Malware 2025  2025  2024  2023  2022  2021  2020  2019  Viry znalosti  Programy  Virus Calendar  MALWARE TRAFFIC  Ransom  Database  Znalosti  Programy  Banking  Mobil  RAT  Evolution  MALWARE DATABAZE  Malware Families  CoinMiner  RAT  Banking Malware  Mobil malware  RAT  ROOTKIT  UPDATE

DATE

NAME

INFO

CATEGORY

SUBCATE

31.12.25 Shai Hulud Shai Hulud strikes again - The golden path MALWARE PYTHON

25.12.25

AuraStealer

Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers

MALWARE

STEALER

25.12.25

SantaStealer

SantaStealer is Coming to Town: A New, Ambitious Infostealer Advertised on Underground Forums

MALWARE

INFOSTEALER

25.12.25

MacSync

From ClickFix to code signed: the quiet shift of MacSync Stealer malware

MALWARE

Mac OS

24.12.25

Wonderland

Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan

MALWARE

ANDROID

24.12.25

NexusRoute NexusRoute: Attempting to Disrupt an Indian Government Ministry MALWARE ANDROID

24.12.25

Frogblight

Frogblight threatens you with a court case: a new Android banker targets Turkish users

MALWARE

ANDROID BANKING

24.12.25

Cellik

Meet Cellik - A New Android RAT With Play Store Integration

MALWARE

ANDROID RAT

20.12.25

GachiLoader

The YouTube Ghost Network is a malware distribution network that uses compromised accounts to promote malicious videos and spread malware, such as infostealers.

MALWARE

LOADER

20.12.25

CountLoader

From Loader to Looter: ACR Stealer Rides on Upgraded CountLoader

MALWARE

LOADER

18.12.25

DOCSWAP

Kimsuky Distributing Malicious Mobile App via QR Code

MALWARE

ANDROID

17.12.25 GhostPoster Inside GhostPoster: How a PNG Icon Infected 50,000 Firefox Users MALWARE JAVASCRIPT
17.12.25 Effluence Remediating Atlassian Confluence servers fails to thwart Effluence backdoor MALWARE BACKDOOR
17.12.25 RCE backdoor 4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign MALWARE BACKDOOR
13.12.25 Golang Stealer This week, SonicWall Capture Labs Threat Research Team analyzed a sample of SalatStealer. This is a Golang malware capable of infiltrating a system and enumerating through browsers, files, cryptowallets and systems while embedding a complete array of monitoring tools to push and pull any data on disk. MALWARE STEALER
13.12.25 ValleyRAT Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits MALWARE RAT
13.12.25 SetcodeRat SetcodeRat Exposed: A Telegram Secret Stealing Trojan Customized for Chinese-speaking Regions MALWARE RAT
13.12.25 PyStoreRAT PyStoreRAT: A New AI-Driven Supply Chain Malware Campaign Targeting IT & OSINT Professionals MALWARE RAT
12.12.25 AshTag Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite MALWARE MALWARE
12.12.25 NANOREMOTE The fully-featured backdoor we call NANOREMOTE shares characteristics with malware described in REF7707 and is similar to the FINALDRAFT implant. MALWARE BACKDOOR
12.12.25 PeerBlight PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182 MALWARE BACKDOOR
10.12.25 JS#SMUGGLER JS#SMUGGLER: Multi-Stage - Hidden Iframes, Obfuscated JavaScript, Silent Redirectors & NetSupport RAT Delivery MALWARE JAVASCRIPT
10.12.25 EtherRAT EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks MALWARE RAT
10.12.25 CastleLoader GrayBravo’s CastleLoader Activity Clusters Target Multiple Industries MALWARE LOADER
8.12.25 SEEDSNATCHER Dissecting an Android Malware Targeting Multiple Crypto Wallet Mnemonic Phrases MALWARE ANDROID
8.12.25 ClayRat Return of ClayRat: Expanded Features and Techniques MALWARE RAT
8.12.25 FvncBot New FvncBot Android banking trojan targets Poland MALWARE ANDROID
7.12.25 Snowlight A malware dropper that allows remote attackers to drop additional payloads on breached devices. MALWARE Dropper
7.12.25 Vshell A backdoor commonly used by Chinese hacking groups for remote access, post-exploitation activity, and to move laterally through a compromised network. MALWARE Backdoor
6.12.25 RondoDox Tracking RondoDox: Malware Exploiting Many IoT Vulnerabilities MALWARE IOT
5.12.25 ValleyRAT Silver Fox’s Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack MALWARE RAT
5.12.25 BRICKSTORM Backdoor The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) assess People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems. V MALWARE BACKDOOR
3.12.25 Glassworm's resurgence Security can't take holidays off, but the code marketplace scanners just might. Over the past week, we've identified and tracked an unprecedented 23 extensions which copy other popular extensions, update after publishing with malware, manipulate download counts, and use KNOWN attack signatures which have been in use for months. Many of these relate to Glassworm malware, but there could be mulitple campaigns at work also. MALWARE Worm
2.12.25 Albiriox Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets MALWARE Android
25.11.25 StealC V2 infostealer Morphisec Thwarts Russian-Linked StealC V2 Campaign Targeting Blender Users via Malicious .blend Files MALWARE Stealer
20.11.25 Sturnus Sturnus: Mobile Banking Malware bypassing WhatsApp, Telegram and Signal Encryption MALWARE Andorid banking

19.11.25

Eternidade Stealer Advanced Banking Trojan Maverick Uses WhatsApp to Prey on Brazilian Users MALWARE Stealer

18.11.25

Pure Crypter

Pure Crypter Malware Analysis: 99 Problems but Detection Ain’t One

MALWARE

Crypter

17.11.25

RONINGLOADER

RONINGLOADER: DragonBreath’s New Path to PPL Abuse

MALWARE

Loader

15.11.25

BeaverTail

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

MALWARE

JSON

15.11.25

RondoDox ARM Malware

This week, the SonicWall Capture Labs Threat Research Team analyzed a sample of RondoDox, a Linux botnet infector.

MALWARE

Botnet

12.11.25 Maverick Maverick: a new banking Trojan abusing WhatsApp in a mass-scale distribution MALWARE Banking Trojan
12.11.25 Coyote Banking Trojan Coyote Banking Trojan Extends Reach & Targets Users through WhatsApp MALWARE Banking Trojan
12.11.25 Gootloader Gootloader Returns: What Goodies Did They Bring? MALWARE Loader
11.11.25 EndClient RAT New Kimsuky Malware “EndClient RAT”: First Technical Report and IOCs MALWARE RAT
11.11.25 Fantasy Hub Fantasy Hub: Another Russian Based RAT as M-a-a-S MALWARE M-a-a-S
11.11.25 Comebacker Lazarus Group targets Aerospace and Defense with new Comebacker variant MALWARE Loader
9.11.25 Line Dancer In-memory shellcode loader targeting Cisco Adaptive Security Appliance (ASA) devices MALWARE Loader
9.11.25 Line Runner Persistent webshell targeting Cisco Adaptive Security Appliance (ASA) devices. MALWARE Loader
8.11.25 XLoader 8.0 Cracking XLoader with AI: How Generative Models Accelerate Malware Analysis MALWARE Loader
8.11.25 LANDFALL LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices MALWARE ANDROID
8.11.25 TOLLBOOTH REF3927 abuses publicly disclosed ASP.NET machine keys to compromise IIS servers and deploy TOLLBOOTH SEO cloaking modules globally. MALWARE FRAMEWORK
6.11.25 PROMPTFLUX GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools MALWARE AI
4.11.25 SesameOp SesameOp: Novel backdoor uses OpenAI Assistants API for command and control MALWARE Backdoor
4.11.25 SleepyDuck SleepyDuck malware invades Cursor through Open VSX MALWARE RAT
4.11.25 HttpTroy DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant MALWARE Dropper
4.11.25 BLINDINGCAN DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant MALWARE Tool
1.11.25 Minecraft RAT RL's analysis of an STD Group-operated RAT yielded file indicators to better detect the malware and two YARA rules. MALWARE RAT
1.11.25 Android/BankBot-YNRK Investigation Report: Android/BankBot-YNRK Mobile Banking Trojan Executive Summary This report covers the analysis and findings related to three Android application packages (APKs) MALWARE Android
1.11.25 HijackLoader The SonicWall Capture Labs threat research team has recently been monitoring new variants of the HijackLoader malware that are being delivered through SVG files. MALWARE Loader
1.11.25 Airstalk Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack MALWARE MALWARE
1.11.25 gokcpdoor The sophisticated campaign, observed by Sophos, involved the exploitation of CVE-2025-61932 to deliver a known backdoor referred to as MALWARE Backdoor
30.10.25 NetSupport RAT Unpacking NetSupport RAT Loaders Delivered via ClickFix MALWARE RAT
30.10.25 Remcos Fileless Remcos Attacks on the Rise MALWARE Fileless
30.10.25 Atroposia Atroposia is a stealthy RAT with HRDP, credential theft, DNS hijacking & fileless exfiltration — aka cybercrime made easy for low-skill attackers. MALWARE RAT
30.10.25 PureHVNC LATAM baited into the delivery of PureHVNC MALWARE RAT
30.10.25 PhantomRaven PhantomRaven: NPM Malware Hidden in Invisible Dependencies MALWARE nmp
29.10.25 Herodotus New Android Malware Herodotus Mimics Human Behaviour to Evade Detection MALWARE Android
26.10.25 ODYSSEY STEALER ODYSSEY STEALER : THE REBRAND OF POSEIDON STEALER MALWARE Stealer
26.10.25 Oyster Rhysida using Oyster Backdoor to deliver ransomware MALWARE Backdoor
26.10.25 WebSocket RAT PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation MALWARE RAT
26.10.25 PXA Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem MALWARE Stealer
25.10.25 GHOSTGRAB Sophisticated Android malware that mines crypto and silently steals banking credentials. EXECUTIVE SUMMARY CYFIRMA is dedicated to providing advanced warning and strategic MALWARE Android
25.10.25 Vidar Stealer 2.0 Trend™ Research examines the latest version of the Vidar stealer, which features a full rewrite in C, a multithreaded architecture, and several enhancements that warrant attention. Its timely evolution suggests that Vidar is positioning itself to occupy the space left after Lumma Stealer’s decline. MALWARE Stealer
25.10.25 SnakeStealer Here’s what to know about the malware with an insatiable appetite for valuable data, so much so that it tops this year's infostealer detection charts MALWARE Stealer
25.10.25 DeskRAT TransparentTribe targets Indian military organisations with DeskRAT MALWARE RAT
25.10.25 GlassWorm GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace MALWARE Worm
25.10.25 PhantomCaptcha PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation MALWARE RAT
22.10.25 GhostSocks GhostSocks: From Initial Access to Residential Proxy MALWARE Maas
22.10.25 PolarEdge Defrosting PolarEdge’s Backdoor MALWARE Backdoor
21.10.25 COLDRIVER To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER MALWARE Malware
21.10.25 SNAPPYBEE Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion MALWARE RAT
20.10.25 Winos 4.0 From China to Malaysia, FortiGuard Labs traces a hacker group’s shifting campaigns and evolving malware delivery tactics across Asia MALWARE RAT

18.10.25

PhantomVAI

Unit 42 researchers have been tracking phishing campaigns that use PhantomVAI Loader to deliver information-stealing malware through a multi-stage, evasive infection chain. 

MALWARE

Loader

17.10.25 BeaverTail BeaverTail and OtterCookie evolve with a new Javascript module MALWARE JavaScipt
17.10.25 LinkPro LinkPro: eBPF rootkit analysis MALWARE Rootkit

13.10.25

Astaroth Astaroth: Banking Trojan Abusing GitHub for Resilience MALWARE Banking

13.10.25

ChaosBot New Rust Malware "ChaosBot" Uses Discord for Command and Control MALWARE Bot

11.10.25

Stealit New Stealit Campaign Abuses Node.js Single Executable Application MALWARE RAT

11.10.25

Stealit New Stealit Campaign Abuses Node.js Single Executable Application MALWARE RAT

10.10.25

ClayRat ClayRat: A New Android Spyware Targeting Russia MALWARE RAT

10.10.25

WRECKSTEEL According to CERT-UA, this is a stealer targeting a range of file extensions and creating screenshots of the compromised machine to be then uploaded via cURL. MALWARE Stealer

5.10.25

Klopatra Klopatra: exposing a new Android banking trojan operation with roots in Turkey MALWARE Android

5.10.25

MatrixPDF MatrixPDF Puts Gmail Users at Risk with Malicious PDF Attachments MALWARE Toolkit

5.10.25

RayInitiator & LINE VIP A sophisticated bootkit and user-mode capability, targeting Cisco ASA devices. A significant advancement over LINE DANCER and LINE RUNNER. MALWARE Bookit
4.10.25 Oyster/Broomstick Arctic Wolf has observed a search engine optimization (SEO) poisoning and malvertising campaign promoting malicious websites hosting trojanized versions of legitimate IT tools such as PuTTY and WinSCP. MALWARE Backdoor
4.10.25 XWorm V6 XWorm V6, a potent malware, has resurfaced with new plugins and persistence methods. Stay informed and enhance your defenses against evolving cyber threats. Protect your organization now! MALWARE Worm
4.10.25 Rhadamanthys 0.9.x Rhadamanthys is a popular, multi-modular stealer, released in 2022. Since then, it has been used in multiple campaigns by various actors. Most recently, it is being observed in the ClickFix campaigns. MALWARE Stealer
3.10.25 SORVEPOTEL Self-Propagating Malware Spreading Via WhatsApp, Targets Brazilian Users MALWARE Malware
3.10.25 Klopatra Klopatra: exposing a new Android banking trojan operation with roots in Turkey MALWARE Banking
3.10.25 EvilAI EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks MALWARE AI
3.10.25 Datzbro Datzbro: RAT Hiding Behind Senior Travel Scams MALWARE RAT
3.10.25 Postmark First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails MALWARE Backdoor
27.9.25 RainyDay How RainyDay, Turian and a new PlugX variant abuse DLL search order hijacking MALWARE Backdoor
27.9.25 Amatera SVG Phishing hits Ukraine with Amatera Stealer, PureMiner MALWARE Stealer
26.9.25 XCSSET XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory MALWARE MacOS
26.9.25 Line Runn Persistent webshell targeting Cisco Adaptive Security Appliance (ASA) devices. MALWARE Loader
26.9.25 Line Danc In-memory shellcode loader targeting Cisco Adaptive Security Appliance (ASA) devices. MALWARE Loader
25.9.25 BRICKSTORM Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors MALWARE BACKDOOR
25.9.25 DeceptiveDevelopment DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception MALWARE AI
24.9.25 YiBackdoor YiBackdoor: A New Malware Family With Links to IcedID and Latrodectus MALWARE BACKDOOR
23.9.25 fezbox Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique MALWARE nmp
22.9.25 BeaverTail Tech Note - BeaverTail variant distributed via malicious repositories and ClickFix lure MALWARE JavaScript
20.9.25 CountLoader Silent Push has discovered a new malware loader that is strongly associated with Russian ransomware gangs that we are naming: “CountLoader.” MALWARE LOADER
20.9.25 Maranhão Stealer Cyble Research & Intelligence Labs detected Maranhão Stealer, a Node.js–based credential stealer leveraging reflective DLL injection. MALWARE STEALER
20.9.25 DeerStealer DeerStealer Malware Campaign: Stealth, Persistence, and Rootkit-Like Capabilities MALWARE STEALER
20.9.25 XillenStealer UNMASKING A PYTHON STEALER – “XillenStealer” MALWARE STEALER
20.9.25 Shai-Hulud "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated September 19) MALWARE PYTHON
16.9.25 SnakeDisk Hive0154, aka Mustang Panda, drops updated Toneshell backdoor and novel SnakeDisk USB worm MALWARE USB
13.9.25 MostereRAT FortiGuard Labs uncovers MostereRAT’s use of phishing, EPL code, and remote access tools like AnyDesk and TightVNC to evade defenses and seize full system control. MALWARE RAT
12.9.25 VBShower The script uses the same method to erase both its own contents and the contents of the VBShower Launcher copy, which is used solely for the malware’s first run. MALWARE BACKDOOR
11.9.25 AsyncRAT AsyncRAT in Action: Fileless Malware Techniques and Analysis of a Remote Access Trojan MALWARE RAT
11.9.25 EggStreme EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company MALWARE Keylogger
10.9.25 ChillyHell ChillyHell: A Deep Dive into a Modular macOS Backdoor MALWARE MacOS
10.9.25 ZynorRAT ZynorRAT technical analysis: Reverse engineering a novel, Turkish Go-based RAT MALWARE RAT
9.9.25 Strain Off Your Docker: Exposed APIs Are Targeted in New Malware Strain MALWARE CRYPTOCURRENCY
9.9.25 RatOn The Rise of RatOn: From NFC heists to remote control and ATS MALWARE ANDROID
9.9.25 MostereRAT MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access MALWARE RAT
9.9.25 GPUGate GPUGate Malware: Malicious GitHub Desktop Implants Use Hardware-Specific Decryption, Abuse Google Ads to Target Western Europe MALWARE GPU
5.9.25 CastleRAT From CastleLoader to CastleRAT: TAG-150 Advances Operations with Multi-Tiered Infrastructure MALWARE RAT
5.9.25 AMOS Stealer An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via ‘Cracked’ Apps MALWARE Stealer
5.9.25 GhostRedirector GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes MALWARE Backdoor
4.9.25 RapperBot RapperBot: From Infection to DDoS in a Split Second MALWARE Bot
2.9.25 Nodemailer Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions MALWARE Python
2.9.25 Silent Gatekeepers Android Droppers: The Silent Gatekeepers of Malware MALWARE Android
2.9.25 ROKRAT Operation HanKook Phantom: North Korean APT37 targeting South Korea MALWARE RAT
30.8.25 Anatsa Android Document Readers and Deception: Tracking the Latest Updates to Anatsa MALWARE Android
30.8.25 Android.Backdoor.916.origin Android backdoor spies on employees of Russian businesses MALWARE Android
30.8.25 SikkahBot Malware Executive Summary Cyble Research and Intelligence Labs (CRIL) has uncovered an ongoing Android malware tracker named “SikkahBot,” active since July 2024 and explicitly targeting students in Bangladesh. MALWARE Bot
30.8.25 INF0S3C STEALER EXECUTIVE SUMMARY Cyfirma’s threat intelligence assessment reveals Inf0s3c Stealer, a Python-based grabber designed to collect system information and user data. The executable MALWARE Stealer
30.8.25 TINKYWINKEY KEYLOGGER EXECUTIVE SUMMARY At CYFIRMA, we are dedicated to providing timely intelligence on emerging cyber threats and adversarial tactics that target both individuals and organizations. MALWARE Keylogger
29.8.25 Xiangoop Pirates of The Nang Hai: Follow the Artifacts No One Know MALWARE Loader
29.8.25 TamperedChef Truesec has observed what appears to be a large cybercrime campaign, involving multiple fraudulent websites promoted through a Google advertising campaign. MALWARE Stealer
26.8.25 Hook Version 3 Hook Version 3: The Banking Trojan with The Most Advanced Capabilities MALWARE Banking
26.8.25 UpCrypter Phishing Campaign Targeting Companies via UpCrypter MALWARE Crypter
24.8.25 XenoRAT XenoRAT malware campaign hits multiple embassies in South Korea MALWARE RAT
23.8.25 Chihuahua Stealer Chihuahua Stealer: Disguising Data Theft in Plain Lyrics MALWARE Stealer
22.8.25 VShell The Silent, Fileless Threat of VShell MALWARE Linux
22.8.25 CORNFLAKE.V3 A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor MALWARE Backdoor
21.8.25 QuirkyLoader A new malware loader delivering infostealers and RATs MALWARE RAT
20.8.25 DripDropper Patching for persistence: How DripDropper Linux malware moves through the cloud MALWARE Linux
19.8.25 GodRAT GodRAT – New RAT targeting financial institutions MALWARE RAT
19.8.25 Noodlophile Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints MALWARE STEALER
17.8.25 DarkCloud New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer MALWARE STEALER
17.8.25 ERMAC V3.0 Hunt.io Exposes and Analyzes ERMAC V3.0 Banking Trojan Full Source Code Leak MALWARE Android
14.8.25 PhantomCard PhantomCard: New NFC-driven Android malware emerging in Brazil MALWARE Android
14.8.25 PS1Bot Malvertising campaign leads to PS1Bot, a multi-stage malware framework MALWARE Backdoor
5.08.25 PlayPraetor PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT MALWARE RAT
5.08.25 PXA Stealer Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem MALWARE STEALER
25.7.25 CastleLoader Understanding Current CastleLoader Campaigns MALWARE Loader
24.7.25 Coyote Coyote in the Wild: First-Ever Malware That Abuses UI Automation MALWARE AI
22.7.25 DCHSpy Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict MALWARE ANDROID
20.7.25 AUTHENTIC ANTI Highly targeted credential and OAuth 2.0 tokenstealing malware targeting Outlook. MALWARE STEALING
20.7.25 Matanbuchus Matanbuchus: Malware-as-a-Service with Demonic Intentions MALWARE MaaS
19.7.25 MFSocket Massistant is the presumed successor to Chinese forensics tool, “MFSocket”, reported in 2019 and attributed to publicly traded cybersecurity company, Meiya Pico MALWARE TOOL
19.7.25 MDifyLoader Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities MALWARE LOADER
19.7.25 DslogdRAT DslogdRAT Malware Installed in Ivanti Connect Secure MALWARE RAT
19.7.25 SPAWNCHIMERA SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability MALWARE  
18.7.25 Emmenhtal MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities MALWARE Loader
18.7.25 Linuxsys VulnCheck observed exploitation of CVE-2021-41773 in the wild. This, in itself, is hardly noteworthy. The vulnerability was an inaugural member of both the CISA KEV and VulnCheck KEV. MALWARE CRYPTOCURRENCY
16.7.25 HazyBeacon Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication MALWARE BACKDOOR
16.7.25 KongTuke Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). MALWARE RAT
10.7.25 macOS.ZuRu macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App MALWARE MacOS
9.7.25 SHELLTER Taking SHELLTER: a commercial evasion framework abused in- the- wild MALWARE INFOSTEALER
9.7.25 Anatsa Anatsa Targets North America; Uses Proven Mobile Campaign Process MALWARE Mobil
8.7.25 NordDragonScan NordDragonScan: Quiet Data-Harvester on Windows MALWARE INFOSTEALER
8.7.25 Batavia Batavia spyware steals data from Russian organizations MALWARE SPYWARE
8.7.25 DRAT V2 DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal MALWARE RAT
5.7.25 Chisel Chisel is an open-source project by Jaime Pillora (jpillora) that allows tunneling TCP and UDP connections via HTTP. It is available across platforms and written in Go. MALWARE Backdoor
3.7.25 NimDoor macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware MALWARE macOS
2.7.25 TransferLoader Zscaler ThreatLabz has identified a new malware loader that we have named TransferLoader, which has been active since at least February 2025. MALWARE LOADER
2.7.25 DAMASCENED PEACOCK A lightweight, staged downloader targeting Windows, delivered via spear-phishing. MALWARE DOWNLOADER
28.6.25 GIFTEDCROOK GIFTEDCROOK’s Strategic Pivot: From Browser Stealer to Data Exfiltration Platform During Critical Ukraine Negotiations MALWARE STEALER
27.6.25 ODYSSEY STEALER The CYFIRMA research team has uncovered multiple websites employing Clickfix tactics to deliver malicious AppleScripts (osascripts). MALWARE STEALER
27.6.25 ToneShell ToneShell Backdoor Used to Target Attendees of the IISS Defence Summit MALWARE BACKDOOR
27.6.25 ToneShell ToneShell Backdoor Used to Target Attendees of the IISS Defence Summit MALWARE BACKDOOR
26.6.25 SparkCat SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play MALWARE MOBIL
24.6.25 UMBRELLA STAND Malware targeting Fortinet devices MALWARE RAT
24.6.25 SHOE RACK A post-exploitation tool for remote shell access & TCP tunnelling through a victim device. MALWARE RAT
24.6.25 XDigo SadFuture: Mapping XDSpy latest evolution MALWARE GO
23.6.25 GodFather GodFather Malware Returns Targeting Banking Users MALWARE BANKING
23.6.25 FjordPhantom Promon discovers new Android banking malware, “FjordPhantom” MALWARE BANKING
21.6.25 Masslogger During our recent investigation at Seqrite Labs, we identified a sophisticated variant of Masslogger credential stealer malware spreading through .VBE (VBScript Encoded) files MALWARE VBE
21.6.25 Amatera Stealer Proofpoint has been closely monitoring a stealer malware formerly known as ACR Stealer. MALWARE STEALER
21.6.25 VMDetector VMDetector-Based Loader Abuses Steganography to Deliver Infostealers MALWARE STEALER
21.6.25 PylangGhost Famous Chollima deploying Python version of GolangGhost RAT MALWARE RAT
20.6.25 KimJongRAT Exploring a New KimJongRAT Stealer Variant and Its PowerShell Implementation MALWARE STEALER
14.6.25 Skuld The attackers combined the ClickFix phishing technique, multi-stage loaders, and time-based evasions to stealthily deliver AsyncRAT, and a customized Skuld Stealer targeting crypto wallets. MALWARE STEALER
11.6.25 Rust Based InfoStealer Demystifying Myth Stealer: A Rust Based InfoStealer MALWARE STEALER
8.6.25 Sakura RAT A simple customer query leads to a rabbit hole of backdoored malware and game cheats MALWARE RAT
7.6.25 AMOS update AMOS Variant Distributed Via Clickfix In Spectrum-Themed Dynamic Delivery Campaign By Russian Speaking Hackers MALWARE Stealer
6.6.25 DuplexSpy DuplexSpy RAT: Stealthy Windows Malware Enabling Full Remote Control and Surveillance MALWARE RAT
4.6.25 Chaos RAT From open-source to open threat: Tracking Chaos RAT’s evolution MALWARE RAT
3.6.25 Crocodilus Crocodilus Mobile Malware: Evolving Fast, Going Global MALWARE Android
1.6.25 Poseidon Stealer and Payday Loader Dark Partners: The crypto heist adventure of Poseidon Stealer and Payday Loader MALWARE MALWARE
30.5.25 XWorm Malware with wide range of capabilities ranging from RAT to ransomware. MALWARE RAT
30.5.25 EDDIESTEALER Chasing Eddies: New Rust- based InfoStealer used in CAPTCHA campaigns MALWARE STEALER
30.5.25 XWorm Malware with wide range of capabilities ranging from RAT to ransomware. MALWARE RAT
30.5.25 EDDIESTEALER Chasing Eddies: New Rust- based InfoStealer used in CAPTCHA campaigns MALWARE STEALER
29.5.25 PE File DOS Header The MS-DOS Header is a 64-byte structure at the beginning of a PE file. Along with the DOS stub, the DOS header is responsible for MS-DOS backward compatibility. MALWARE RAT
28.5.25 Dero miner Dero miner zombies biting through Docker APIs to build a cryptojacking horde MALWARE CRYPTOCURRENCY
28.5.25 VenomRAT Inside a VenomRAT Malware Campaign MALWARE RAT
27.5.25 Winos 4.0 NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign MALWARE Loader
24.5.25 Lactrodectus Following the spiders: Investigating Lactrodectus malware MALWARE RAT
21.5.25 Pure Harm Pure Harm: PureRAT Attacks Russian Organizations MALWARE RAT
20.5.25 RedisRaider RedisRaider: Weaponizing misconfigured Redis to mine cryptocurrency at scale MALWARE CRYPTOCURRENCY
18.5.25 SnipVex SnipVex—more than a Clipbanker MALWARE Stealer
18.5.25 XRed XRed Backdoor: The Hidden Threat in Trojanized Programs MALWARE Backdoor
18.5.25 Skitnet Skitnet is a multi-stage malware that uses Rust and Nim to execute a stealthy reverse shell over DNS, leveraging encryption, manual mapping, and dynamic API resolution to evade detection MALWARE Loader
16.5.25 Remcos RAT Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT MALWARE RAT
13.5.25 Noodlophile New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms MALWARE STEALER
10.5.25 OtterCookie v4 Additional Features of OtterCookie Malware Used by WaterPlum MALWARE STEALER
9.5.25 PupkinStealer PupkinStealer : A .NET-Based Info-Stealer MALWARE STEALER
9.5.25 HANNIBAL Stealer HANNIBAL Stealer: A Rebranded Threat Born from Sharp and TX Lineage MALWARE STEALER
8.5.25 StealC I StealC You: Tracking the Rapid Changes To StealC MALWARE Steal
8.5.25 COLDRIVER COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs MALWARE Steal
6.5.25 TerraStealerV2 and TerraLogger TerraStealerV2 and TerraLogger: Golden Chickens' New Malware Families Discovered MALWARE Loader
2.5.25 MintsLoader Uncovering MintsLoader With Recorded Future Malware Intelligence Hunting MALWARE Loader
1.5.25 Sheriff IBM X-Force discovers new Sheriff Backdoor used to target Ukraine MALWARE Backdoor
25.4.25 DslogdRAT DslogdRAT Malware Installed in Ivanti Connect Secure MALWARE RAT
24.4.25 io_uring io_uring Is Back, This Time as a Rootkit MALWARE ROOTKIT
22.4.25 SuperCard X Malware A novel Android malware offered through a Malware-as-a-Service (MaaS) model, enabling NFC relay attacks for fraudulent cash-outs. MALWARE ANDROID
18.4.25 MysterySnail RAT IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia MALWARE RAT
18.4.25 PAKLOG, CorKLOG, and SplatCloak | P2 Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2 MALWARE APT
18.4.25 ToneShell and StarProxy | P1 Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1 MALWARE APT
18.4.25 XorDDoS controller Unmasking the new XorDDoS controller and infrastructure MALWARE DDoS
16.4.25 Android.Clipper Nice chatting with you: what connects cheap Android smartphones, WhatsApp and cryptocurrency theft? MALWARE Android
16.4.25 BPFDoor BPFDoor’s Hidden Controller Used Against Asia, Middle East Targets MALWARE Backdoor
16.4.25 SNOWLIGHT According to sysdig, SNOWLIGHT is used as a dropper for its fileless payload (vshell). MALWARE Linux
15.4.25 ResolverRAT New Malware Variant Identified: ResolverRAT Enters the Maze MALWARE RAT
15.4.25 CurlBack RAT Goodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform Attacks MALWARE RAT
12.4.25 TsarBot TsarBot: A New Android Banking Trojan Targeting Over 750 Banking, Finance, and Cryptocurrency Applications MALWARE Bot
11.4.25 SpyNote Newly Registered Domains Distributing SpyNote Malware MALWARE Android RAT
10.4.25 GammaSteel Shuckworm Targets Foreign Military Mission Based in Ukraine MALWARE PowerShell
9.4.25 TCESB How ToddyCat tried to hide behind AV software MALWARE Rootkit
9.4.25 ClipBanker Attackers distributing a miner and the ClipBanker Trojan via SourceForge MALWARE Trojan
2.4.25 Outlaw Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective MALWARE Linux
2.4.25 HijackLoader Analyzing New HijackLoader Evasion Tactics

MALWARE

Loader

2.4.25 Anubis Backdoor The Savage Ladybug , also known as FIN7, has developed a new, mildly obfuscated Python-based backdoor called Anubis Backdoor .

MALWARE

Backdoor

1.4.25

DarkWisp backdoor

To achieve persistence on infected systems, Water Gamayun employs two distinct backdoors in their campaigns.

MALWARE

Backdoor

1.4.25

MSC EvilTwin loader

The MSC EvilTwin loader represents a novel approach (CVE-2025-26633) to malware deployment by leveraging specially crafted Microsoft Saved Console (.msc) files.

MALWARE

Loader

1.4.25

SilentPrism backdoor

SilentPrism is a backdoor malware designed to achieve persistence, dynamically execute shell commands, and maintain unauthorized remote control of compromised systems.

MALWARE

Backdoor

1.4.25

EncryptHub stealer

On July 26, 2024, security researcher Germán Fernández tweeted about a fake WinRAR website distributing various types of malwares, including stealers, miners, hidden virtual network computing (hVNC),

MALWARE

Stealer

31.3.25

RESURGE

CISA analyzed three files obtained from a critical infrastructure’s Ivanti Connect Secure device after threat actors exploited Ivanti CVE-2025-0282 for initial access.

MALWARE

ICS

29.3.25

Crocodilus

Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices

MALWARE

ANDROID

28.3.25

Python-based Discord Remote Access Trojan

ANALYSIS OF A DISCORD-BASED REMOTE ACCESS TROJAN (RAT)

MALWARE

RAT

28.3.25

Konni RAT

Analysis of Konni RAT: Stealth, Persistence, and Anti-Analysis Techniques

MALWARE

RAT

28.3.25

SnakeKeylogger SnakeKeylogger – A Multistage Info Stealer Malware Campaign MALWARE Keylogger

28.3.25

CoffeeLoader CoffeeLoader: A Brew of Stealthy Techniques MALWARE Loader

28.3.25

PJobRAT PJobRAT makes a comeback, takes another crack at chat apps MALWARE ANDROID RAT

28.3.25

EDRKillShifter Shifting the sands of RansomHub’s EDRKillShifter MALWARE Tool

25.3.25

Raspberry Robin Raspberry Robin: Copy Shop USB Worm Evolves to Initial Access Broker Enabling Other Threat Actor Attacks MALWARE Worm

25.3.25

Raspberry Robin Raspberry Robin: Copy Shop USB Worm Evolves to Initial Access Broker Enabling Other Threat Actor Attacks MALWARE Worm

21.3.25

Bloody Wolf The notorious cluster changes its toolkit by switching from malware to a legitimate remote administration tool MALWARE Toolkit

21.3.25

ABYSSWORKER Shedding light on the ABYSSWORKER driver MALWARE Driver

21.3.25

Arcane stealer What’s intriguing about this malware is how much it collects. It grabs account information from VPN and gaming clients, and all kinds of network utilities like ngrok, Playit, Cyberduck, FileZilla and DynDNS. MALWARE Stealer

20.3.25

Paragon's Adroid Spyware Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations MALWARE Android

20.3.25

PEAKLIGHT PEAKLIGHT: Decoding the Stealthy Memory-Only Malware MALWARE DROPPER

20.3.25

ClearFake ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery MALWARE JAVASCRIPT

18.3.25

StilachiRAT StilachiRAT analysis: From system reconnaissance to cryptocurrency theft MALWARE RAT

16.3.25

StealBit THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool MALWARE TOOL
14.3.25 MassJacker Captain MassJacker Sparrow: Uncovering the Malware’s Buried Treasure MALWARE Cryptojacking
14.3.25 OBSCURE#BAT Analyzing OBSCURE#BAT: Threat Actors Lure Victims into Executing Malicious Batch Scripts to Deploy Stealthy Rootkits MALWARE Rootkit
13.3.25 KoSpy Lookout Discovers New Spyware by North Korean APT37 MALWARE Spyware

8.3.25

BADBOX 2.0 Satori Threat Intelligence Disruption: BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes MALWARE Android

8.3.25

Zloader 2.9.4.0 Inside Zloader’s Latest Trick: DNS Tunneling

MALWARE

Loader

8.3.25 Skuld stealer TMPN (Skuld) Stealer: The dark side of open source MALWARE Stealer
8.3.25 Trojan-Downloader.Win32.TookPS Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity MALWARE AI
8.3.25 Ragnar Loader (a.k.a Sardonic Backdoor) is a sophisticated toolkit of the Monstrous Mantis MALWARE Loader
7.3.25 Cobalt Strike kit Unmasking the new persistent attacks on Japan

MALWARE

Kit
7.3.25 EncryptRAT Unveiling EncryptHub: Analysis of a multi-stage malware campaign MALWARE RAT
6.3.25 Poco RAT The evolution of Dark Caracal tools: analysis of a campaign featuring Poco RAT MALWARE RAT
5.3.25 Typosquatted Typosquatted Go Packages Deliver Malware Loader Targeting Linux and macOS Systems MALWARE Go
5.3.25 BackConnect Qbot is Back.Connect MALWARE Stealer
5.3.25 Polyglot Malware Call It What You Want: Threat Actor Delivers Highly Targeted Multistage Polyglot Malware MALWARE Go
5.3.25 clipper malware Infostealer Campaign against ISPs MALWARE Infostealer
4.3.25 Havoc Havoc: SharePoint with Microsoft Graph API turns into FUD C2 MALWARE Loader
27.2.25 CleverSoar New “CleverSoar” Installer Targets Chinese and Vietnamese Users MALWARE Rootkit
27.2.25 ValleyRAT ValleyRAT Insights: Tactics, Techniques, and Detection Methods MALWARE RAT
27.2.25 Winos 4.0 Winos 4.0 Spreads via Impersonation of Official Email to Target Users in Taiwan MALWARE MALWARE
27.2.25 TgToxic Android trojan TgToxic updates its capabilities MALWARE Android
26.2.25 Auto-Color Auto-Color: An Emerging and Evasive Linux Backdoor MALWARE Linux
26.2.25 LightSpy LightSpy Expands Command List to Include Social Media Platforms MALWARE Spyware
25.2.25 HiddenGh0st RAT Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign MALWARE RAT
24.2.25 ACRStealer ACRStealer Infostealer Exploiting Google Docs as C2 MALWARE Stealer
22.2.25 NailaoLocker Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors MALWARE Backdoor
22.2.25 Shadowpad Updated Shadowpad Malware Leads to Ransomware Deployment MALWARE Backdoor
20.2.25 XLoader XLoader Executed Through JAR Signing Tool (jarsigner.exe) MALWARE Loader
20.2.25 StaryDobry StaryDobry ruins New Year’s Eve, delivering miner instead of presents MALWARE Cryptominer
20.2.25 Snake Keylogger FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant MALWARE Keylogger
20.2.25 JS to C2 javascript-to-command-and-control-c2-server-malware MALWARE JavaScript
18.2.25 FrigidStealer An Update on Fake Updates: Two New Actors, and New Mac Malware MALWARE MacOS
18.2.25 ELF/Sshdinjector.A!tr Analyzing ELF/Sshdinjector.A!tr with a Human and Artificial Analyst MALWARE Linux
18.2.25 DEATHLOTUS A passive CGI backdoor that supports file creation and command execution MALWARE Backdoor
18.2.25 UNAPIMON A defense evasion utility written in C++ MALWARE Utility
18.2.25 PRIVATELOG A loader that's used to drop Winnti RAT (aka DEPLOYLOG) which, in turn, delivers a kernel-level rootkit named WINNKIT by means of a rootkit installer MALWARE Rootkit
18.2.25 CUNNINGPIGEON A backdoor that uses Microsoft Graph API to fetch commands – file and process management, and custom proxy – from mail messages MALWARE Backdoor
18.2.25 WINDJAMMER A rootkit with capabilities to intercept TCPIP Network Interface, as well as create covert channels with infected endpoints within intranet MALWARE Rootkit
18.2.25 SHADOWGAZE A passive backdoor reusing listening port from IIS web server MALWARE Backdoor
18.2.25 XCSSET Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that targets users by infecting Xcode projects, in the wild. MALWARE MacOS
18.2.25 Golang Backdoor Telegram Abused as C2 Channel for New Golang Backdoor MALWARE Backdoor
10.2.25 FINALDRAFT From South America to Southeast Asia: The Fragile Web of REF7707 MALWARE Malware
10.2.25 NAPLISTENER NAPLISTENER: more bad dreams from developers of SIESTAGRAPH MALWARE Malware
10.2.25 BadIIS This blog post details our analysis of an SEO manipulation campaign targeting Asia. We also share recommendations that can help enterprises proactively secure their environment. MALWARE Malware
10.2.25 ASPXSpy ASPXSpy is a Web shell. It has been modified by Threat Group-3390 actors to create the ASPXTool version. MALWARE Malware
10.2.25 Malicious ML models Malicious ML models discovered on Hugging Face platform MALWARE AI
10.2.25 ValleyRAT Rat Race: ValleyRAT Malware Targets Organizations with New Delivery Techniques MALWARE RAT
10.2.25 Sliver Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor MALWARE Backdoor
10.2.25 SparkCat Take my money: OCR crypto stealers in Google Play and App Store MALWARE Android
5.2.25 RDP Wrapper Persistent Threats from the Kimsuky Group Using RDP Wrapper MALWARE Wrapper
5.2.25 AsyncRAT AsyncRAT Reloaded: Using Python and TryCloudflare for Malware Delivery Again MALWARE RAT
5.2.25 FERRET macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed MALWARE macOS
5.2.25 boltdb-go Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for Persistence MALWARE GO Backdoor
5.2.25 Coyote Banking Trojan Coyote Banking Trojan: A Stealthy Attack via LNK Files MALWARE Banking
27.1.25 MintsLoader: StealC MintsLoader: StealC and BOINC Delivery MALWARE Loader
25.1.25 TorNet New TorNet backdoor seen in widespread campaign MALWARE Backdoor

10.1.25

Banshee Stealer Cracking the Code: How Banshee Stealer Targets macOS Users MALWARE MacOS

10.1.25

NonEuclid RAT The NonEuclid Remote Access Trojan (RAT) is a type of malicious software that enables unauthorised remote access and control of a victim’s computer, often without their awareness. MALWARE RAT

2.1.25

Quasar RAT Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts MALWARE RAT