LokiBot Resurfaces in New Phishing Campaign
A new email phishing campaign delivers LokiBot via JavaScript attachments. LokiBot harvests credentials from password managers like 1Password, Enpass, and KeePass, and…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
TheMoon Malware: Used in 5socks and Anyproxy Residential Proxy Services
TheMoon is a malware family that infected years-old Linksys and Cisco routers, turning them into residential proxies sold by services like 5socks…
5socks: Residential Proxy Service Dismantled by FBI in 2025
5socks was a residential proxy service that used TheMoon malware-infected routers to provide proxy access. It was taken down by the FBI…
Anyproxy: Residential Proxy Service Dismantled by FBI in 2025
Anyproxy was a residential proxy service that used TheMoon malware-infected routers to provide proxy access. It was taken down by the FBI…
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
A new malware family named AryStinger, discovered by QiAnXin's XLab, has infected at least 4,300 legacy routers to create a distributed reconnaissance…
AryStinger Botnet: IoT Malware Campaign
AryStinger is an IoT botnet that targets poorly secured servers and IoT devices to co-opt them into a DDoS network. It is…
KV-Botnet: Predecessor to JDY Botnet Taken Down by U.S. Government
The KV-botnet was a larger botnet that included the JDY cluster. It was taken down by the U.S. government in early 2024,…
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer
Cybersecurity researchers from Elastic Security Labs have disclosed a new campaign that delivers the CastleStealer information stealer via a previously unreported malware…
OXLOADER — Malware profile
OXLOADER was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
CastleStealer: .NET Information Stealer Distributed via Malvertising
CastleStealer is a .NET-based information stealer that targets credentials and sensitive data. It has been distributed alongside CastleLoader in campaigns using ClickFix…