Dutch authorities have successfully dismantled a large botnet that had infected around 17 million devices. The operation involved taking down over 200 servers from a local hosting provider that were crucial to the botnet's functionality. This action is significant as such botnets can be used for various malicious activities, including launching distributed denial-of-service (DDoS) attacks and distributing spam or malware. The disruption not only impacts the cybercriminals behind the botnet but also helps protect the millions of devices that were compromised. By targeting the infrastructure supporting these attacks, the Dutch government aims to enhance overall internet security and reduce the risk of further exploitation of infected devices.
Articles tagged "Malware"
Found 502 articles
Infosecurity Magazine
A recent incident involving an AI-generated npm infostealer has drawn attention after it accidentally exposed its own GitHub token, revealing the identity of its operator. This infostealer, designed to collect sensitive information, had a flaw that led to the leak of the token on a public platform. As a result, researchers were able to trace back to the developer behind the malware, raising concerns about the capabilities of AI tools in creating malicious software. This incident highlights the potential risks associated with the misuse of AI in software development, particularly in the realm of cybersecurity. Developers and users of npm packages should be vigilant about the security of their applications and the code they incorporate from third parties.
BleepingComputer
GreyVibe, a suspected Russian hacking group, has been targeting Ukrainian organizations using advanced techniques involving AI-generated messages. They create enticing lures to trick victims into downloading malware, which is custom-built for their operations. This approach allows them to bypass traditional security measures and effectively compromise systems. The use of AI tools like ChatGPT and Gemini in these cyberattacks raises concerns about the evolving nature of threats, particularly in geopolitical contexts. Organizations in Ukraine need to bolster their security protocols to defend against these sophisticated tactics.
BleepingComputer
Hackers are exploiting a vulnerability in FortiClient Enterprise Management Server (EMS), identified as CVE-2026-35616, which allows them to bypass authentication. This flaw is being used to deliver a credential-stealing malware known as EKZ. Organizations using FortiClient EMS are at risk, as attackers can gain unauthorized access to sensitive information through this exploit. The situation is concerning since the malware targets credentials, potentially leading to further data breaches. Companies should prioritize patching this vulnerability to protect their systems and data from compromise.
Security Affairs
CVE-2026-35616A recently identified vulnerability in FortiClient Endpoint Management Server (EMS), tracked as CVE-2026-35616, is being actively exploited to deploy information-stealing malware, according to a report from Arctic Wolf. This flaw has a high severity rating of 9.1 and allows attackers to execute remote code without needing authentication, making it particularly dangerous. Organizations using FortiClient EMS should be on high alert as the vulnerability can be exploited through specially crafted requests. The vulnerability was patched in April, but the ongoing exploitation highlights the importance of timely updates and monitoring for suspicious activity. Companies must ensure they have applied the latest patches to protect their systems from these attacks.
Infosecurity Magazine
Recent research shows that cybercriminals have shifted tactics from typosquatting—where they create malicious packages with misspelled names—to developing more sophisticated open source packages that closely mimic legitimate code. This new approach allows attackers to trick users into downloading and installing harmful software without them realizing it. The implications are significant, as developers and organizations relying on open source software may inadvertently use these compromised packages, leading to potential data breaches or system vulnerabilities. Users must remain vigilant and verify the authenticity of packages before installation to prevent falling victim to these impersonation tactics.
A new cyber campaign has emerged, targeting cryptocurrency firms through deceptive recruitment tactics and custom malware designed for macOS systems. Researchers from Wiz have identified this threat actor, known as JINX-0164, which employs social engineering to lure victims into downloading malicious software. The malware is tailored to exploit continuous integration and continuous deployment (CI/CD) infrastructures, increasing the risk of digital asset theft for affected organizations. As cryptocurrency firms often handle significant amounts of valuable digital assets, these attacks could lead to substantial financial losses and damage to their reputations. Companies in the crypto space need to be vigilant and enhance their security measures to protect against these sophisticated threats.
Recent research has uncovered a long-running cybercrime operation targeting fans of pirated books, movies, and TV shows. In 2026, experts identified new websites associated with this gang, attracting tens of millions of visitors. These sites have been linked to malware distribution, including a Remote Access Trojan (RAT) that allows attackers to control infected devices. This situation poses significant risks for users who access these pirated materials, as they may unknowingly download harmful software. It's crucial for consumers to be aware of these dangers and consider the security implications of engaging with pirated content.
Hackread – Cybersecurity News, Data Breaches, AI and More
Iran's Nimbus Manticore hacking group has been targeting US companies by distributing trojanized installers of Zoom, a popular video conferencing software. This malicious tactic is part of a broader cyber campaign linked to the Iranian Revolutionary Guard Corps (IRGC). By disguising malware within legitimate software, the attackers aim to infiltrate and compromise sensitive networks of various firms. This incident raises significant concerns about the security of widely used applications and highlights the potential risks associated with downloading software from unverified sources. Companies should be vigilant and ensure their software is obtained from trusted platforms to avoid falling victim to similar attacks.
Recent reports from WatchGuard and ESET reveal two banking trojan campaigns targeting users in Latin America and Europe. The Grandoreiro malware is aimed at Windows devices, while the BTMOB RAT is designed for Android users. These campaigns specifically target companies in Spain, Portugal, and Mexico, as well as mobile users in Brazil. The malware's ability to siphon sensitive financial information poses a significant risk to both businesses and individual users. As cybercriminals continue to adapt their tactics, it's crucial for users to remain vigilant and implement security measures to protect their devices and data.
Researchers have discovered a new attack method called 'SymJack' that exploits AI coding agents. By using malicious repositories and deceptive symlinks, attackers can trick these AI systems into installing compromised servers under their control. This allows the attackers to steal sensitive information, disrupt continuous integration pipelines, and inject harmful code into software projects. The implications are significant, especially for companies relying on AI tools for software development, as it exposes them to supply chain attacks that can go unnoticed. Developers and organizations need to be vigilant about the sources of their code and the integrity of the tools they use.
SecurityWeek
Security firms have successfully disrupted the GlassWorm botnet by taking down all four command-and-control channels that the malware relied on. This operation is significant because botnets like GlassWorm can be used by attackers for various malicious activities, such as launching distributed denial-of-service (DDoS) attacks or spreading other malware. By dismantling these C&C channels, researchers have reduced the botnet's ability to control infected devices, which is a win for cybersecurity efforts. This disruption not only impacts the operators of the botnet but also protects potential victims from being exploited. As the threat landscape evolves, ongoing vigilance against such malware remains crucial for both individuals and organizations.
Infosecurity Magazine
FortiGuard Labs has reported on a new campaign involving the PureLogs malware, which uses techniques like JavaScript, PowerShell, and process hollowing to steal sensitive data. The attackers lure victims through fake purchase orders, tricking them into providing confidential information. This tactic poses a significant risk to organizations that handle financial transactions or sensitive data, as it can lead to data breaches and financial losses. Companies should be vigilant and educate their employees about these types of scams to prevent falling victim to such attacks. The ongoing nature of this campaign highlights the need for continuous awareness and cybersecurity training.
A new malware strain known as 'Megalodon' has infiltrated over 5,500 GitHub repositories in a matter of hours. This campaign involved the insertion of malicious code that steals sensitive information, including developer credentials and secrets. The rapid spread of this malware poses a significant risk to developers and organizations using these repositories, as compromised credentials can lead to further security breaches. GitHub users need to be vigilant and review their repositories for any unauthorized changes. This incident serves as a stark reminder of the vulnerabilities that can exist within widely used platforms, necessitating increased security measures.
TeamPCP, the group behind the Shai-Hulud worm, has caused considerable disruption within the open source community. Their actions have raised concerns about the security of open source software, which is widely used across various platforms and applications. While there is some debate about whether the team's actions stem from sheer luck or actual skill, the consequences are clear: numerous projects and developers are facing challenges in maintaining the integrity of their software. This incident underscores the need for improved security practices in open source development, as vulnerabilities can lead to widespread damage if not addressed promptly. The ongoing scrutiny of TeamPCP's methods and the worm's impact on the ecosystem will likely inform future security measures in open source projects.