UPDATED
HackRead · · Medium severity
Malwarebytes links fake Google and Cloudflare verification pages to shared ClickFix infrastructure delivering StealC, NetSupport and other malware.
NCSC UK Advisories · · Medium severity
A technical analysis of a new variant of the SparrowDoor malware.
Malwarebytes Labs ·
In a joint operation, Google , the FBI, and other partners have dealt a significant blow to the residential proxy ecosystem by disrupting the NetNut (also tracked as Popa) botnet. NetNut is a malicious service built on millions of...
AlienVault OTX · · Medium severity
The BabaDeda loader family has undergone significant advancements in its capabilities, particularly in stealth, evasion, and payload flexibility. Discovered during April 2026, this evolved framework continues to conceal malicious...
Help Net Security · · Medium severity
Malwarebytes Mobile Security for iPhone combines scam prevention, privacy protection, and identity monitoring in a single app. It evaluates a device’s security posture, provides recommendations to improve protection, and is available...
Flashpoint ·
Blogs Blog Identity Is the New Attack Surface: How Infostealers Are Reshaping Enterprise Risk Our new guide explores how infostealers are fueling modern identity-based attacks and how organizations can build a proactive defense before...
Flashpoint · · Medium severity
Blogs Blog Remus Stealer: A New, Not-So-New Infostealer In this post, we explore the emergence of Remus Stealer, analyzing its structural and behavioral similarities to the infamous Lumma malware. SHARE THIS: Flashpoint Intel Team July...
AlienVault OTX · · Medium severity
In April 2026, researchers discovered a malware campaign targeting players of adult-themed games. The infected games install a previously unknown implant called Argamal that downloads and executes a RAT after several days, resulting in...
AlienVault OTX · · Critical severity
This analysis examines Gamaredon's (UAC-0010, Armagedon) advanced espionage operations targeting Ukrainian government, military, and critical infrastructure. The FSB-operated group deploys GammaSteel, a sophisticated stealer operating...
The Hacker News · · High severity
Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls. Avalon...
AlienVault OTX · · Medium severity
A large-scale operation impersonates open-source and freeware projects to capture search traffic, targeting tools such as Ghidra, dnSpy, and SpiderFoot. The professionally designed sites load CloudFront-hosted JavaScript that converts...
Slashdot · · Medium severity
An anonymous reader quotes a report from Ars Technica: Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs with stealthy, custom-developed credential-stealing...
Hackaday · · Medium severity
Unsurprisingly to many of us, app stores for smart televisions are also trash. Perhaps even more full of trash than other app stores due to the smaller ecosystem and fewer reviewers. Spur analyzed the LG smart TV app store, and found...
Malwarebytes Labs · · Medium severity
Cybercriminals are finding new ways to trick people into compromising their own devices and accounts. One campaign used a sponsored ad on X to target Mac users, while another technique, dubbed ConsentFix, steals Microsoft 365 accounts...
HackRead · · Medium severity
The newly spotted PamStealer is spreading through a fake Maccy clipboard app and steal Mac passwords, browser data and clipboard content.
The Register ·
Tech companies working with US law enforcement "significantly degraded" the NetNut residential proxy network as part of an ongoing effort to disrupt the tools cybercriminals use to conceal their activity, say researchers. The work was...
AlienVault OTX ·
PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to...
Tech-Economic Times · · Medium severity
The tech giant said it disabled accounts and services used in NetNut-related malware command-and-control operations and shared technical intelligence on the group's infrastructure with law enforcement and industry partners to...
Ars Technica · · Medium severity
Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs with stealthy, custom-developed credential-stealing code. The malware is delivered in two stages. The first is...
Krebs on Security · · Medium severity
The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut , a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum...
Malwarebytes Labs · · Medium severity
ClickFix attacks, which trick people into running malicious commands themselves , continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single...
9to5Mac · · Medium severity
Jamf Threat Labs, the company’s security research arm, recently shared details of a ClickFix-style attack it spotted running as a sponsored ad on the social media site X. The ad, originating from a well-known account, promoted a...
IT Pro · · Medium severity
Nicole Kobie first started writing for ITPro in 2007. As a freelance journalist covering technology and business, Nicole's work includes bylines in New Scientist, Wired, PC Pro and many more. Nicole the author of a book about the...
The Hacker News · · Medium severity
The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. "In this campaign, the attackers focused their...
AppleInsider · · Medium severity
A newly discovered macOS infostealer verifies Mac login passwords before stealing sensitive data, giving attackers immediate confirmation that compromised credentials will actually work. PamStealer Researchers at Jamf Threat Labs have...
AlienVault OTX · · Medium severity
Since February 2026, a new malware family utilizing a Loader plus Core two-stage architecture has been detected, primarily conducting large-scale DDoS attacks with strong cross-platform capabilities. The family is transitioning from C...
Hacker News · · Medium severity
BleepingComputer · · Medium severity
Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target...
darkreading · · Medium severity
Researchers say the highly effective social engineering technique is no longer the exception for malware attacks — it's now the rule.
BleepingComputer · · Medium severity
Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data.
The Hacker News · · Medium severity
Cybersecurity researchers have flagged a new multi-stage malware delivery attack chain that uses social engineering and Blogger pages to deliver an information stealer called PureLogs. The activity has been codenamed VEIL#DROP by...
TNW · · Medium severity
A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal, using fake PDFs, geofencing, and a payload hidden inside an image to steal credentials without triggering security tools. Fortinet’s...
The Hacker News · · Medium severity
A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks...
Infosecurity Magazine · · Medium severity
Securonix said the Veil#Drop campaign abuses Google Blogspot to deliver PureLog Stealer in memory
Infosecurity Magazine · · Medium severity
FortiGuard says the Brazilian banking trojan Ousaban is targeting Spain and Portugal via phishing
Phoronix · · Medium severity
Last month on Phoronix there were 294 original news articles and 18 Linux hardware reviews / multi-page benchmark articles. Beyond Phoronix.com turning 22 years old in June, there were also a lot of exciting Linux hardware and...
The Hacker News · · Medium severity
Large language models keep inventing web addresses that do not exist. Attackers have started buying those made-up domains before anyone else can, then hosting phishing pages on them to catch traffic that AI tools point their way. Palo...
CXO Insight Middle East · · High severity
New Kaspersky GReAT (Global Research and Analysis Team) research into the rapidly growing ransomware group known as The Gentlemen has shown that the attackers have evolved their tactics through new custom-built tools – a backdoor...
The Hacker News · · Medium severity
ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give...
Slashdot · · Medium severity
Amazon says it is ending sideloading on new Fire Sticks because "apps that facilitate piracy, and other apps, can carry malware," adding that there is "a good amount of evidence" that sideloaded apps may contain unwanted code or...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free