UPDATED
BleepingComputer · · High severity
Attackers are adapting established techniques to AI platforms, emerging technologies, and changing user behavior. ESET's new threat report examines the rise of malicious AI skills, AI-assisted malware, ClickFix attacks, record quishing...
BleepingComputer · · Medium severity
The Arch Linux project has temporarily disabled adoption of Arch User Repository (AUR) packages after a surge in malicious takeovers of existing packages.
TechSpot · · Medium severity
The developer, who goes by the handle Bogdan_X, told Windows Latest that his research began after he spotted a fake website mimicking the official Wintoys page. Tracing the site's registration led him to 72 fraudulent websites built on...
Help Net Security · · Medium severity
A new Mirai-derived IoT botnet can force an infected Linux device to reboot once its main process is killed, giving its persistence mechanisms another opportunity to relaunch it, Nozomi Networks Labs has found. The malware, dubbed...
Help Net Security · · Medium severity
Stairwell, the AI SOC that stops breaches no one else can, today announced the availability of Backstory, an agentic investigation platform that traces related malware variants, identifies affected systems, and maps the full blast...
AlienVault OTX · · Medium severity
Two npm beta releases in the @joyfill namespace were compromised with an import-time JavaScript implant that uses blockchain transactions on Tron, Aptos, and BNB Smart Chain to retrieve encrypted payloads. The malicious code leads to a...
AlienVault OTX · · Medium severity
Since Q1 2026, an emerging botnet named Dysphoria has amassed over 200,000 compromised hosts through rapid technical iterations spanning jackskid and fbot variants. The botnet employs sophisticated blockchain-based command and control...
Help Net Security · · Medium severity
A phone backup app asks for storage, contacts, SMS, and call logs. A device-management tool asks for more than that. Run either one past a machine learning malware scanner and it comes back flagged.
HackRead · · Medium severity
PhantomEnigma abuses Brazilian government websites and trusted email channels to spread malware, target banks, evade security checks, and maintain access.
The Hacker News · · Medium severity
A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to...
AlienVault OTX · · Medium severity
Mirage Kitten, an advanced persistent threat group also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore, has been observed deploying a previously undocumented malware set targeting aerospace, aviation, defense, and...
Malwarebytes Labs · · Medium severity
Nearly half of people encounter a scam on their phone every single day. Malwarebytes is doing something about it. That figure comes from a 2025 Malwarebytes survey of 1,300 respondents across the US and Europe.
The Record by Recorded Future · · Medium severity
On Sunday, AnMed published a statement online saying they were “experiencing a cybersecurity disruption involving malware” and were working to restore systems and determine the scope of the incident.
The Hacker News ·
Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The...
TechCentral · · Medium severity
Behavioural tools can compensate, but new approaches to AI injection attacks are needed, says Kaspersky.
SecurityWeek · · Medium severity
The malware-as-a-service operation launches legitimate browsers on an invisible desktop, giving attackers persistent and covert remote access to compromised Windows systems. The post MedusaHVNC Malware Uses Hidden Windows Desktops to...
The Hacker News · · Medium severity
The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra....
Infosecurity Magazine · · Medium severity
Impersonating well-known cryptocurrency and trading sites, SourTrade has developed a novel technique to drop infostealers to victims
AlienVault OTX · · Medium severity
A fraudulent website impersonating Corepack, the Node.js package manager tool, is distributing malware to developers. The attackers exploit timing around Corepack's removal from Node.js bundling, targeting developers searching for...
Help Net Security · · Medium severity
An automated update tool watches a package registry, catches a new release the moment it publishes, and opens a pull request for your team. That is the job it was built to do. In September 2025, that speed cut the wrong way.
Digital Trends · · Medium severity
A malicious Meccha Chameleon Steam Workshop map was found attempting to download malware onto players' PCs. Here's what happened, why it matters, and how to stay safe.
The Hacker News · · Medium severity
A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant,...
BleepingComputer · · Medium severity
A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs browsers to assemble malware directly in memory.
The Hacker News · · Medium severity
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social...
TechRadar · · Medium severity
Hackers hid dangerous malware on a page hidden in Anthopic's Claude.ai domain
SecurityWeek · · High severity
Noteworthy stories that might have slipped under the radar: Siemens ROX II industrial switch vulnerabilities, Russian Zimbra webmail espionage campaign, Stadler Rail ransomware extortion attempt. The post In Other News: Dolphin X...
AppleInsider · · Medium severity
It takes a very specific series of steps and even then it cannot affect every Mac app, but researchers have found a way to bypass Apple's macOS security and run malware. There is a way to get malware onto your Mac, although it's not...
The Hacker News · · Medium severity
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into...
HackRead · · Medium severity
Dolphin X malware targets more than 300 apps and includes an AI Profiler that scores infected Windows PCs to help criminals identify high-value victims quickly.
BleepingComputer · · Medium severity
A new Dolphin X remote access trojan claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims should be targeted first.
BleepingComputer · · Medium severity
A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware.
BleepingComputer · · Medium severity
Ukraine's CERT has uncovered attacks distributing an archive containing the legitimate Notepad++ application and a malicious utility called LunchPoke disguised as a plugin to establish persistence.
TechRadar · · Medium severity
This devious malware scans over 300 apps to build an AI profile telling hackers which victims to target
SecurityWeek · · Medium severity
SentinelOne’s new benchmark, built on the Fast16 case, shows which AI models can sustain a malware investigation and which cannot. The post Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models appeared first on SecurityWeek .
BleepingComputer · · High severity
The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.
darkreading · · Medium severity
A malicious application delivers four-stage Android spyware via phony Google Play sites, exploiting civilian fear during Iranian missile strikes.
TechRadar · · High severity
A bizarre new malware campaign hacks your printer and forces it to print out ransomware demands
ExtremeTech · · Medium severity
It collects data from eight web browsers, some cryptocurrency wallet extensions, password managers, FTP clients, and shell history—then sends it to the attackers.
AlienVault OTX · · Medium severity
An active Lampion malware campaign has been identified targeting Portuguese users through phishing emails that impersonate financial and administrative communications. Lampion, a Brazilian banking malware derived from the ChePro...
AlienVault OTX · · Medium severity
In July 2026, a sophisticated Go-based botnet named NadMesh was discovered actively deploying across the internet. Unlike traditional worms, it integrates autonomous scanning, exploitation of 20+ vulnerabilities, and targeted harvesting...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free