Updated logoUPDATED

Malware & Threat Intelligence News

826 stories · Updated every 5 minutes · Page 3 of 21

  2. CastleStealer: An Emerging Infostealer Growing More Sophisticated

    Flashpoint · · Medium severity

    Table Of Contents Table of Contents What We Know About CastleStealer What Data Does CastleStealer Target? Bypassing App-Bound Encryption From Infostealer to Remote Access How CastleStealer Exfiltrates Stolen Data Protect Against...

  6. OTX Threat: Canto incognito: tracking the PoeLLM malware

    AlienVault OTX · · Medium severity

    Since April 2026, PoeLLM malware has been actively targeting exposed AI/LLM and open-source services including LiteLLM, Ollama, Gotenberg, and Gitea, with possible Ivanti Sentry targeting. The campaign employs an unusual...

  7. OTX Threat: The state of AI-analysis evasion in malware

    AlienVault OTX · · Medium severity

    Malware authors are developing techniques to obstruct automated AI analysis by embedding natural-language instructions within their code. This 'AI-analysis evasion' targets the pipeline that extracts text from samples and submits it to...

  8. Some cheap Android phones are shipping with malware baked in

    Android Authority · · Medium severity

    TL;DR Researchers have uncovered a malware campaign affecting some low-cost Android phones, including devices from Doogee and Cubot. Dubbed Midnight Mimosa, the malware is embedded in device firmware and can install apps, grant...

  9. Thousands of cheap Android phones shipped with ad-fraud malware

    The Record by Recorded Future · · Medium severity

    "It’s on the phone before the owner switches it on for the first time, and it can’t be uninstalled," researchers at Bitdefender said about ad fraud malware found on thousands of cheap Android devices.

  14. Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers

    The Register · · Medium severity

    A suspected Italian attacker armed with a malware-controlling poem has infected more than 3,000 servers since April, breaking into enterprise AI infrastructure to mine cryptocurrency and add compromised systems to its growing botnet....

  15. PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

    The Hacker News · · Medium severity

    Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miners and...

  18. How to secure your Android phone against scams, malware and theft?

    Innovation Village | Technology, Product Reviews, Business · · Medium severity

    Cybercrime is evolving at an unprecedented rate, driven largely by advances in artificial intelligence and increasingly sophisticated attack methods. According to a 2025 study by the Pew Research Center , nearly three-quarters of...

  21. FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware

    SecurityWeek · · Medium severity

    An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026. The post FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware appeared first on...

  22. New Linux malware turns vulnerable IoT devices into proxy nodes

    CSO Online Security · · Medium severity

    A new Linux backdoor is turning vulnerable internet-facing devices into remotely controlled proxy nodes, while using the public Session Traversal Utilities for NAT (STUN) infrastructure to blend into normal VoIP and WebRTC traffic....

  23. Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

    SecurityWeek · · Medium severity

    Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign. The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek .

  24. OTX Threat: A STUNning Disguise: Cling Malware Masquerades as Google

    AlienVault OTX · · Medium severity

    A sophisticated IoT botnet dubbed Cling has been discovered exploiting vulnerable internet-exposed devices through CVE-2021-35394 and other command-injection flaws. The malware distinguishes itself by abusing STUN protocol traffic and...

  26. Malwarebytes Scam Link Check analyzes URLs and explains potential risks

    Help Net Security · · Medium severity

    Malwarebytes has launched the Malwarebytes Scam Link Check, a free web tool that lets anyone check whether a website link is safe or dangerous before clicking it. Users paste any suspicious URL, the kind that arrives by text, email,...

  27. Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

    The Hacker News · · Medium severity

    Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because it introduces...

  29. OTX Threat: XWorm Malware: Worming Its Way From Entry to Exploitation

    AlienVault OTX · · High severity

    XWorm is a versatile modular malware that poses a multifaceted threat through remote access, data theft, ransomware delivery, and botnet creation. Associated with the DDGroup cybercrime group, it rapidly gained notoriety for using...

  31. OTX Threat: 2CLoader: A New Malware Loader Delivering Vidar and Remus

    AlienVault OTX · · Medium severity

    In August 2026, a new loader designated 2CLoader was identified being used to distribute information stealers including Vidar and Remus, along with XWorm RAT. The loader implements extensive anti-analysis capabilities including anti-VM,...

  32. Malwarebytes earns another Top Product award in independent testing

    Malwarebytes Labs · · Medium severity

    Every few months, Malwarebytes gets a chance to test its mettle against real-world threats in an independent laboratory setting. And the latest round of results gives us plenty to celebrate. Malwarebytes earned a perfect 18 out of 18...

  34. A real ChatGPT page is being used to trick people into installing malware

    Android Authority · · Medium severity

    TL;DR Attackers created a fake ChatGPT model called “Plus 5.6” on the real ChatGPT website. It sent users to a fake security check that tricked them into running a malicious Windows command. That command could install malware that could...

  35. US sanctions 10 over ATM malware scheme tied to Tren de Aragua

    The Record by Recorded Future · · Medium severity

    Treasury’s Office of Foreign Assets Control (OFAC) targeted multiple Venezuelan nationals and several companies they control that are part of the effort to launder the money stolen from dozens of ATMs.

Get these stories the moment they break

Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.

Join Updated free

Tech news by section

Tech news by region

Trending topics