Malware

Sites mimicking DeepSeek, AutoCAD, UltraViewer and more lead to remote system access.

More advanced obfuscation techniques have been adopted by a new Hijack Loader malware variant, the SHELBY malware, and the Emmenhtal Loader to facilitate clandestine compromise, according to The Hacker News.

Updated Triada trojan compromises thousands of Android devices BleepingComputer reports that at least 3,000 Android devices that are counterfeits of widely known smartphones, most of which are in Russia, were confirmed to have been pre-installed with the latest iteration of the modular and stealthy Triada trojan.

Attacks with the novel Python-based Anubis backdoor have been deployed by Russian advanced persistent threat operation FIN7.

Vulnerable SSH servers have been primarily targeted by the Outlaw Linux cryptocurrency mining botnet, also known as Dota, which could self-propagate through its BLITZ initial access component, The Hacker News reports.

Threat actors have leveraged Microsoft Teams and other tools to facilitate a malware-spreading voice phishing scam, according to Hackread.

More than 1,500 internet-exposed PostgreSQL instances have been compromised with cryptocurrency mining malware as part of an ongoing JINX-0126 attack campaign, which is an evolution of PG_MEM malware activity initially detected by Aqua Security in August, The Hacker News reports.