VulnHub

UAC-0099, a Russia-aligned hacking group, has been linked to a new malware called ASHVEIN, which functions as both an infostealer and a remote access trojan (RAT). This malware is currently being used in targeted attacks against Ukrainian government personnel. Researchers from TrendAI, who are tracking this activity under the name Earth Sirrush, report that ASHVEIN disguises its commands within HTML, making it harder to detect. This development raises concerns about the security of government systems in Ukraine, particularly given the ongoing geopolitical tensions in the region. As these attacks evolve, it highlights the need for enhanced cybersecurity measures among officials and government staff.

Researchers from CloudSEK have identified the MALFEX campaign, which uses malicious npm packages to distribute the Overlord Remote Access Trojan (RAT). This malware targets users by stealing sensitive data from Discord and various web browsers. The attack primarily affects developers and users who download and install compromised npm packages, which are commonly used in software development. This incident raises concerns about the security of open-source package repositories and the potential for widespread data theft. Users and developers need to be vigilant about the sources of their packages and consider implementing security measures to protect their data.

A new Android banking trojan called RatHat is being controlled through a web console used by its operators to manage infected devices. Security firm Cleafy has identified nearly 100 instances of this console being deployed since April 2026. This malware operates on a malware-as-a-service model, allowing different customers to run their own versions of the trojan. The console collects various data from compromised phones, which can include sensitive financial information. The use of this malware poses significant risks to users, particularly those with banking applications on their Android devices, as attackers can steal personal and financial information with relative ease.

The latest Security Affairs Malware newsletter covers significant developments in the malware landscape, including a case where a Malware-as-a-Service platform exploited GitHub to distribute malicious software across forty different companies. One notable threat discussed is the PAYLOAD ransomware, which has been found to weaponize Active Directory Group Policy Objects (GPO), making it easier for attackers to infiltrate and control networks. Additionally, researchers are tracing a Node.js Remote Access Trojan (RAT) named ChainScript, which is being used in various cyber attacks. These incidents highlight the evolving tactics of cybercriminals and the need for organizations to stay vigilant against sophisticated malware techniques that can compromise their systems and sensitive data.

SectopRAT, a remote access Trojan (RAT), has resurfaced by embedding itself within legitimate applications. This tactic allows it to evade detection and compromise systems without raising alarms. Security experts are warning organizations to be vigilant in monitoring application behavior, rather than assuming that all programs are safe. As this malware can infiltrate various systems, it poses a significant risk to businesses that may overlook such hidden threats. The resurgence of SectopRAT serves as a reminder for companies to enhance their security protocols and scrutinize application integrity meticulously.

The RatHat Android Trojan is a new piece of malware that uses artificial intelligence to enhance its ability to navigate and control infected devices in real-time. This makes it more adaptable and harder to detect by traditional security measures. Users of Android devices are particularly at risk, as the malware can exploit vulnerabilities to take control of their devices. The implications of this are significant, as it could lead to unauthorized access to personal information, financial data, and other sensitive content. As the malware continues to evolve, it raises concerns about the effectiveness of current security protocols against AI-driven threats.

Cybercriminals are using deceptive tactics to distribute a new remote access trojan (RAT) named ChainScript. This malware disguises itself as popular software applications like Spotify, Zoom Workplace, and Microsoft Teams, making it more likely for users to download it unknowingly. ChainScript has been seen under various names, such as ComponentTask33 and OrchidViolet66. The threat actors are employing ClickFix-like lures to rotate their command and control (C2) infrastructure, which complicates detection and mitigation efforts. This situation poses a significant risk to both individuals and organizations, as it can lead to unauthorized access to sensitive information and systems.

Kaspersky researchers have identified a new campaign dubbed MovieReaper, which targets users across multiple countries through compromised movie torrents, including a recent release titled 'The Odyssey.' The Trojan is designed to operate in multiple stages and cleverly utilizes the Solana blockchain to conceal its command and control (C2) infrastructure. This means that users who download these torrents may unknowingly install malware on their devices. The implications are significant, as this tactic not only spreads malware but also complicates efforts to track and combat the attackers behind it. Users are advised to be cautious when downloading files from torrent sites, as they could be exposing themselves to serious security risks.

Indonesia is facing a cybersecurity threat from a group known as GoldFactory, which is using a technique involving the Android Work Profile feature to distribute the Gigabud Trojan. This malicious software targets Android banking apps, allowing attackers to steal sensitive financial information from users. Another group, Mantax Otax, is reportedly spreading malware independently. This situation raises concerns for Android users in Indonesia, particularly those who rely on banking apps for financial transactions. The ability of these groups to exploit legitimate features in Android underscores the need for heightened vigilance among users and better security measures from app developers.

A new campaign is targeting individuals and organizations in Cambodia using a remote access trojan (RAT) known as Spark RAT. The attackers are employing various lure themes, including government notices, public health information, and real estate content, to entice a wide range of potential victims. Notably, the campaign exploits a vulnerable OPSWAT driver, which allows the malware to disable security tools, making it easier for attackers to infiltrate systems undetected. This situation is concerning as it not only threatens personal and organizational data security but also raises alarms about the potential for broader impacts on national security and public safety. Users in Cambodia should be particularly vigilant and ensure their security measures are up to date.

The 'Grandoreiro' banking Trojan has resurfaced in Mexico, adopting new features that make it more challenging for security professionals to detect and analyze. Initially disrupted by law enforcement actions, the malware has been updated to improve its stealth capabilities, raising concerns among cybersecurity experts. This malware primarily targets banking credentials, putting both individual users and financial institutions at risk. As it spreads, users in Mexico need to be particularly vigilant about their online banking security. The resurgence of Grandoreiro underscores the ongoing battle between malware developers and cybersecurity efforts, reminding everyone of the importance of safeguarding sensitive financial information.

The Grandoreiro banking trojan has resurfaced with a new campaign targeting users in Latin America, first detected in May 2026. This malware employs a technique known as DLL sideloading to execute its malicious code. As a banking trojan, Grandoreiro is designed to steal sensitive financial information from its victims, which can lead to unauthorized access to their bank accounts. The resurgence of this trojan is concerning as it indicates that attackers are evolving their methods to bypass security measures. Users in affected regions should remain vigilant and enhance their security practices to protect against potential financial fraud.

Researchers from Group-IB have identified a new Android malware called WindRelay that poses a significant threat to users by capturing real-time payment card data via NFC (Near Field Communication). The malware works in conjunction with the SpyNote remote access trojan, enabling attackers to gain control over a victim's device and relay sensitive information directly to them. The attack typically begins with a phone call from a fraudster impersonating a bank representative, tricking victims into revealing their financial data. This malware not only compromises personal financial security but also highlights the growing sophistication of cybercriminal tactics. Users need to be vigilant about unsolicited calls and consider additional security measures to protect their payment information.

A new type of malware known as WindRelay is being used in conjunction with the SpyNote Remote Access Trojan (RAT) to execute live-call scams. This combination allows fraudsters to clone credit cards during phone calls, posing a significant risk to unsuspecting victims. The attackers can manipulate information in real-time, making it easier for them to deceive individuals and potentially steal their financial information. This incident serves as a reminder for users to be cautious during phone conversations, especially when discussing sensitive information. Awareness and vigilance are key to preventing falling victim to such scams.

The latest Malware Newsletter from Security Affairs covers a variety of recent malware incidents. One notable threat involves fake Roblox cheats that are being distributed through Discord and online forums, which are actually Java stealers designed to harvest sensitive information from users. Another focus is on a complex operation involving a cluster of malicious npm packages that deliver a remote access Trojan (RAT) targeting Alibaba. This highlights the ongoing risks associated with third-party software and the importance of scrutinizing downloads from less reputable sources. As these attacks evolve, users and companies need to stay vigilant and prioritize security measures to protect their data.