WireGuard: VPN Protocol Exploited in Malware Campaign
WireGuard is a modern VPN protocol known for its simplicity and performance. In the UAC-0145 campaign, attackers compiled a trojanized version of…
Tag: malware
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials Ravie LakshmananJul 02, 2026Malware / Cyber Attack Threat actors associated…
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories Ravie LakshmananJul 02, 2026Hacking News / Cybersecurity News This week’s…
Umbrij Malware: OAuth Token Theft via Headless Browser Exploitation
Umbrij is a .NET-based malware attributed to the ToddyCat APT group, designed to steal OAuth tokens from Gmail accounts. It exploits Chromium-based…
InfernoGrabber v9.0: AI-Generated Browser Ransomware and Information Stealer
InfernoGrabber v9.0 is a Python Flask-based malware generated using DeepSeek. It operates as a malicious web server, stealing Discord tokens, credit card…
Phantom Squatting: AI-Hallucinated Domains Used for Phishing and Malware Attacks
Palo Alto Networks' Unit 42 has identified a new attack vector called 'phantom squatting,' where threat actors register AI-hallucinated domains that do…
Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery
Security researcher Bert-Jan Pals analyzed roughly 3,000 live ClickFix payloads and presented findings at OrangeCon in early June, publishing details on June…
ClickFix: Fake CAPTCHA Phishing Technique
ClickFix is a social engineering technique that uses fake CAPTCHA pages to trick users into copying and running malicious commands, often leading…
RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS
RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS Swati KhandelwalJun 30, 2026Botnet / Vulnerability A new two-stage malware…
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
Threat actors are actively exploiting CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in Langflow (CVSS 9.3), to deploy a Monero cryptocurrency…