UPDATED
BleepingComputer · · Medium severity
Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware.
The Register · · Critical severity
The public still doesn’t know who is abusing a critical Citrix vulnerability exploited as a zero-day weeks before disclosure, but we now know that the unknown digital intruders have used CVE-2026-88772 to break into government agencies,...
AlienVault OTX · · Medium severity
NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors....
Microsoft Security Blog · · Medium severity
In this article Star Blizzard TTPs observed in 2026 Defending against Star Blizzard and RedFlick-related activity Microsoft Defender detections Hunting queries Indicators of compromise Since January 2026, Microsoft has observed Russian...
Infosecurity Magazine · · Medium severity
RatHat's C2 panel now builds malware and ranks victims with AI across nearly 100 deployments
Infosecurity Magazine · · Medium severity
Microsoft Threat Intelligence warns that NeedyMantis threat actor from China has targeted organizations across a range of industries
SecurityWeek · · Medium severity
The malware framework uses a modular architecture and a custom executable file format for long-term persistence. The post Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft appeared first on SecurityWeek .
darkreading · · Medium severity
The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.
The Hacker News · · Medium severity
RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said...
Microsoft Security Blog · · Medium severity
In this article Observed operators and targeting Malware packaging and distribution NeedyMantis architecture and capabilities Mitigation and protection guidance Hunting queries Indicators of compromise Microsoft Threat Intelligence has...
AlienVault OTX · · Medium severity
An undocumented remote-access Trojan named Kothamine Agent has been discovered with support for over 30 commands, enabling attackers to control infected Windows systems through command execution, file manipulation, and capability...
AlienVault OTX · · Medium severity
A Python-based Malware-as-a-Service builder enables operators to generate customized Windows infostealer executables. The system comprises a builder component and an embedded payload, using Nuitka or PyInstaller compilation to evade...
The Hacker News · · Medium severity
Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that's targeting exposed Docker daemons to deploy an open-source artificial intelligence (AI) agent framework called Hermes Agent. "The implant...
SecurityWeek ·
The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions. The post New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining appeared first on SecurityWeek .
The Hacker News · · Medium severity
Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same...
The Hacker News · · Medium severity
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are...
SecurityWeek ·
Noteworthy stories that might have slipped under the radar: BragJack attack against browser AI assistants, TDengine flaw threatens industrial telemetry uptime, Ubuntu update overhaul. The post In Other News: Clop Leak Site Takeover,...
TechRadar · · Medium severity
This Mac malware is somehow using iCloud calendar invites to try and steal your data
Malwarebytes Labs · · Medium severity
We discovered an undocumented remote-access Trojan (RAT) called Kothamine Agent . It supports more than 30 commands and it gives attackers control of an infected Windows computer: they can run commands, read and change files, and add...
Infosecurity Magazine · · Medium severity
The newly-discovered trojan abuses the Android Accessibility Service to gain control over victim devices and collect sensitive banking credentials
Help Net Security · · Medium severity
A new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, crypto wallet data, and files, according to Kaspersky. Researchers found the malware spreading through a crypto wallet...
SANS Internet Storm Center · · Medium severity
Introduction My previous post on Macfinger ClickFix was two days ago, and this campaign remains active. The more I look into the malware delivered by this campaign, the more I believe it is not a variant of Atomic macOS (AMOS) Stealer...
BleepingComputer · · Medium severity
A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads.
BleepingComputer · · Medium severity
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control.
AlienVault OTX · · Medium severity
RemControl is an Android banking trojan first observed in July 2026 that targets financial institutions across Western Europe, the Middle East, and Canada. The malware is distributed through fake Google Play Store pages advertising...
AlienVault OTX · · Medium severity
North Korea-linked threat actors are conducting Operation Conflict Compass, targeting individuals and organizations focused on Ukraine using spear-phishing emails with malicious ZIP attachments. These contain LNK files disguised as PDFs...
TechRadar · · Medium severity
Massive Chinese hack uses AI agents to steal over 600,000 credit cards and hit hundreds of sites with malware
The Hacker News · · Medium severity
ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a...
HackRead · · Medium severity
Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure.
Help Net Security · · Medium severity
A new Android banking trojan called RemControl tricks victims into installing a fake TV app, then takes control of their phones to steal banking PINs, Group-IB has found. Researchers confirmed that the malware targets customers of more...
AlienVault OTX · · Medium severity
ThreatDown researchers discovered CARBONATO, a Docker botnet that exploits exposed Docker daemons on port 2375. The operation was uncovered through an unauthenticated Docker registry exposed since May 2026, revealing two parallel...
BleepingComputer · · Medium severity
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application.
AlienVault OTX · · Medium severity
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser...
The Hacker News · · Medium severity
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector...
The Hacker News · · Medium severity
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser...
Infosecurity Magazine ·
Qrator found a Windows botnet advertised with AI API draining, credential theft and SOCKS5 proxying
AlienVault OTX · · Critical severity
DarkMe, a Visual Basic 6 spy-RAT previously linked to financially-motivated APT group Water Hydra, was observed in two separate incidents affecting organizations in August 2026. Previously notable for weaponizing zero-day exploits...
AlienVault OTX · · Medium severity
This analysis covers infostealer distribution trends during August 2026, focusing on distribution channels, detection rates, and disguise techniques. Primary infostealers identified include Remus, Vidar, LummaC2, and ACRStealer,...
TechSpot · · Medium severity
The malware, called CLOSEDQUORUM, checks with DeepSeek, Qwen, Mistral and Google Gemini before selecting its next action. It can continue operating if one of those services is unavailable because it can query the others. Cisco Talos...
The Hacker News · · Critical severity
A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved...
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free