VulnHub

A new variant of MacSync malware is targeting Mac users by stealing sensitive information such as login credentials and crypto wallet data. Discovered by Kaspersky, this malware spreads through a crypto wallet application named Toria, which has been promoted on platforms like X and Telegram. The MacSync malware family, which first appeared in 2025, has evolved to include a persistent backdoor that allows attackers continued access to infected systems. This poses significant risks to users, particularly those involved in cryptocurrency, as their financial and personal data could be compromised. Users should be cautious about downloading apps from unverified sources and consider enhancing their security measures to protect against such malware.

Check Point has reported a serious vulnerability affecting its Security Management and Log Servers. This flaw could allow attackers to execute code remotely with root privileges, which poses a significant risk to users' systems. Organizations using these products should take immediate action to protect their environments. The potential for unauthorized access and control over sensitive data makes this a pressing concern for businesses relying on Check Point's security solutions. Users are advised to apply the necessary patches as soon as they become available to mitigate this risk.

Kaspersky researchers have identified a new campaign dubbed MovieReaper, which targets users across multiple countries through compromised movie torrents, including a recent release titled 'The Odyssey.' The Trojan is designed to operate in multiple stages and cleverly utilizes the Solana blockchain to conceal its command and control (C2) infrastructure. This means that users who download these torrents may unknowingly install malware on their devices. The implications are significant, as this tactic not only spreads malware but also complicates efforts to track and combat the attackers behind it. Users are advised to be cautious when downloading files from torrent sites, as they could be exposing themselves to serious security risks.

Three distinct threat groups, identified as NightEagle, Hacking Cat, and Toy Ghouls, are targeting Russian enterprises with various cyberattack methods, including backdoors, ransomware, and wipers. NightEagle, also known as APT-Q-95, has been active since at least 2023 and is employing innovative techniques for maintaining access and moving laterally within networks. The attacks pose significant risks to the affected organizations, as they could lead to data breaches, operational disruptions, and potential ransom demands. Kaspersky's reports indicate that these groups are becoming increasingly sophisticated, which raises concerns for the security of businesses operating in Russia. Companies in this region should enhance their security measures to defend against these evolving threats and protect sensitive information.

Kaspersky's GERT team has identified a new campaign from the NightEagle APT group, which is targeting Russian companies. This campaign utilizes the GhostContainer backdoor and exploits vulnerabilities in Active Directory and Remote Desktop Protocol (RDP). The tools used in these attacks are hosted on GitHub, raising concerns about the accessibility of malicious resources for attackers. Companies in Russia should be particularly vigilant as these vulnerabilities can lead to unauthorized access and potential data breaches. Understanding the methods employed by NightEagle is crucial for organizations to strengthen their defenses against such targeted campaigns.

Kaspersky's GERT team has identified new backdoors linked to the hacking group known as Toy Ghouls. These backdoors utilize two distinct methods for command-and-control: one operates through the HiveMQ MQTT broker, while the other employs the Matrix-based Element messenger. This discovery raises alarms as it indicates the group's ongoing efforts to establish secure communication channels for their malicious activities. The use of these platforms suggests that the attackers may be adapting their techniques to evade detection, which could pose significant risks to organizations relying on these technologies. Understanding and mitigating this threat is crucial for enhancing cybersecurity measures against such evolving tactics.

The Iranian hacking group known as Nimbus Manticore has been linked to two new types of malware that can affect both Linux and macOS systems. These malware families are remote access trojans (RATs) created using Node.js and JavaScript, allowing attackers to gain control over infected devices. Researchers from Kaspersky noted that the group is using a clever tactic of posing as recruiters to deliver malicious code through fake coding tests. This development is concerning as it expands the group's targeting capabilities and indicates a shift in their methods. Users and organizations using Linux or macOS systems should be vigilant and consider enhancing their security measures to prevent potential infections.

Kaspersky researchers have identified a new wave of cyberattacks linked to the group known as Mirage Kitten, focusing on the aviation and FinTech sectors in the Middle East and Africa. These attacks employ newly discovered malware families called NodeRabbit, which operates in Node.js, and PollCat, designed in JavaScript. The emergence of these malware variants poses a significant risk to organizations in these industries, potentially leading to data breaches or service disruptions. Companies in the affected sectors should enhance their security measures to guard against these sophisticated threats, as the implications of such attacks can be severe, impacting both operations and customer trust.

A cybersecurity group has reported that a threat actor known as Silver Fox is distributing a backdoor malware called ValleyRAT by disguising it as a legitimate signed adware application. This adware, specifically a desktop wallpaper tool named QN Wallpaper, is being added to users' antivirus exclusions, allowing the malware to operate undetected. The tactic of embedding malware within trusted applications poses a significant risk to users, as they may unknowingly grant access to their systems. Kaspersky, a Russian cybersecurity vendor, identified this method, which raises concerns about the security of software that users might consider harmless. This incident serves as a reminder for users to be cautious about what they exclude from their antivirus protections.

Kaspersky researchers have identified a new type of malware specifically designed for car head units, which are the infotainment systems found in vehicles. This malware has been linked to the BadBox botnet, a network that has already compromised millions of devices. The malware's targeting of car systems raises significant concerns about the security of vehicle technology, as it could potentially allow attackers to control various functions of the car or access sensitive data. This incident emphasizes the growing vulnerability of modern vehicles to cyber threats, highlighting a need for stronger security measures in automotive technology. Car manufacturers and users alike should be aware of this emerging threat and take precautions to safeguard their systems.

Mustang Panda, also known as HoneyMyte, has enhanced its CoolClient backdoor by deploying a signed kernel-mode driver that can conceal processes, files, and network activity. This upgrade makes it significantly harder for security software to detect and remove the malware from infected Windows systems. Kaspersky's recent analysis indicates that this new variant of CoolClient deepens the malware's integration into the operating system, raising concerns for users and organizations relying on Windows. The implications are serious, as this could allow attackers to maintain prolonged access to compromised systems while evading detection. Users and organizations need to remain vigilant and implement security measures to protect against this evolving threat.

Kaspersky researchers have identified a new cyber-espionage campaign linked to the group Armored Likho. This campaign masquerades as a fundraising initiative and uses a newly developed tool called the Still Toolkit, which is specifically designed to steal data from Telegram and eavesdrop on users. The implications of this attack are significant, particularly for individuals and organizations that rely on Telegram for communication. Users should be cautious about unsolicited fundraising requests and consider enhancing their security measures to protect sensitive information. This incident illustrates the ongoing risks posed by sophisticated cyber-espionage tactics, which continue to evolve and target popular communication platforms.

Researchers at Kaspersky have identified a cybersecurity threat involving the Head Mare APT group, which is exploiting vulnerabilities in unpatched TrueConf servers. This group is using malicious software installers to deliver two backdoors, PhantomCore and PhantomGraph, to users participating in video conferences. The attack specifically targets systems that have not updated their TrueConf software, making them susceptible to these exploits. This situation raises significant concerns for organizations that rely on video conferencing tools for communication, as attackers could gain unauthorized access to sensitive information. Users and companies should prioritize patching their TrueConf installations to mitigate this risk.

A group known as Head Mare has been exploiting vulnerabilities in unpatched TrueConf servers to carry out attacks against various Russian companies. These companies operate in sectors like instrumentation, electronics, transport, energy, IT, and software development. Kaspersky, a cybersecurity firm, reported detecting these attacks in July 2026. The attackers are reportedly replacing legitimate client installers with malicious software called PhantomCore, which could compromise the security of the affected organizations. This situation raises concerns for companies still using outdated versions of TrueConf, as failure to update could lead to severe security breaches.