VulnHub

Researchers at Elastic Security Labs have identified four previously unknown programs connected to REVSTEALER, a Windows information-stealing malware. These programs persist on infected systems even after REVSTEALER removes itself. Notably, one of the modules disables Windows Update and Microsoft Defender, allowing a cryptocurrency miner to operate without interference. This poses a significant risk to users, as it not only compromises their data but also hijacks system resources for mining operations. Users and organizations need to be aware of these threats to protect their systems from potential exploitation.

Recent reports indicate that hackers are using infostealer malware to hijack login sessions for Claude, a popular AI tool. This type of malware captures sensitive information from users, allowing attackers to gain unauthorized access to accounts. The evolving Fire Ant malware has been noted for its ability to operate at a deeper level within systems, moving from hypervisors to trusted infrastructures. Additionally, a new toolkit called Gryxa has emerged, designed to monitor how users uninstall it. Another malware variant, ValleyRAT, is disguising itself as adware to trick users into installing it. These developments suggest a growing sophistication among cybercriminals and a heightened risk for users across various platforms, emphasizing the need for robust security measures.

Anthropic has locked users out of their Claude accounts after attackers compromised login sessions using infostealer malware. This incident raises concerns about the security of user credentials and the potential for unauthorized access to sensitive information. While the company is taking steps to protect users by enforcing account locks, it highlights the risks associated with infostealer malware that targets login information. Users may need to reset their passwords and monitor their accounts for any suspicious activity. This situation serves as a reminder for individuals to be vigilant about their online security practices.

Cybercriminals are exploiting over 5,400 hacked small-business websites to distribute ClickFix payloads, which are stored in smart contracts on the BNB Smart Chain (BSC). This operation targets unsuspecting website owners and their visitors, potentially leading to unauthorized access and data theft. The use of blockchain technology for storing malicious payloads makes it challenging for traditional security measures to detect and mitigate these attacks. This incident highlights the growing trend of attackers using compromised legitimate sites as a delivery mechanism, raising concerns for both businesses and consumers. Organizations should take immediate steps to secure their websites and monitor for any signs of compromise.

On August 31, between 07:35 and 21:45 UTC, attackers targeted a coding platform by delivering malicious Terraform modules. These modules are designed to automate the setup of cloud infrastructure, making them particularly dangerous if they gain access to users' systems. Developers using the platform may unknowingly incorporate these harmful modules into their projects, potentially allowing attackers to compromise their cloud environments. This incident raises significant concerns about supply chain security and the integrity of tools that developers rely on. It serves as a reminder for users to thoroughly vet any third-party modules before integrating them into their workflows.

A new Linux toolkit, dubbed 'ted', has been discovered embedded within altered HAProxy load balancers used by two South Korean organizations. This malicious implant allows attackers to intercept web traffic and manipulate the pages seen by certain visitors. The presence of 'ted' in the HAProxy binaries indicates that it does not exploit a vulnerability in HAProxy itself; instead, it requires the attackers to execute code on the affected systems. This incident raises significant concerns as it demonstrates how attackers can compromise widely used software to conduct web traffic interception. Organizations using HAProxy should be vigilant and ensure their installations are secure to prevent such intrusions.

Kaspersky's GERT team has identified new backdoors linked to the hacking group known as Toy Ghouls. These backdoors utilize two distinct methods for command-and-control: one operates through the HiveMQ MQTT broker, while the other employs the Matrix-based Element messenger. This discovery raises alarms as it indicates the group's ongoing efforts to establish secure communication channels for their malicious activities. The use of these platforms suggests that the attackers may be adapting their techniques to evade detection, which could pose significant risks to organizations relying on these technologies. Understanding and mitigating this threat is crucial for enhancing cybersecurity measures against such evolving tactics.

Attackers have breached Coder's Cloudflare infrastructure, enabling them to insert unauthorized registry servers. These servers distributed malicious Terraform modules that contained code designed to steal user credentials. This incident poses a significant risk to developers and organizations that rely on Terraform for infrastructure management, as they could unknowingly use compromised modules, leading to potential data theft and security breaches. Users of Coder's services need to be vigilant, as the malicious code could affect their systems and expose sensitive information. The incident underscores the necessity for robust security measures when integrating third-party modules into development workflows.

Cyber attackers are exploiting the trusted Node.js JavaScript runtime to deliver malicious software in targeted campaigns. A report from the Symantec Threat Hunter Team reveals that this method has been used since February 2026, affecting various sectors, including government agencies, tech firms, and hotels. The attackers are utilizing the node.exe process, which is normally seen as safe, to deploy harmful payloads without raising immediate suspicion. This tactic poses significant risks as it can bypass traditional security measures, making it harder for organizations to detect the intrusion. Companies in the affected sectors need to enhance their security protocols to address this emerging threat.

In early August, researchers from GitGuardian discovered a new variant of the Shai-Hulud infostealer worm that has significantly expanded its capabilities. This version can now scan for credentials across 469 different locations, including developer environments, CI/CD tools, cloud configurations, and AI tool settings. This is a stark increase from earlier variants, which only checked 189 paths. The broader scanning capability means that attackers can potentially access sensitive information from a wider array of systems, putting developers and organizations at greater risk. Companies should assess their security measures to protect against this evolving threat, as the increased number of targeted locations makes it easier for attackers to find valuable credentials.

A recent international operation led by the US has successfully disrupted the Sality peer-to-peer (P2P) botnet, which has been known for infecting computers worldwide. This botnet is responsible for a range of malicious activities, including the distribution of malware and the generation of spam. The operation involved sinkholing infected machines, effectively cutting off their connections and rendering them inactive. This is significant because Sality has been a persistent threat for years, affecting both individual users and organizations. By dismantling this botnet, authorities aim to reduce its impact and protect users from further exploitation.

A Russian man has been extradited to the United States in connection with a malware campaign that targeted around 80,000 freelance users. This malware was designed to steal personal information and payment details, impacting individuals who rely on freelance platforms for work. The case highlights ongoing concerns about cybercrime targeting vulnerable online communities. With the rise of remote work, freelancers often face unique risks, making them attractive targets for cybercriminals. This incident serves as a reminder for freelancers to be vigilant about their online security and to take steps to protect their personal information.

A cybercrime group known as Gambling Goblin has been targeting Brazilian government and educational websites by installing malicious Apache modules on their servers. This operation, which Check Point Research has been tracking since mid-2025, redirects users from these sites to pages promoting online gambling and sports betting. The attackers are likely Chinese-speaking, and their activities raise concerns about the security of public web infrastructure in Brazil. This incident not only affects the integrity of government and educational institutions but also poses risks to users who may unknowingly interact with these compromised sites. The situation highlights the ongoing challenges in cybersecurity for public entities and the need for robust security measures.

Hackers have executed a Border Gateway Protocol (BGP) hijack to redirect traffic meant for Softaculous, allowing them to deliver a malicious update for Virtualizor. This incident has compromised at least five out of thirty-four Virtualizor hypervisors at a hosting provider, granting the attackers root access to these systems. The attack window is reported to have occurred on August 28. This breach raises concerns for users relying on Virtualizor for virtualization management, as the malicious update could lead to unauthorized control over their servers. Organizations using this software should take immediate steps to assess their systems for vulnerabilities and potential intrusions.