UPDATED
Every story on Updated that mentions Malware & Threat Intelligence, newest first. Each headline links to a summary page with the original source, so you can scan the topic in under a minute.
AlienVault OTX · · Medium severity
ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums. The malware targets macOS systems running Sierra...
AlienVault OTX · · Medium severity
Attackers compromised camera management software (CMS.exe) to gain initial access to multiple organizational environments. Following compromise, adversaries deployed rs.win32.exe into user AppData directories and leveraged DLL...
AlienVault OTX · · Medium severity
Three malware campaigns using VBScript have been identified targeting victims primarily in Brazil and Portugal through phishing attacks. The campaigns deliver Overlord RAT, Lampion trojan, and an unknown RAT using fake legal notices,...
The Hacker News · · Medium severity
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication...
The Hacker News · · Medium severity
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to...
TechRadar · · Medium severity
Rogue AI agent engages 'Skynet mode' to search the internet for exposed LLMs to hijack and run malware attacks
The Hacker News · · High severity
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation...
TechRadar · · Medium severity
AI agents tricked by a rogue downloads file into running dangerous malware
SecurityWeek · · Medium severity
Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection. The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek .
HackRead · · Medium severity
StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using…
AlienVault OTX · · Medium severity
Aokigahara is a newly identified infostealer with traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications. Its distinguishing feature is...
The Hacker News · · Medium severity
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught...
BGR ·
It may sound impossible, but a recent botnet used poetry -- yes, POETRY! -- to attack more than 3,000 servers and use them to mine cryptocurrency.
Checkpoint Research · · Medium severity
Key Points Aokigahara , a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian . The malware includes traditional data theft capabilities targeting browsers, VPN...
SecurityWeek · · Medium severity
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet. The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared first on...
AlienVault OTX · · Medium severity
In September 2026, an SEO poisoning campaign distributed Armorsteal malware through fake websites impersonating Chocolatey package manager and Microsoft Activation Scripts (MAS) tool. Victims searching for software installation commands...
The Hacker News · · Medium severity
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be...
BleepingComputer · · Medium severity
Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables.
CSO Online Security · · High severity
Hackers hijacked the software release pipeline of LiteLLM, a popular open-source AI gateway, to distribute credential-stealing malware, marking the project’s second supply chain compromise this year despite security measures introduced...
TNW · · Medium severity
ESET linked hackers to Russia, using a decentralised network to hide their malware during an attack on a Ukrainian grain company. The security company says it is the first documented case of a state-linked hacking group using the...
AlienVault OTX · · Medium severity
Attackers leveraged a sponsored Google search result for 'amazon business' to redirect victims to a spoofed Amazon login page hosted on Google Sites. The page presented a fake CAPTCHA (ClickFix) that tricked users into executing a...
BleepingComputer · · Medium severity
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.
Help Net Security · · Medium severity
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed...
AlienVault OTX · · Medium severity
Midnight Mimosa is a widespread Android malware campaign involving malicious applications preinstalled in firmware of low-cost MediaTek-based devices, with infections observed across more than 150 countries. The campaign leverages...
TechSpot · · Critical severity
Hackers are actively exploiting security vulnerabilities in outdated Plex Media Server installations to deploy cryptocurrency miners and proxy malware. Plex confirms widespread attacks against internet-facing servers, with the flaws...
Help Net Security · · Medium severity
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its...
The Hacker News · · Medium severity
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to...
The Hacker News · · Medium severity
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow...
The Hacker News · · Medium severity
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware...
BleepingComputer · · Medium severity
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the...
SecurityWeek · · Medium severity
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures. The post Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks appeared first on...
AlienVault OTX · · Medium severity
Between April and July 2026, attackers compromised AOMEI Technology's update and notification infrastructure to distribute malware to users of AOMEI Backupper, backup software used by over 100 million people worldwide. During three...
Malwarebytes Labs · · Medium severity
The Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology’s update and notification infrastructure in a campaign investigated between April and July. AOMEI Backupper is backup software that the...
The Hacker News · · Medium severity
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude...
CSO Online Security · · Medium severity
Malware is evolving rapidly, driven by advances in AI and changes in computing infrastructures. Security professionals must continuously educate themselves on these trends to defend against increasingly sophisticated threats. The...
TechRadar · · Medium severity
Just when we thought targeted ads couldn't get any worse, these were found serving malware
SecurityWeek · · Medium severity
Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow flaw under attack. The post In Other News: ICS-Sniper Attack, Hacking XWorm...
IT Security Guru · · High severity
Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity....
Help Net Security · · Medium severity
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and...
CSO Online Security · · Medium severity
Fresh research suggests recent panic over AI-generated malware may be overblown. Last month Anthropic detailed how Russia-linked cyberespionage group Midnight Blizzard used Claude to rebuild malware each time security tools flagged its...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free