malware – Page 27 – CyberSecurityBoard

Malware

FREAKYPOLL: Python Backdoor

FREAKYPOLL is a Python-based backdoor deployed in the UAC-0145 campaign, providing remote access to infected systems.

backdoor FREAKYPOLL malware Python

July 19, 2026

Malware

COWARDDUCK: Android Backdoor Disguised as Security Tool

COWARDDUCK is a full-featured Android backdoor distributed via messaging apps, disguised as security tools. It exfiltrates contacts, files, and geolocation using Dropbox…

Android backdoor COWARDDUCK Dropbox

July 19, 2026

Attack Groups

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware

Russian state-sponsored threat actors from the UAC-0145 sub-cluster, linked to Sandworm and GRU, are using fake CAPTCHA checks on compromised websites to…

ACR Stealer Android CAPTCHA CERT-UA

July 19, 2026

Malware

GHETTOVIBE: VBS File Dropped via ClickFix

GHETTOVIBE is a VBS file saved in the Startup autorun directory, delivered through fake CAPTCHA checks in the UAC-0145 campaign targeting Ukrainian…

ClickFix GHETTOVIBE malware VBS

July 19, 2026

Malware

SCOUTCURL: PowerShell Reconnaissance Script

SCOUTCURL is a PowerShell script used by UAC-0145 to perform basic reconnaissance by harvesting details about infected machines.

malware PowerShell reconnaissance SCOUTCURL

July 19, 2026

Malware

FLUIDLEECH: Loader Masquerading as Antivirus

FLUIDLEECH is a loader used in the UAC-0145 campaign, disguised as software for removing computer viruses to trick users.

antivirus FLUIDLEECH loader malware

July 19, 2026

Malware

LOADLOOP: Loader in UAC-0145 Campaign

LOADLOOP is a loader used alongside FLUIDLEECH in the UAC-0145 campaign to deliver additional malware payloads.

loader LOADLOOP malware

July 19, 2026

Malware

ViteVenom: Malicious npm Campaign Targeting Vite Developers

ViteVenom is a malware campaign discovered by Checkmarx that uses seven malicious scoped npm packages to deliver a RAT via blockchain-based C2…

blockchain C2 malware npm RAT

July 17, 2026

Malware

ChainVeil: Precursor Malware Campaign Using Blockchain C2

ChainVeil is a previous malware campaign that used unscoped typosquat npm packages and a four-tier blockchain C2 infrastructure to deliver a remote…

blockchain C2 ChainVeil malware npm

July 17, 2026

Critical CVEs

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft Ravie LakshmananJul 17, 2026Malware / Threat Intelligence Cybersecurity researchers have attributed the…

APT breach exploit malware

July 17, 2026