Malware & Threat Intelligence News

827 stories · Updated every 5 minutes · Page 7 of 21

1. MantaxOtax Android Malware Combines Ransomware With Spyware

   Infosecurity Magazine · 10 Sep 2026, 18:30 IST · High severity

   MantaxOtax Android malware combines ransomware with extensive spyware capabilities

2. Fake GTA 6 download delivers malware-packed bundle to impatient gamers

   Help Net Security · 10 Sep 2026, 15:21 IST · Medium severity

   Grand Theft Auto VI (GTA 6) is still three months from release, but cybercriminals are not waiting for the launch date. Security firm Huntress found malware disguised as a leaked copy of the game, aimed at fans hoping to get their hands...

3. OTX Threat: Grand Theft Auto VI hype leads to malware

   AlienVault OTX · 09 Sep 2026, 21:25 IST · High severity

   Threat actors are exploiting anticipation for Grand Theft Auto VI by distributing malicious ISO files disguised as leaked game versions. These fake installers are spread through SEO poisoning, gaming forums, social media, and torrenting...

4. Fake GTA6 ‘Leaked Download’ Caught Spreading RATs, Infostealer and Wiper Ransomware

   IT Security Guru · 09 Sep 2026, 20:27 IST · High severity

   Cybersecurity firm Huntress has uncovered a malware campaign that preys on excitement for Grand Theft Auto VI (GTA6), packaging remote access trojans, an infostealer, and destructive ransomware inside fake “leaked” copies of the hotly...

5. Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA

   The Hacker News · 09 Sep 2026, 19:53 IST · Medium severity

   Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others. Information...

6. OTX Threat: Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files

   AlienVault OTX · 08 Sep 2026, 22:29 IST · Medium severity

   An exposed directory at 188.245.99.156 revealed a comprehensive cryptomining toolkit containing 147 files including Python exploit source code, campaign logs, and Windows registry hives. Analysis confirms 3,562 Redis servers were...

7. F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

   The Hacker News · 09 Sep 2026, 13:06 IST · Medium severity

   Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache loads any of the three appliances'...

8. Is Shai-Hulud back? Researchers spot 'wormy boy' slipping past npm malware scanning features

   IT Pro · 09 Sep 2026, 13:43 IST · Medium severity

   Is Shai-Hulud back? Researchers spot 'wormy boy' slipping past npm malware scanning features

9. OTX Threat: REVSTEALER ramps up: analysis of up-and-coming infostealer

   AlienVault OTX · 06 Sep 2026, 17:38 IST · Medium severity

   An emerging infostealer tracked as REVSTEALER under REF2859 has gained significant momentum with approximately 4,700 samples identified over the past year. The malware features comprehensive credential harvesting capabilities targeting...

10. Attackers spread malware through ScreenConnect file transfers

    Help Net Security · 07 Sep 2026, 14:43 IST · Medium severity

    A file transfer flaw in ScreenConnect Remote Access Support and Access sessions affects both Cloud and On-Premise deployments, ConnectWise confirmed. “A CVE identifier and an official fix will be issued within the week,” the company...

11. JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

    The Hacker News · 07 Sep 2026, 13:23 IST · Medium severity

    Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. "The payloads are protected with...

12. Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast

    Help Net Security · 06 Sep 2026, 13:30 IST · Medium severity

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Anthropic locks out Claude users after infostealers hijack login sessions Anthropic has started locking users out of their Claude accounts...

13. OTX Threat: Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam

    AlienVault OTX · 06 Aug 2026, 23:05 IST · Medium severity

    A sophisticated macOS malware campaign leverages ClickFix social engineering to infect victims. The attack begins with a fake CAPTCHA prompt delivered via email links, tricking users into executing malicious commands in Terminal. This...

14. The hidden work of modernizing Malwarebytes

    Malwarebytes Labs · 04 Sep 2026, 22:45 IST · Medium severity

    Most of the work that keeps a security product trustworthy is invisible. Users see a scan complete, a threat blocked, an update applied overnight. They don’t see the platform underneath.

15. This Week in Security: Baked-in Malware, Freezers Not Freezing, Zoom Snoops Clipboards, and AI Makes Things Worse, Faster

    Hackaday · 04 Sep 2026, 19:30 IST · Medium severity

    The AI platform ServiceNow which offers both hosted and on-premises versions just patched a trifecta of CVSS-10 vulnerabilities . CVSS rankings are determined by the severity of a flaw, the ease of exploiting the bug, if authentication...

16. CrowdStrike Disrupts Sality Botnet After More Than 20 Years

    TechRepublic · 04 Sep 2026, 03:06 IST

    Cybersecurity expert Ken Underhill reports from CrowdStrike on the disruption of the 20-year-old Sality botnet and what security teams need to know. The post CrowdStrike Disrupts Sality Botnet After More Than 20 Years appeared first on...

17. ‘Attackers are steering their botnets with greater precision and control’: DDoS attack numbers might be dwindling, but they’re intensifying

    IT Pro · 04 Sep 2026, 16:06 IST · Medium severity

    ‘Attackers are steering their botnets with greater precision and control’: DDoS attack numbers might be dwindling, but they’re intensifying

18. Microsoft Defender briefly decided Google Search was malware

    TechSpot · 04 Sep 2026, 01:47 IST · Medium severity

    You can pay every month for Office 365's productivity tools, but you still can't escape Microsoft Defender's habit of turning everyday links into fake security alerts. On September 2, Office 365 subscribers ran into an unusual incident:...

19. Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns

    IT Security Guru · 03 Sep 2026, 15:53 IST · Medium severity

    Cybersecurity firm Huntress has uncovered a wave of malicious installations of ScreenConnect, a widely used remote-support tool, that spread between machines without any further action from a victim or an attacker, a self-propagating...

20. BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory

    The Hacker News · 03 Sep 2026, 20:56 IST · Medium severity

    Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. "Unlike the standard...

21. StreamRat Android malware spreads through Meta and TikTok ads

    Malwarebytes Labs · 03 Sep 2026, 21:34 IST · Medium severity

    A malicious advertising campaign promoting a fake free TV-streaming service reached roughly 570,000 Meta users. The researchers who discovered the campaign found that its streaming-themed ads were aimed at Spanish-speaking users, with...

22. Microsoft warns fake CAPTCHA is tricking Windows users into running malware

    TechSpot · 03 Sep 2026, 20:57 IST · Medium severity

    The pages impersonate Cloudflare and other trusted services. Instead of presenting a normal CAPTCHA challenge, they instruct users to open PowerShell or Command Prompt and paste in a command.

23. Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

    The Hacker News · 03 Sep 2026, 16:13 IST · Medium severity

    Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has...

24. Russian man indicted for spreading malware to 80,000 freelancers

    Help Net Security · 03 Sep 2026, 16:13 IST · Medium severity

    A Russian national accused of using fake accounts on a freelance employment platform to spread malware to approximately 80,000 users has been indicted by a federal grand jury in California. Searzhudin Tamirlanovich Aktulaev, 40, faces...

25. No–AI Agents Did Not Build Secret Civilizations Stop Anthropomorphizing Malware

    Hacker News · 03 Sep 2026, 13:15 IST · Medium severity

26. Your threat feed is someone else’s database: What ingesting malware intel at scale takes

    Help Net Security · 03 Sep 2026, 11:00 IST · Medium severity

    The advice is to consume shared threat intelligence. Wire the community feeds into your pipeline. This looks like a fine advice and I agree to it.

27. Russian national facing 20 years for malware campaign that infected 80,000 freelancers

    The Record by Recorded Future · 03 Sep 2026, 00:13 IST · Medium severity

    Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court on Monday after being arrested in Cyprus in May 2025 and extradited to the U.S.

28. A malware installer posing as a legitimate download service is infecting brands across almost every industry — Microsoft Edge, Razer, Kaspersky and more actively imitated

    TechRadar · 02 Sep 2026, 22:20 IST · Medium severity

    A malware installer posing as a legitimate download service is infecting brands across almost every industry — Microsoft Edge, Razer, Kaspersky and more actively imitated

29. OTX Threat: One leftover build path links an infostealer, a remote-access tool, and a ransomware family

    AlienVault OTX · 02 Sep 2026, 04:20 IST · High severity

    A compilation artifact, specifically a developer's home directory path (/home/tcherber/.cargo/), linked multiple malware families including a Rust-based infostealer named Zer0day Stealer, an HVNC remote-control tool, and ENIGMA Locker...

30. Russian Man Extradited Over Malware Campaign Targeting Freelancers

    Infosecurity Magazine · 02 Sep 2026, 20:30 IST · Medium severity

    Russian man extradited to US over malware campaign that targeted 80,000 freelance users

31. Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

    The Hacker News · 02 Sep 2026, 17:52 IST · Medium severity

    Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete...

32. Sality, one of the longest-running botnets, finally gets disrupted

    The Record by Recorded Future · 02 Sep 2026, 17:45 IST · Medium severity

    and European authorities disrupted the long-running botnet Sality, turning the malware’s peer-to-peer architecture against itself to cut thousands of infected computers off from operators.

33. OTX Threat: Sality's P2P Network Turned Against Itself, Cutting Off New Malware Payloads

    AlienVault OTX · 02 Sep 2026, 15:26 IST · Medium severity

    On August 31, 2026, U.S., Bulgarian, Hungarian, and Romanian authorities, collaborating with CrowdStrike and Shadowserver Foundation, successfully disrupted the Sality botnet through a peer-to-peer sinkhole operation. Active since 2003,...

34. OTX Threat: Hackers Weaponize Microsoft Teams Help Desk Calls for Malware and Network Lateral Movement

    AlienVault OTX · 02 Sep 2026, 15:29 IST · Medium severity

    Hackers Weaponize Microsoft Teams Help Desk Calls for Malware and Network Lateral Movement

35. Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

    The Hacker News · 02 Sep 2026, 14:40 IST · Medium severity

    Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016...

36. US charges Russian for infecting 80,000 freelancers with malware

    BleepingComputer · 02 Sep 2026, 14:36 IST · Medium severity

    A California federal grand jury has indicted a Russian national for his role in a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware.

37. Sality botnet infrastructure dismantled in joint global takedown

    BleepingComputer · 02 Sep 2026, 13:30 IST · Medium severity

    International law enforcement agencies and private partners have seized Sality malware infrastructure in a joint action aiming to disrupt and take down the peer-to-peer (P2P) botnet.

38. Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

    The Hacker News · 02 Sep 2026, 12:26 IST · Medium severity

    Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation. The effort was undertaken on August 31, 2026, by authorities...

39. Cops, CrowdStrike disrupt Sality botnet by poisoning the network and diverting into sinkholes

    The Register · 02 Sep 2026, 05:24 IST · Medium severity

    International law enforcement agencies, working with CrowdStrike and Shadowserver Foundation, have disrupted Sality, a 23-year-old peer-to-peer botnet used to deliver malware to more than 15,000 machines worldwide. The botnet has...

40. Cisco routers are being turned into surveillance vantage points to hoover up data on trusted networks — and it's all thanks to this new malware

    TechRadar · 02 Sep 2026, 00:35 IST · Medium severity

    Cisco routers are being turned into surveillance vantage points to hoover up data on trusted networks — and it's all thanks to this new malware