14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Cybersecurity researchers at Trend Micro's TrendAI have uncovered a set of 14 trojanized npm packages that masquerade as legitimate calendar and streak…
Category: Malware
Malware families, payloads, loaders, ransomware and related tooling.
RedC2: AI-Assisted C2 Framework
RedC2 is a cross-platform command-and-control framework for Windows, macOS, and Linux, marketed on cybercrime forums and sold via Red Offsec. It features…
JarService: The Dropper Delivering Malware to Car Head Units
JarService is a dropper used by MoYu Group to deliver malware to Android-based car head units. It launches a loader that communicates…
zhima: Reverse Proxy Module Used in Car Head Unit Malware
zhima is a reverse proxy module documented by Nokia Deepfield Emergency Response Team. It is selectively delivered via IPTV apps and now…
Android Car Head Unit Malware Spreads via Built-In Updaters for Ad Fraud and Proxy Botnet
Cybersecurity researchers have uncovered a new malware family specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which…
AvNeutralizer: Malware Tool for Disabling Endpoint Security
AvNeutralizer is a malware tool used by threat actors like FIN7 to disable endpoint security software. It leverages legitimate signed drivers, such…
CornFlake RAT: Go-Based Remote Access Trojan Used in CaptiveCrunch
CornFlake RAT is a Go-based remote access trojan deployed via adversary-in-the-middle (AitM) attacks, often disguised as browser or OS updates. It performs…
HEADRUSH: Rogue Excel Plugin Delivering HTA Malware
HEADRUSH is a rogue Excel plugin used by UNC5976 to deliver an HTML Application (HTA) download. Discovered in April 2026, it is…
Vidar Infostealer: Commodity Malware Used by UNC7005
Vidar is a commodity infostealer used by UNC7005 to siphon data from Windows hosts. It is distributed via malicious URLs and phishing…
Atomic (AMOS) Infostealer: macOS Credential Theft Tool
Atomic, also known as AMOS, is a commodity infostealer targeting macOS. UNC7005 uses it to steal data from macOS hosts, often delivered…