Back to all threats

Hackers Hijack Blender 3D Assets to Deploy StealC V2 Data-Stealing Malware

The Hacker News
Actively Exploited

Summary

Cybersecurity researchers have identified a campaign that exploits Blender Foundation files to distribute StealC V2, a data-stealing malware. This operation has been ongoing for at least six months, posing significant risks to users who download infected .blend files from platforms like CGTrader.

Original Article Summary

Cybersecurity researchers have disclosed details of a new campaign that has leveraged Blender Foundation files to deliver an information stealer known as StealC V2. "This ongoing operation, active for at least six months, involves implanting malicious .blend files on platforms like CGTrader," Morphisec researcher Shmuel Uzan said in a report shared with The Hacker News. "Users unknowingly

Impact

Blender Foundation files, .blend files, CGTrader platform

In the Wild

Yes

Timeline

Ongoing since at least six months

Remediation

Users should avoid downloading .blend files from untrusted sources and ensure their cybersecurity measures are up to date.

Related Coverage

Security Affairs newsletter Round 553 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

The article discusses a dual campaign targeting GlobalProtect portals and SonicWall APIs, highlighting a critical XXE vulnerability found in Apache software. This vulnerability poses a significant risk, necessitating immediate attention from affected organizations to mitigate potential exploitation.

Dec 7, 2025

Portugal updates cybercrime law to exempt security researchers

BleepingComputer

Portugal has updated its cybercrime law to provide a legal safe harbor for security researchers engaged in good-faith hacking, thereby allowing them to operate without fear of prosecution under specific conditions. This change aims to encourage responsible security research and enhance overall cybersecurity in the country.

Dec 7, 2025

Week in review: React, Node.js flaw patched, ransomware intrusion exposes espionage foothold

Help Net Security

The article highlights recent developments in cybersecurity, including a patched flaw in React and Node.js, as well as a ransomware intrusion that has revealed an espionage foothold. These incidents underscore the ongoing challenges in securing software frameworks and the risks posed by cyber threats to sensitive information.

Dec 7, 2025

Attackers launch dual campaign on GlobalProtect portals and SonicWall APIs

Security Affairs

A hacking campaign has been targeting GlobalProtect logins and scanning SonicWall APIs since December 2, 2025. The attack is significant due to its scale, involving over 7,000 IP addresses linked to a German hosting provider, indicating a coordinated effort that poses a serious threat to the security of affected systems.

Dec 6, 2025

Researchers Uncover 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks

The Hacker News

Over 30 security vulnerabilities have been identified in AI-powered Integrated Development Environments (IDEs), collectively termed IDEsaster. These vulnerabilities combine prompt injection techniques with legitimate features, allowing for potential data exfiltration and remote code execution, posing significant risks to developers and organizations using these tools.

Dec 6, 2025

Your smart home is at risk - 6 ways to protect your devices from attack

Latest news

This article discusses the cybersecurity risks associated with smart home devices and emphasizes the importance of minimizing entry points to enhance security. It highlights the growing concern over vulnerabilities in smart home technology and the potential for unauthorized access and attacks.

Dec 6, 2025