All news with #malware tag

🛡️ Researchers at Group-IB have uncovered a new Android malware-as-a-service called RemControl, distributed via malvertising that impersonates the TVTap IPTV app. The dropper starts a VPN to block Google Play services and requests Accessibility permissions to deploy full-screen phishing overlays and steal banking credentials. Targets include users in Europe, Canada, and parts of the Middle East, and the operation dynamically fetches C2 data via Telegram.

🛡️ Cisco Talos disclosed a Windows implant named CLOSEDQUORUM that delegates command decisions to up to four commercial AI models instead of relying on a traditional C2 server. The malware collects basic system facts and asks the models to vote among actions such as steal, inject, and persist, then executes the majority choice. Talos found the code in mid-June 2026 and released tooling, CAIRN, to hunt for AI-driven malware, noting the public build contains placeholder API keys and webhooks so it is not operational.

🔍 Researchers have uncovered a previously undocumented Windows botnet named x47.c that advertises 18 attack methods, including an "AI API drain" designed to exhaust paid AI credits. Qrator Research Labs analyzed seller materials from WraithTools and found modules for credential theft, SOCKS5 proxying and an AI-assisted persistence feature. The botnet also supports multiple DDoS techniques, fast-flux routing and a stealer targeting browser credentials and tokens.

🛡️ Cisco Talos reports a new malware family called CLOSEDQUORUM that uses a panel of large language models (LLMs) to fully automate command-and-control decisions and credential theft. The binary compiles tactical knowledge into model-readable prompts and constrains responses to JSON-formatted executable choices, enabling unattended execution against LSASS memory, browser-saved passwords, and crypto wallets. Researchers found the sample via the CAIRN toolkit and note the approach trades human limits for model and API weaknesses, and has not yet been confirmed in the wild.

🛡️ Cisco Talos details a new Go-based Windows implant named ClosedQuorum that uses multiple AI models — including Google Gemini, DeepSeek, Qwen, and Mistral — to autonomously decide post-compromise actions. The malware uses reconnaissance data and a voting system to select among restricted options such as steal, inject, persist, and move (the latter currently unimplemented). Stolen credentials and wallet data are exfiltrated via Discord webhooks, enabling fully automated attack chains.

🛡️ ReversingLabs disclosed a malicious npm package named tw-pkgprobe-7731 that posed as a security probe for developers integrating Twilio. First published in mid-August 2026 with multiple rapid versions, the package checks for Twilio environments, harvests environment variables and system details, and exfiltrates data via webhook. Some versions specifically targeted Twilio SIDs and could steal ACCOUNT_SID and AUTH_TOKEN, while later releases reverted to benign probing and OSINT collection.

🔍 Cisco Talos describes CLOSEDQUORUM, a Windows implant that delegates tactical command-and-control decisions to a closed panel of commercial LLMs. The binary queries up to four providers (DeepSeek, Qwen, Mistral, Gemini), aggregates JSON-formatted verdicts by plurality voting, and maps chosen decisions to capabilities like credential theft, process injection, and persistence. Development builds show operator-specific API credentials; the public build contains dummy keys, and defenders are advised to prioritize behavioral detections over simple domain blocking.

🛡️ Checkmarx has identified a malicious npm package, indexed-btree, that concealed its payload inside application code rather than using lifecycle scripts, indicating attackers are adapting to npm's install-time protections. The package, first published on June 18, 2026, accumulated millions of downloads before removal and is estimated to have generated roughly €230,933.57 in cryptocurrency for the operator. The loader was embedded in a BTree.prototype.set() method and used EtherHiding and blockchain-hosted encrypted blobs to fetch staged payloads before cleaning up traces.

🛡️ Security researcher Patrick Wardle demonstrated on September 21 that malware already running on a Mac can change a hidden Muse preference so dictation is sent to an attacker-controlled endpoint instead of Meta. The issue affects the Mac Muse app and requires code execution as the logged-in user; it is not a remote exploit. Wardle warned that this lets attackers leverage the app's granted permissions to access files, messages, and other resources Muse can reach.

🛡️ A new ClickFix malware-as-a-service framework named Exvicy has been observed delivering malware via compromised WordPress sites by injecting obfuscated JavaScript and a fake Cloudflare Turnstile lure. Sekoia's Threat Detection & Research team linked Exvicy to active C2 infrastructure after telemetry showed customer hosts communicating with its servers. The actor advertises the service on Exploit.IN, with pricing rising from $1,200 to $2,000 per month and operational panels discovered through a screenshot in the advert. Sekoia assessed Exvicy reuses large portions of ErrTraffic's code, with the main technical difference being Exvicy's hardcoded C2 servers versus ErrTraffic's blockchain-based hiding.

🔒 Checkmarx researchers uncovered a campaign in which a malicious npm package, impersonating sorted-btree as “indexed-btree,” embeds malware inside a runtime method rather than using lifecycle install scripts. The payload launches a detached Node.js loader that fingerprints hosts and exfiltrates data to hardcoded Slack and Telegram endpoints, while using a Sepolia Ethereum smart contract as a resilient C2 pointer. Multiple related packages with high download counts were removed after discovery.

🛡️ SentinelOne attributes a campaign by the North Korean-linked group Jade Sleet to the compromise of an India-based IT services provider, using macOS backdoors FLATROOF and ROOFDECK. The attackers employed job-interview and coding project lures with weaponized Terraform lock files to trick developers into fetching malicious modules. FLATROOF uses Telegram for C2 and data theft, while ROOFDECK leverages the Nostr protocol for decentralized C2 and persistent, signed command execution. The incident underscores the growing risk to developer endpoints and supply chain vectors.

🔒 Security researcher Gal Weizman of Forever Security disclosed a proof-of-concept attack named BragJack that uses a single malicious Chromium extension to hijack built-in AI browser agents. The technique, demonstrated against Chrome Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude for Chrome, exploits Chromium's declarativeNetRequest to intercept and modify trusted resources, enabling agents to access files, history, screenshots, and act on users' behalf. Vendors issued fixes and paid bug bounties, and the researcher published a full technical breakdown.

🛡️ A joint advisory from Japanese, US, Australian, and German authorities warns that North Korean-affiliated group WaterPlum compromised at least 30,000 devices from December 2025 through July 2026 and transferred over $10.7 million in stolen cryptocurrency to North Korea. The group used malicious npm packages, fake interviews, and recruited remote IT workers to distribute malware and steal credentials, crypto keys, and sensitive data.

🛡️ Zimperium zLabs discovered RatHat, an Android malware that leverages an AI-powered subsystem to remotely navigate compromised devices. Distributed via malvertising, SMS, and phishing sites hosting APKs, RatHat abuses Accessibility permissions to enable Developer Options and Wireless Debugging. It installs a Go-based agent for ADB-level commands, persistence, and self-restoration, and a second agent for persistent FRP reverse-proxy tunnels. The malware overlays HTML on banking and crypto apps, intercepts SMS and notifications, captures credentials and unlock patterns, and uses anti-analysis techniques to evade detection.

🛡️ This post explains how browser extensions can be abused to deliver ClickFix social-engineering attacks, using a recent campaign that pushed 19 malicious add‑ons through official stores as an example. It describes how extensions gain wide permissions, how attackers acquire or buy extensions, and how updates and C2 modules let them inject malicious code into otherwise legitimate pages. The article highlights modules that steal credentials, drain crypto wallets, prompt for seed phrases, and serve ClickFix instructions that can break out of the browser and install system‑level malware.

🛡️ Joint advisories warn that Iranian state-linked hackers deploy a Windows malware called CHOSEN BRICK to spy on dissidents, activists, and journalists. The malware harvests email, Telegram, and WhatsApp data, captures screenshots and audio, and establishes persistence via Registry Run keys while adding Microsoft Defender exclusions. Attacks begin with social engineering on WhatsApp or Telegram and malicious files masquerading as trusted apps. Stolen data is exfiltrated via Telegram or cloud services and sometimes published on pro-Iranian leak sites.

🔒 Researchers at Elastic Security Labs uncovered a banking malware toolkit called KREMLIN that has been active since mid-2025 and installs malicious Chrome and Edge extensions to steal credentials, session tokens, and other sensitive data. The infection begins with a malicious JavaScript file posing as banking documents, which downloads Node.js, establishes persistence, and retrieves payload locations from an Ethereum smart contract. KREMLIN copies extensions into browser profile directories, regenerates integrity HMACs using browser keys, and enables them without user consent, while also operating as an info-stealer and delivering RATs like REMCOS.

🛡️ A commentator describes encountering a fake CAPTCHA scam that fingerprinted devices and served different payloads based on user environment. The attacker’s TDS (Traffic Distribution System) delivered benign pages to datacenter IPs used by scanners, while residential and mobile IPs received malicious payloads. The scam prompted a pop-up asking users to press Windows key + R and execute code, and the poster notes they avoid this by using Linux without faked user agents.

🔎 This Unit 42 analysis documents an AMOS stealer infection observed in a lab on Aug. 5, 2026, providing a snapshot of indicators seen at that time. The report outlines the infection chain beginning with a malicious webpage instructing copy/paste into Terminal, the Zsh scripts and Mach-O binaries used, and the persistence mechanisms under user Library directories. It also details collected artifacts, post‑infection HTTP POST traffic to C2 servers, and the frequent changes in indicators that characterize AMOS as an actively evolving threat.