VulnHub

The Daxin malware, a kernel-mode rootkit first identified in March 2022, has resurfaced, with researchers discovering it operating on a compromised system belonging to a manufacturer in Taiwan in 2026. This malware is particularly concerning because it can provide attackers with deep access to targeted systems, potentially leading to data theft or further exploitation. The resurgence of Daxin suggests that attackers are still actively using and developing sophisticated tools to breach security measures, particularly in regions like Taiwan, which is significant for its role in global technology supply chains. Companies in the region should enhance their defenses and monitor for any signs of compromise to mitigate the risks associated with this malware. The ongoing evolution of threats like Daxin emphasizes the need for continuous vigilance in cybersecurity practices.

A new malware framework named OkoBot has emerged, capable of deploying over 20 different payloads aimed at stealing sensitive data, particularly cryptocurrency wallet seed phrases and user credentials. The framework is designed to infiltrate systems and extract valuable information from users, making it a significant threat to anyone dealing with cryptocurrencies. As cybercriminals increasingly target digital assets, this development raises alarms for individuals and businesses alike. Users are advised to enhance their security measures and remain vigilant against suspicious activities that may indicate an OkoBot attack. The rise of such tools underscores the ongoing risk of data breaches in the cryptocurrency space.

A global phishing campaign has been detected that disguises a Lua loader as a TrueType font file to deploy remote access Trojans (RATs) and information stealers. Attackers are using this method to bypass security measures by making the malicious files appear innocuous. This tactic affects users who may inadvertently open these disguised files, leading to potential data breaches or unauthorized access to systems. The presence of such sophisticated phishing techniques raises concerns about the effectiveness of traditional email security measures. Users need to be vigilant about unexpected email attachments, even if they seem harmless, to avoid falling victim to these types of attacks.

Researchers have discovered a targeted campaign exploiting the ViPNet update system, which is used by several large organizations in Russia. This campaign aims to deliver malicious modules to these entities, potentially compromising their secure networks. The nature of the attack suggests that it is focused on significant targets, indicating a high level of sophistication. With the ViPNet system being integral for secure communications, the implications of this breach could be severe, affecting the integrity of sensitive data and operations. Organizations using this software should be on high alert and consider implementing additional security measures to safeguard against these threats.

Cybersecurity experts have identified a new malware named TELEPUZ that has been spreading since late April 2026 through compromised websites using ClickFix lures. This modular malware is designed to steal data and execute commands on infected systems. Researchers from Elastic Security Labs note that while the number of command-and-control domains associated with TELEPUZ is currently limited, its capabilities raise significant concerns for users and organizations. The lightweight nature of the malware makes it particularly dangerous, as it can easily evade detection. Users visiting infected sites are at risk, making it crucial for individuals and companies to remain vigilant about their online activities and security practices.

A new piece of malware known as ClickLock Stealer is targeting macOS users by forcing them to input their login passwords. This infostealer operates by running a command in the Terminal that creates a fake system dialog asking for the password. If the victim cancels this request, the malware repeatedly kills various applications—including Finder and Terminal—every 210 milliseconds until the password is provided. Once the victim logs in again, the malware installs two LaunchAgents, allowing it to operate silently in the background. This type of attack is particularly concerning as it manipulates user behavior to extract sensitive information, highlighting the need for users to be cautious about unexpected prompts and commands.

Over 20 Brazilian government websites have been hijacked as part of a campaign by a group known as PhantomEnigma. These sites were repurposed to deliver malware, which poses a significant risk to users who visit them. Researchers from ANY.RUN discovered previously unknown backdoor tactics and complex relationships within the cybercriminal infrastructure involved. This incident not only affects the integrity of government websites but also puts the data and security of users at risk, highlighting the ongoing challenges in protecting public digital resources. It serves as a reminder for both users and government agencies to remain vigilant against such attacks.

Kaspersky has reported a new malware called OkoBot that specifically targets cryptocurrency users. The malware masquerades as fake software, tricking users into downloading it. Once installed, OkoBot steals sensitive information such as wallet files, seed phrases, and passwords, while also recording user activity within wallet applications. This poses a significant risk to cryptocurrency holders, as their assets could be compromised. Users need to be cautious about the software they install and ensure they are using legitimate applications to protect their digital currencies.

Daxin, an advanced malware linked to a Chinese threat actor, has been detected again after a four-year gap, this time within a manufacturing firm in Taiwan. This kernel-mode rootkit, identified as 'srt64.sys', was first reported by Symantec in March 2022. Alongside Daxin, researchers have also discovered a new backdoor called Stupig, which has not been previously documented. The resurgence of Daxin raises concerns about targeted attacks on critical infrastructure, particularly in sectors like manufacturing that are vital to the economy. Organizations in Taiwan and similar industries need to be vigilant and reassess their cybersecurity measures to protect against these sophisticated threats.

A group of Russian hackers, known as UAT-11795, is targeting users of popular video conferencing applications like WebEx and Zoom by distributing a trojanized version of their software. This malicious software, identified as Starland RAT, is designed to steal user credentials and cryptocurrency. The attackers are using sophisticated methods to infiltrate these widely used platforms, raising concerns for businesses and individuals who rely on them for communication. The spread of this malware could lead to significant financial losses for victims, as it compromises sensitive information. Users of these applications should be vigilant and ensure they are downloading software from official sources to protect against this threat.

Recently, researchers discovered that five malicious versions of AsyncAPI packages were uploaded to the Node Package Manager (npm). These packages contained a remote access trojan designed to steal user credentials and other sensitive information. This supply-chain attack poses a significant risk, as developers who unknowingly downloaded these infected packages could have their systems compromised. The incident highlights the vulnerabilities within the npm ecosystem and the importance of scrutinizing third-party packages before use. Developers and organizations should be vigilant about the packages they incorporate into their projects to avoid similar attacks in the future.

A phishing campaign that lasted six months used seasonal eCards to trick victims into downloading legitimate Remote Monitoring and Management (RMM) tools. Attackers crafted emails that appeared to be friendly holiday greetings, leading individuals to believe they were receiving festive messages. Instead, these emails contained links that, when clicked, installed RMM software on the victims' devices without their knowledge. This tactic poses a significant risk as it allows attackers to gain remote access to the systems of unsuspecting users, potentially leading to data breaches and further exploitation. Companies and individuals need to be vigilant about unexpected emails, especially those that seem too good to be true, to avoid falling victim to similar attacks.

On July 14, researchers from OX Security revealed that several AsyncAPI npm packages were compromised, leading to the injection of malware capable of stealing information, stealing cryptocurrency, and allowing remote access to infected systems. The packages affected include @asyncapi/generator version 3.3.1 and @asyncapi/generator-components version 0.7.1, which collectively have over 2 million downloads each week. This incident poses significant risks to developers and organizations using these packages, as the malicious code could potentially lead to severe data breaches and financial losses. Users of these packages are urged to take immediate action to secure their systems and avoid using the compromised versions. The discovery of this attack underscores the vulnerabilities present in the npm ecosystem and the importance of maintaining vigilance against supply chain attacks.

Kaspersky's GReAT team has identified a new malware framework called OkoBot that specifically targets cryptocurrency users. This sophisticated malware utilizes a component known as TookPS to steal sensitive information, such as seed phrases, and monitor activities on Chromium-based browsers. Additionally, OkoBot can install various types of malware, including the Rilide stealer, which further compromises users' security. This threat is particularly concerning for those involved in cryptocurrency transactions, as it can lead to significant financial losses and privacy violations. Users need to be vigilant and consider enhancing their security measures to protect against these evolving threats.