE | Android |
| 14.8.25 | PhantomCard | PhantomCard: New NFC-driven Android malware emerging in Brazil | MALWARE | Android |
| 14.8.25 | PS1Bot | Malvertising campaign leads to PS1Bot, a multi-stage malware framework | MALWARE | Backdoor |
| 5.08.25 | PlayPraetor | PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT | MALWARE | RAT |
| 5.08.25 | PXA Stealer | Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem | MALWARE | STEALER |
| 25.7.25 | CastleLoader | Understanding Current CastleLoader Campaigns | MALWARE | Loader |
| 24.7.25 | Coyote | Coyote in the Wild: First-Ever Malware That Abuses UI Automation | MALWARE | AI |
| 22.7.25 | DCHSpy | Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict | MALWARE | ANDROID |
| 20.7.25 | AUTHENTIC ANTI | Highly targeted credential and OAuth 2.0 tokenstealing malware targeting Outlook. | MALWARE | STEALING |
| 20.7.25 | Matanbuchus | Matanbuchus: Malware-as-a-Service with Demonic Intentions | MALWARE | MaaS |
| 19.7.25 | MFSocket | Massistant is the presumed successor to Chinese forensics tool, “MFSocket”, reported in 2019 and attributed to publicly traded cybersecurity company, Meiya Pico | MALWARE | TOOL |
| 19.7.25 | MDifyLoader | Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities | MALWARE | LOADER |
| 19.7.25 | DslogdRAT | DslogdRAT Malware Installed in Ivanti Connect Secure | MALWARE | RAT |
| 19.7.25 | SPAWNCHIMERA | SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability | MALWARE | |
| 18.7.25 | Emmenhtal | MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities | MALWARE | Loader |
| 18.7.25 | Linuxsys | VulnCheck observed exploitation of CVE-2021-41773 in the wild. This, in itself, is hardly noteworthy. The vulnerability was an inaugural member of both the CISA KEV and VulnCheck KEV. | MALWARE | CRYPTOCURRENCY |
| 16.7.25 | HazyBeacon | Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication | MALWARE | BACKDOOR |
| 16.7.25 | KongTuke | Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). | MALWARE | RAT |
| 10.7.25 | macOS.ZuRu | macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App | MALWARE | MacOS |
| 9.7.25 | SHELLTER | Taking SHELLTER: a commercial evasion framework abused in- the- wild | MALWARE | INFOSTEALER |
| 9.7.25 | Anatsa | Anatsa Targets North America; Uses Proven Mobile Campaign Process | MALWARE | Mobil |
| 8.7.25 | NordDragonScan | NordDragonScan: Quiet Data-Harvester on Windows | MALWARE | INFOSTEALER |
| 8.7.25 | Batavia | Batavia spyware steals data from Russian organizations | MALWARE | SPYWARE |
| 8.7.25 | DRAT V2 | DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal | MALWARE | RAT |
| 5.7.25 | Chisel | Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go. | MALWARE | Backdoor |
| 3.7.25 | NimDoor | macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware | MALWARE | macOS |
| 2.7.25 | TransferLoader | Zscaler ThreatLabz has identified a new malware loader that we have named TransferLoader, which has been active since at least February 2025. | MALWARE | LOADER |
| 2.7.25 | DAMASCENED PEACOCK | A lightweight, staged downloader targeting Windows, delivered via spear-phishing. | MALWARE | DOWNLOADER |
| 28.6.25 | GIFTEDCROOK | GIFTEDCROOK’s Strategic Pivot: From Browser Stealer to Data Exfiltration Platform During Critical Ukraine Negotiations | MALWARE | STEALER |
| 27.6.25 | ODYSSEY STEALER | The CYFIRMA research team has uncovered multiple websites employing Clickfix tactics to deliver malicious AppleScripts (osascripts). | MALWARE | STEALER |
| 27.6.25 | ToneShell | ToneShell Backdoor Used to Target Attendees of the IISS Defence Summit | MALWARE | BACKDOOR |
| 27.6.25 | ToneShell | ToneShell Backdoor Used to Target Attendees of the IISS Defence Summit | MALWARE | BACKDOOR |
| 26.6.25 | SparkCat | SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play | MALWARE | MOBIL |
| 24.6.25 | UMBRELLA STAND | Malware targeting Fortinet devices | MALWARE | RAT |
| 24.6.25 | SHOE RACK | A post-exploitation tool for remote shell access & TCP tunnelling through a victim device. | MALWARE | RAT |
| 24.6.25 | XDigo | SadFuture: Mapping XDSpy latest evolution | MALWARE | GO |
| 23.6.25 | GodFather | GodFather Malware Returns Targeting Banking Users | MALWARE | BANKING |
| 23.6.25 | FjordPhantom | Promon discovers new Android banking malware, “FjordPhantom” | MALWARE | BANKING |
| 21.6.25 | Masslogger | During our recent investigation at Seqrite Labs, we identified a sophisticated variant of Masslogger credential stealer malware spreading through .VBE (VBScript Encoded) files | MALWARE | VBE |
| 21.6.25 | Amatera Stealer | Proofpoint has been closely monitoring a stealer malware formerly known as ACR Stealer. | MALWARE | STEALER |
| 21.6.25 | VMDetector | VMDetector-Based Loader Abuses Steganography to Deliver Infostealers | MALWARE | STEALER |
| 21.6.25 | PylangGhost | Famous Chollima deploying Python version of GolangGhost RAT | MALWARE | RAT |
| 20.6.25 | KimJongRAT | Exploring a New KimJongRAT Stealer Variant and Its PowerShell Implementation | MALWARE | STEALER |
| 14.6.25 | Skuld | The attackers combined the ClickFix phishing technique, multi-stage loaders, and time-based evasions to stealthily deliver AsyncRAT, and a customized Skuld Stealer targeting crypto wallets. | MALWARE | STEALER |
| 11.6.25 | Rust Based InfoStealer | Demystifying Myth Stealer: A Rust Based InfoStealer | MALWARE | STEALER |
| 8.6.25 | Sakura RAT | A simple customer query leads to a rabbit hole of backdoored malware and game cheats | MALWARE | RAT |
| 7.6.25 | AMOS update | AMOS Variant Distributed Via Clickfix In Spectrum-Themed Dynamic Delivery Campaign By Russian Speaking Hackers | MALWARE | Stealer |
| 6.6.25 | DuplexSpy | DuplexSpy RAT: Stealthy Windows Malware Enabling Full Remote Control and Surveillance | MALWARE | RAT |
| 4.6.25 | Chaos RAT | From open-source to open threat: Tracking Chaos RAT’s evolution | MALWARE | RAT |
| 3.6.25 | Crocodilus | Crocodilus Mobile Malware: Evolving Fast, Going Global | MALWARE | Android |
| 1.6.25 | Poseidon Stealer and Payday Loader | Dark Partners: The crypto heist adventure of Poseidon Stealer and Payday Loader | MALWARE | MALWARE |
| 30.5.25 | XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | MALWARE | RAT |
| 30.5.25 | EDDIESTEALER | Chasing Eddies: New Rust- based InfoStealer used in CAPTCHA campaigns | MALWARE | STEALER |
| 30.5.25 | XWorm | Malware with wide range of capabilities ranging from RAT to ransomware. | MALWARE | RAT |
| 30.5.25 | EDDIESTEALER | Chasing Eddies: New Rust- based InfoStealer used in CAPTCHA campaigns | MALWARE | STEALER |
| 29.5.25 | PE File DOS Header | The MS-DOS Header is a 64-byte structure at the beginning of a PE file. Along with the DOS stub, the DOS header is responsible for MS-DOS backward compatibility. | MALWARE | RAT |
| 28.5.25 | Dero miner | Dero miner zombies biting through Docker APIs to build a cryptojacking horde | MALWARE | CRYPTOCURRENCY |
| 28.5.25 | VenomRAT | Inside a VenomRAT Malware Campaign | MALWARE | RAT |
| 27.5.25 | Winos 4.0 | NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign | MALWARE | Loader |
| 24.5.25 | Lactrodectus | Following the spiders: Investigating Lactrodectus malware | MALWARE | RAT |
| 21.5.25 | Pure Harm | Pure Harm: PureRAT Attacks Russian Organizations | MALWARE | RAT |
| 20.5.25 | RedisRaider | RedisRaider: Weaponizing misconfigured Redis to mine cryptocurrency at scale | MALWARE | CRYPTOCURRENCY |
| 18.5.25 | SnipVex | SnipVex—more than a Clipbanker | MALWARE | Stealer |
| 18.5.25 | XRed | XRed Backdoor: The Hidden Threat in Trojanized Programs | MALWARE | Backdoor |
| 18.5.25 | Skitnet | Skitnet is a multi-stage malware that uses Rust and Nim to execute a stealthy reverse shell over DNS, leveraging encryption, manual mapping, and dynamic API resolution to evade detection | MALWARE | Loader |
| 16.5.25 | Remcos RAT | Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT | MALWARE | RAT |
| 13.5.25 | Noodlophile | New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms | MALWARE | STEALER |
| 10.5.25 | OtterCookie v4 | Additional Features of OtterCookie Malware Used by WaterPlum | MALWARE | STEALER |
| 9.5.25 | PupkinStealer | PupkinStealer : A .NET-Based Info-Stealer | MALWARE | STEALER |
| 9.5.25 | HANNIBAL Stealer | HANNIBAL Stealer: A Rebranded Threat Born from Sharp and TX Lineage | MALWARE | STEALER |
| 8.5.25 | StealC | I StealC You: Tracking the Rapid Changes To StealC | MALWARE | Steal |
| 8.5.25 | COLDRIVER | COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs | MALWARE | Steal |
| 6.5.25 | TerraStealerV2 and TerraLogger | TerraStealerV2 and TerraLogger: Golden Chickens' New Malware Families Discovered | MALWARE | Loader |
| 2.5.25 | MintsLoader | Uncovering MintsLoader With Recorded Future Malware Intelligence Hunting | MALWARE | Loader |
| 1.5.25 | Sheriff | IBM X-Force discovers new Sheriff Backdoor used to target Ukraine | MALWARE | Backdoor |
| 25.4.25 | DslogdRAT | DslogdRAT Malware Installed in Ivanti Connect Secure | MALWARE | RAT |
| 24.4.25 | io_uring | io_uring Is Back, This Time as a Rootkit | MALWARE | ROOTKIT |
| 22.4.25 | SuperCard X Malware | A novel Android malware offered through a Malware-as-a-Service (MaaS) model, enabling NFC relay attacks for fraudulent cash-outs. | MALWARE | ANDROID |
| 18.4.25 | MysterySnail RAT | IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia | MALWARE | RAT |
| 18.4.25 | PAKLOG, CorKLOG, and SplatCloak | P2 | Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2 | MALWARE | APT |
| 18.4.25 | ToneShell and StarProxy | P1 | Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1 | MALWARE | APT |
| 18.4.25 | XorDDoS controller | Unmasking the new XorDDoS controller and infrastructure | MALWARE | DDoS |
| 16.4.25 | Android.Clipper | Nice chatting with you: what connects cheap Android smartphones, WhatsApp and cryptocurrency theft? | MALWARE | Android |
| 16.4.25 | BPFDoor | BPFDoor’s Hidden Controller Used Against Asia, Middle East Targets | MALWARE | Backdoor |
| 16.4.25 | SNOWLIGHT | According to sysdig, SNOWLIGHT is used as a dropper for its fileless payload (vshell). | MALWARE | Linux |
| 15.4.25 | ResolverRAT | New Malware Variant Identified: ResolverRAT Enters the Maze | MALWARE | RAT |
| 15.4.25 | CurlBack RAT | Goodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform Attacks | MALWARE | RAT |
| 12.4.25 | TsarBot | TsarBot: A New Android Banking Trojan Targeting Over 750 Banking, Finance, and Cryptocurrency Applications | MALWARE | Bot |
| 11.4.25 | SpyNote | Newly Registered Domains Distributing SpyNote Malware | MALWARE | Android RAT |
| 10.4.25 | GammaSteel | Shuckworm Targets Foreign Military Mission Based in Ukraine | MALWARE | PowerShell |
| 9.4.25 | TCESB | How ToddyCat tried to hide behind AV software | MALWARE | Rootkit |
| 9.4.25 | ClipBanker | Attackers distributing a miner and the ClipBanker Trojan via SourceForge | MALWARE | Trojan |
| 2.4.25 | Outlaw | Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective | MALWARE | Linux |
| 2.4.25 | HijackLoader | Analyzing New HijackLoader Evasion Tactics |
Loader |
|
| 2.4.25 | Anubis Backdoor | The Savage Ladybug , also known as FIN7, has developed a new, mildly obfuscated Python-based backdoor called Anubis Backdoor . |
Backdoor |
|
|
1.4.25 |
To achieve persistence on infected systems, Water Gamayun employs two distinct backdoors in their campaigns. |
Backdoor |
||
|
1.4.25 |
The MSC EvilTwin loader represents a novel approach (CVE-2025-26633) to malware deployment by leveraging specially crafted Microsoft Saved Console (.msc) files. |
Loader |
||
|
1.4.25 |
SilentPrism is a backdoor malware designed to achieve persistence, dynamically execute shell commands, and maintain unauthorized remote control of compromised systems. |
Backdoor |
||
|
1.4.25 |
On July 26, 2024, security researcher Germán Fernández tweeted about a fake WinRAR website distributing various types of malwares, including stealers, miners, hidden virtual network computing (hVNC), |
Stealer |
||
|
31.3.25 |
CISA analyzed three files obtained from a critical infrastructure’s Ivanti Connect Secure device after threat actors exploited Ivanti CVE-2025-0282 for initial access. |
ICS |
||
|
29.3.25 |
Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices |
ANDROID |
||
|
28.3.25 |
ANALYSIS OF A DISCORD-BASED REMOTE ACCESS TROJAN (RAT) |
RAT |
||
|
28.3.25 |
Analysis of Konni RAT: Stealth, Persistence, and Anti-Analysis Techniques |
RAT |
||
|
28.3.25 |
SnakeKeylogger | SnakeKeylogger – A Multistage Info Stealer Malware Campaign | MALWARE | Keylogger |
|
28.3.25 |
CoffeeLoader | CoffeeLoader: A Brew of Stealthy Techniques | MALWARE | Loader |
|
28.3.25 |
PJobRAT | PJobRAT makes a comeback, takes another crack at chat apps | MALWARE | ANDROID RAT |
|
28.3.25 |
EDRKillShifter | Shifting the sands of RansomHub’s EDRKillShifter | MALWARE | Tool |
|
25.3.25 |
Raspberry Robin | Raspberry Robin: Copy Shop USB Worm Evolves to Initial Access Broker Enabling Other Threat Actor Attacks | MALWARE | Worm |
|
25.3.25 |
Raspberry Robin | Raspberry Robin: Copy Shop USB Worm Evolves to Initial Access Broker Enabling Other Threat Actor Attacks | MALWARE | Worm |
|
21.3.25 |
Bloody Wolf | The notorious cluster changes its toolkit by switching from malware to a legitimate remote administration tool | MALWARE | Toolkit |
|
21.3.25 |
ABYSSWORKER | Shedding light on the ABYSSWORKER driver | MALWARE | Driver |
|
21.3.25 |
Arcane stealer | What’s intriguing about this malware is how much it collects. It grabs account information from VPN and gaming clients, and all kinds of network utilities like ngrok, Playit, Cyberduck, FileZilla and DynDNS. | MALWARE | Stealer |
|
20.3.25 |
Paragon's Adroid Spyware | Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations | MALWARE | Android |
|
20.3.25 |
PEAKLIGHT | PEAKLIGHT: Decoding the Stealthy Memory-Only Malware | MALWARE | DROPPER |
|
20.3.25 |
ClearFake | ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery | MALWARE | JAVASCRIPT |
|
18.3.25 |
StilachiRAT | StilachiRAT analysis: From system reconnaissance to cryptocurrency theft | MALWARE | RAT |
|
16.3.25 |
StealBit | THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool | MALWARE | TOOL |
| 14.3.25 | MassJacker | Captain MassJacker Sparrow: Uncovering the Malware’s Buried Treasure | MALWARE | Cryptojacking |
| 14.3.25 | OBSCURE#BAT | Analyzing OBSCURE#BAT: Threat Actors Lure Victims into Executing Malicious Batch Scripts to Deploy Stealthy Rootkits | MALWARE | Rootkit |
| 13.3.25 | KoSpy | Lookout Discovers New Spyware by North Korean APT37 | MALWARE | Spyware |
|
8.3.25 | BADBOX 2.0 | Satori Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes | MALWARE | Android |
|
8.3.25 | Zloader 2.9.4.0 | Inside Zloader’s Latest Trick: DNS Tunneling |
Loader |
|
| 8.3.25 | Skuld stealer | TMPN (Skuld) Stealer: The dark side of open source | MALWARE | Stealer |
| 8.3.25 | Trojan-Downloader.Win32.TookPS | Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity | MALWARE | AI |
| 8.3.25 | Ragnar Loader | (a.k.a Sardonic Backdoor) is a sophisticated toolkit of the Monstrous Mantis | MALWARE | Loader |
| 7.3.25 | Cobalt Strike kit | Unmasking the new persistent attacks on Japan | Kit | |
| 7.3.25 | EncryptRAT | Unveiling EncryptHub: Analysis of a multi-stage malware campaign | MALWARE | RAT |
| 6.3.25 | Poco RAT | The evolution of Dark Caracal tools: analysis of a campaign featuring Poco RAT | MALWARE | RAT |
| 5.3.25 | Typosquatted | Typosquatted Go Packages Deliver Malware Loader Targeting Linux and macOS Systems | MALWARE | Go |
| 5.3.25 | BackConnect | Qbot is Back.Connect | MALWARE | Stealer |
| 5.3.25 | Polyglot Malware | Call It What You Want: Threat Actor Delivers Highly Targeted Multistage Polyglot Malware | MALWARE | Go |
| 5.3.25 | clipper malware | Infostealer Campaign against ISPs | MALWARE | Infostealer |
| 4.3.25 | Havoc | Havoc: SharePoint with Microsoft Graph API turns into FUD C2 | MALWARE | Loader |
| 27.2.25 | CleverSoar | New “CleverSoar” Installer Targets Chinese and Vietnamese Users | MALWARE | Rootkit |
| 27.2.25 | ValleyRAT | ValleyRAT Insights: Tactics, Techniques, and Detection Methods | MALWARE | RAT |
| 27.2.25 | Winos 4.0 | Winos 4.0 Spreads via Impersonation of Official Email to Target Users in Taiwan | MALWARE | MALWARE |
| 27.2.25 | TgToxic | Android trojan TgToxic updates its capabilities | MALWARE | Android |
| 26.2.25 | Auto-Color | Auto-Color: An Emerging and Evasive Linux Backdoor | MALWARE | Linux |
| 26.2.25 | LightSpy | LightSpy Expands Command List to Include Social Media Platforms | MALWARE | Spyware |
| 25.2.25 | HiddenGh0st RAT | Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign | MALWARE | RAT |
| 24.2.25 | ACRStealer | ACRStealer Infostealer Exploiting Google Docs as C2 | MALWARE | Stealer |
| 22.2.25 | NailaoLocker | Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors | MALWARE | Backdoor |
| 22.2.25 | Shadowpad | Updated Shadowpad Malware Leads to Ransomware Deployment | MALWARE | Backdoor |
| 20.2.25 | XLoader | XLoader Executed Through JAR Signing Tool (jarsigner.exe) | MALWARE | Loader |
| 20.2.25 | StaryDobry | StaryDobry ruins New Year’s Eve, delivering miner instead of presents | MALWARE | Cryptominer |
| 20.2.25 | Snake Keylogger | FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant | MALWARE | Keylogger |
| 20.2.25 | JS to C2 | javascript-to-command-and-control-c2-server-malware | MALWARE | JavaScript |
| 18.2.25 | FrigidStealer | An Update on Fake Updates: Two New Actors, and New Mac Malware | MALWARE | MacOS |
| 18.2.25 | ELF/Sshdinjector.A!tr | Analyzing ELF/Sshdinjector.A!tr with a Human and Artificial Analyst | MALWARE | Linux |
| 18.2.25 | DEATHLOTUS | A passive CGI backdoor that supports file creation and command execution | MALWARE | Backdoor |
| 18.2.25 | UNAPIMON | A defense evasion utility written in C++ | MALWARE | Utility |
| 18.2.25 | PRIVATELOG | A loader that's used to drop Winnti RAT (aka DEPLOYLOG) which, in turn, delivers a kernel-level rootkit named WINNKIT by means of a rootkit installer | MALWARE | Rootkit |
| 18.2.25 | CUNNINGPIGEON | A backdoor that uses Microsoft Graph API to fetch commands – file and process management, and custom proxy – from mail messages | MALWARE | Backdoor |
| 18.2.25 | WINDJAMMER | A rootkit with capabilities to intercept TCPIP Network Interface, as well as create covert channels with infected endpoints within intranet | MALWARE | Rootkit |
| 18.2.25 | SHADOWGAZE | A passive backdoor reusing listening port from IIS web server | MALWARE | Backdoor |
| 18.2.25 | XCSSET | Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that targets users by infecting Xcode projects, in the wild. | MALWARE | MacOS |
| 18.2.25 | Golang Backdoor | Telegram Abused as C2 Channel for New Golang Backdoor | MALWARE | Backdoor |
| 10.2.25 | FINALDRAFT | From South America to Southeast Asia: The Fragile Web of REF7707 | MALWARE | Malware |
| 10.2.25 | NAPLISTENER | NAPLISTENER: more bad dreams from developers of SIESTAGRAPH | MALWARE | Malware |
| 10.2.25 | BadIIS | This blog post details our analysis of an SEO manipulation campaign targeting Asia. We also share recommendations that can help enterprises proactively secure their environment. | MALWARE | Malware |
| 10.2.25 | ASPXSpy | ASPXSpy is a Web shell. It has been modified by Threat Group-3390 actors to create the ASPXTool version. | MALWARE | Malware |
| 10.2.25 | Malicious ML models | Malicious ML models discovered on Hugging Face platform | MALWARE | AI |
| 10.2.25 | ValleyRAT | Rat Race: ValleyRAT Malware Targets Organizations with New Delivery Techniques | MALWARE | RAT |
| 10.2.25 | Sliver | Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor | MALWARE | Backdoor |
| 10.2.25 | SparkCat | Take my money: OCR crypto stealers in Google Play and App Store | MALWARE | Android |
| 5.2.25 | RDP Wrapper | Persistent Threats from the Kimsuky Group Using RDP Wrapper | MALWARE | Wrapper |
| 5.2.25 | AsyncRAT | AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again | MALWARE | RAT |
| 5.2.25 | FERRET | macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed | MALWARE | macOS |
| 5.2.25 | boltdb-go | Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for Persistence | MALWARE | GO Backdoor |
| 5.2.25 | Coyote Banking Trojan | Coyote Banking Trojan: A Stealthy Attack via LNK Files | MALWARE | Banking |
| 27.1.25 | MintsLoader: StealC | MintsLoader: StealC and BOINC Delivery | MALWARE | Loader |
| 25.1.25 | TorNet | New TorNet backdoor seen in widespread campaign | MALWARE | Backdoor |
|
10.1.25 | Banshee Stealer | Cracking the Code: How Banshee Stealer Targets macOS Users | MALWARE | MacOS |
|
10.1.25 | NonEuclid RAT | The NonEuclid Remote Access Trojan (RAT) is a type of malicious software that enables unauthorised remote access and control of a victim’s computer, often without their awareness. | MALWARE | RAT |
|
2.1.25 | Quasar RAT | Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts | MALWARE | RAT |