ALERTS OCTOBER 2026 2025 2024 2023 2022
HOME AI
APT
BOTNET
CAMPAIGN
CRIME
CRYPTOCURRENCY
EXPLOIT
HACKING
GROUP
OPERATION
PHISHING
RANSOM
SPAM
VIRUS
VULNEREBILITY
| 2024
2025
2026 January(30)
February(48)
March(53)
April(50)
May(50)
June(41)
July(43)
August(52) SEPTEMBER(39)
October(33)
November(0)
December(0)
DATE |
NAME |
INFO |
CATEGORY |
SUBCATE |
|
24.10.26 |
Fake Japanese Apps Deliver Black Hawk Android RAT | STAR Labs has published a report on a recent Android malware campaign utilizing a WebSocket Remote Access Trojan (RAT) managed via control panels branded as Black Hawk or Eagle. The financially motivated threat actors distribute lightweight dropper apps disguised as well-known Japanese entities—including tax services, retail platforms, and messaging applications—as well as fake investment opportunities. | ALERTS | VIRUS |
|
24.10.26 |
PHP2Shell Vulnerabilities Allow Remote Code Execution in PHP Runtimes | A pair of critical security flaws in the core PHP runtime engine, collectively designated PHP2Shell, have been disclosed. Tracked as CVE-2026-109618 and CVE-2026-109619, both are use-after-free conditions during out-of-memory error handling and request cleanup inside default PHP components, including upload-progress functions and request parsers. | ALERTS | VULNEREBILITY |
|
24.10.26 |
BRONZE SANDCASTLE Uses DLL Sideloading to Deploy Custom Meterpreter-Style Backdoor | Researchers at the Sophos Counter Threat Unit recently reported on BRONZE SANDCASTLE, a China-based threat cluster active against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Research details how the group pairs legitimate signed executables, such as Sandboxie binaries, with a malicious DLL to sideload and decrypt an encrypted configuration payload directly in memory. | ALERTS | APT |
|
24.10.26 |
Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks | Attackers have built an autonomous offensive agent that hunts the internet for exposed large language models (LLMs) and hijacks them to power a self-directed cybercrime operation. Once connected to an unprotected model, the agent is instructed to scan for new targets, exploit common web frameworks, steal databases and credentials, and quietly install cryptocurrency miners, for up to 100,000 steps and without asking a human for approval. The owner of the hijacked model pays for the computing power, while the servers the agent breaks into are stripped of data and put to work mining. | ALERTS | AI |
|
21.10.26 |
ROMULUS Delivers Payloads Through ClickFix | Researchers at Forescout recently reported on a multi-payload delivery framework named ROMULUS that leverages social engineering lures based on the ClickFix technique. The threat platform acts as a flexible backend that orchestrates staging scripts and trojanized installer packages to compromise victim endpoints. | ALERTS | VIRUS |
|
21.10.26 |
QuartzLine Zenith Backdoor | The researchers from Expel reported on a malicious program known as QuartzLine, that disguises itself as a fully functional PDF reader for Windows systems. Because the application operates as expected, victims rarely suspect foul play or remove the software. | ALERTS | VIRUS |
|
21.10.26 |
Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries | Russian espionage group Swallowtail (aka APT28, Fancy Bear, Forest Blizzard) targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. All three targets were likely to hold information of direct interest to a foreign intelligence service. | ALERTS | APT |
|
21.10.26 |
GhostProfile MacOS malware | Cybersecurity analysts at Moonlock Lab recently examined a novel macOS threat named GhostProfile. Classified as a hidden Virtual Network Computing (hVNC) strain, this malware covertly duplicates local Chrome and Firefox user profiles. | ALERTS | VIRUS |
|
20.10.26 |
KGB RAT - a commodity malware sold as Malware-as-a-Service | Cybersecurity experts at Group-IB recently examined KGB RAT, a Windows malware strain advertised on dark web forums since late 2025. Disguised as a standard system administration utility, KGB RAT is distributed under the Malware-as-a-Service (MaaS) model and stands out by combining traditional espionage and extortion tools - such as password harvesting, keystroke logging, desktop control, and file encryption with a number of psychological harassment capabilities including forced BSODs and screamer functions. | ALERTS | VIRUS |
|
20.10.26 |
UAT-6275 Intrusion Activity Directed Against CIS Government Agencies | In a recent write-up, Cisco Talos details espionage operations conducted by UAT-6275 targeting public sector, environmental, and energy organizations across the Commonwealth of Independent States. The threat group relies on multiple initial distribution methods, including malicious Word documents, PS2EXE downloaders, shortcut files, and archive payloads leveraging a WinRAR vulnerability (CVE-2025-8088). | ALERTS | APT |
|
20.10.26 |
Hirudo Android Malware | Security researchers at ThreatFabric reported on "Hirudo," an advanced Android financial malware that merges real-time device hijacking with credential harvesting. Unlike typical mobile trojans that simply superimpose counterfeit login windows over legitimate software, Hirudo uninstalls legitimate financial applications and substitutes them with tampered versions engineered to internally bypass security defenses, such as Play Integrity checks and signature verifications. | ALERTS | VIRUS |
|
20.10.26 |
Aoki: Infostealer Targets AI Coding Assistant Credentials | The Aoki (aka Aokigahara) infostealer has begun stealing credentials for AI coding assistants. Recent versions of Aoki analyzed by the Symantec Threat Hunter Team were designed to harvest credential and session files for Claude, OpenAI's Codex, Cursor, Codeium and Gemini, alongside the browser, cryptocurrency wallet and password manager data that infostealers typically collect. | ALERTS | VIRUS |
|
20.10.26 |
MATCHBOIL Downloader Evolving in Targeted Campaign Against Ukrainian Entities | According to ESET Research, UAC-0099, a Russian aligned threat actor group, has been developing and deploying the MATCHBOIL downloader since about 2024. It targets Ukrainian government, financial and media organizations and may serve as an initial access broker for Sandworm. The infection chain starts with a spearphishing link that downloads an archive containing a VBScript. | ALERTS | VIRUS |
|
20.10.26 |
Another phishing campaign distributing AgentTesla observed in the wild | Security researchers at ASEC recently uncovered a new phishing campaign distributing the AgentTesla malware. Attackers lure victims with emails masqueraded as commercial proposal inquiries, urging recipients to evaluate an attached compressed archive for product pricing and inventory details. Instead of a legitimate document, this archive conceals a malicious .NET executable. | ALERTS | CAMPAIGN |
|
20.10.26 |
XWorm Malware Evolves Into Advanced Surveillance Platform | In a recent write-up, Netskope Threat Labs details how XWorm has transformed from a conventional information stealer into an intrusive surveillance toolkit. Due to publicly leaked builder binaries and source code, detection volume for the malware expanded fourfold, with significant focus on the financial sector. | ALERTS | VIRUS |
|
20.10.26 |
Warden Stealer | Gen Threat Labs has published a report on Warden Stealer, a Rust-based malware-as-a-service infostealer targeting configuration files and local data belonging to AI assistants and agentic coding tools. Distributed through cracked software, game cheats, malvertising, and ClickFix campaigns, the malware heavily obfuscates its builds using code morphing to bypass security scans. | ALERTS | VIRUS |
|
20.10.26 |
Fake GitHub sign-in alerts used to steal developer OAuth tokens | According to Apiiro, security researchers observed a massive automated campaign re-arming a fleet of more than 17,000 malicious GitHub repositories linked to the FakeGit ecosystem. Skipping the need for new infrastructure, the threat actor utilizes a tactic termed RePointing, executing rapid, automated commits to update existing project README files so their download links redirect to fresh ZIP archives. | ALERTS | HACKING |
|
10.10.26 |
FakeGit Infrastructure Re-Armed in Large-Scale RePointing Campaign | According to Apiiro, security researchers observed a massive automated campaign re-arming a fleet of more than 17,000 malicious GitHub repositories linked to the FakeGit ecosystem. Skipping the need for new infrastructure, the threat actor utilizes a tactic termed RePointing, executing rapid, automated commits to update existing project README files so their download links redirect to fresh ZIP archives. | ALERTS | CAMPAIGN |
|
10.10.26 |
Earth Sirrush Espionage Group Refines Toolset Against Ukrainian Targets | Researchers at TrendAI recently reported on Earth Sirrush, a Russia-aligned intrusion set, also tracked as UAC-0099 and previously as SHADOW-EARTH-065, that has run espionage operations since at least 2022. Its targets are mainly Ukrainian government bodies, defense organizations, border units and logistics operators, reached through spear-phishing lures that pose as the national police, border guard, tax and justice authorities. | ALERTS | APT |
|
10.10.26 |
AI-Branded Ad Phishing campaign | In a recent write-up, researchers at Island detail a human-operated phishing platform disguised as a range of AI advertising products, including a fake "Muse Ads" tool that went live eight days after Meta announced Muse. The campaign targets agency staff, media buyers and Google Ads manager-account administrators, whose accounts carry stored payment methods and access to multiple client accounts. Victims arrive through invitation emails at a branded product page. | ALERTS | PHISHING |
|
10.10.26 |
Targeted Intrusion Campaign Leverages Trojanized Coding Assessments | Researchers at Unit 42 from Palo Alto Networks recently reported on an intrusion campaign designated as Blinder Tunnel, which targeted critical infrastructure entities in Iraq. The threat actor behind the activity impersonated the IT department of an aviation enterprise to deliver trojanized coding assessments to targeted individuals. | ALERTS | HACKING |
|
10.10.26 |
Cling botnet | In a recent write-up, Nozomi Networks details a novel botnet dubbed Cling that targets internet-exposed IoT and networking devices. Per the report, initial access relied on exploiting a known vulnerability in Realtek Jungle SDK diagnostic components (CVE-2021-35394) alongside multiple command-injection flaws across router and CCTV products. | ALERTS | BOTNET |
|
10.10.26 |
BPFDoor and AVERAT activity continues | Researchers at Rapid7 recently reported a cluster of Linux malware targeting telecom and network-edge environments with regionalized process spoofing. The activity involves a dropper that deploys customized builds of BPFDoor, BPF Rekoobe, and a new modular implant tracked as AVERAT. | ALERTS | VIRUS |
|
10.10.26 |
Vidar and Remus infostealers distributed with help of new 2CLoader | Zscaler ThreatLabz uncovered a previously undocumented loader malware dubbed 2CLoader. This modular loader has been observed facilitating the delivery of credential-harvesting tools including Vidar and Remus, alongside the XWorm malware strain. | ALERTS | VIRUS |
|
2.10.26 |
Malicious packages posing as KakaoTalk messaging app installers | ASEC Ahnlab researchers reported about an evolution of recently monitored campaigns where adversaries are manipulating search engine optimization (SEO) to steer unsuspecting users toward counterfeit KakaoTalk installers. The packaging of these trojanized setup packages progressively shifted across NSIS, Advanced Installer, and Inno Setup formats, bundling authentic software alongside malicious components. | ALERTS | VIRUS |
|
2.10.26 |
Antino Malware Targets Asian Governments | In a recent write-up, Cisco Talos details UAT-11587, a China-nexus cluster active since September 2025 that delivers a previously undocumented Rust backdoor named Antino. The targets are government, defense, diplomatic, legislative and research organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria. | ALERTS | VIRUS |
|
2.10.26 |
CloudSyncD macOS Backdoor Delivered via Fake Zoom Installer | According to Jamf Threat Labs, researchers discovered a two-stage macOS backdoor dubbed CloudSyncD that arrives hidden inside fake Zoom application installers. The malicious dropper convinces users into bypassing Gatekeeper protections and entering their system password | ALERTS | VIRUS |
|
2.10.26 |
Warlock ransomware targets water and telecom operators | The China-nexus group behind Warlock ransomware is still breaking into organizations through Microsoft SharePoint vulnerabilities, a tactic that brought it to prominence a year ago. In the past two months, the group, which Symantec tracks as Longlegs (aka Storm-2603), attacked at least four organizations in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. | ALERTS | RANSOM |
|
2.10.26 |
BotHelper RAT | Researchers at Point Wild recently reported a new malware family dubbed BotHelper, a .NET remote access trojan equipped with real-time desktop monitoring functions. Targeting Windows environments, the infection begins with a native executable stager that fingerprints the host machine and intentionally disables TLS certificate validation to retrieve an encrypted payload from a remote server. | ALERTS | VIRUS |
|
2.10.26 |
Brimstone APT Delivers ComicPulse Backdoor Through RedFlick Technique | Researchers at Microsoft Threat Intelligence recently reported on evolving cyberespionage tradecraft from the Russian state-sponsored group Brimstone (aka Star Blizzard). The group has pivoted from narrow spear-phishing toward broader initial-contact email operations while adopting compromised host platforms to distribute malicious content. | ALERTS | APT |
|
2.10.26 |
Multi-stage attack leveraging KMS Auto that leads to scareware | A recent K7 Security Labs investigation highlights a multi-phase intrusion campaign wherein adversaries leverage KMS Auto, which is an an unofficial third-party utility used to bypass licensing and activate various Microsoft products. | ALERTS | SPAM |
|
2.10.26 |
LxBase RAT Hits Russian Firms | In a recent write-up, BI.ZONE Threat Intelligence details a new campaign deploying LxBase RAT against Russian organizations. Between July and September 2026, attackers targeted a wide array of domestic industries, including finance, energy, retail, logistics, and engineering. | ALERTS | VIRUS |
|
2.10.26 |
New PamStealer Variant Targets macOS Users | A new variant documented by Jamf Threat Labs targets macOS environments with an upgraded version of the PamStealer infostealer. Attackers trick users into downloading a malicious disk image by impersonating a multichain cryptocurrency wallet called Wavel. | ALERTS | VIRUS |