Malware

Windows systems have been covertly compromised with the Teramind endpoint monitoring software for unauthorized surveillance as part of advanced phishing campaigns spoofing Zoom and Google Meet, GBHackers News reports.

Multiple malicious payloads have been distributed in attacks exploiting the Windows File Explorer and WebDAV protocol as part of campaigns that have been ongoing since February 2024 but only significantly escalated in September 2024, according to GBHackers News.

Trojanized tools for the Roblox and Xeno games have been harnessed to deliver a remote access trojan on Windows systems, HackRead reports.

The Ruby Jumper campaign, first identified by Zscaler ThreatLabz in December 2025, deploys multiple malware families such as RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, FOOTWINE, and BLUELIGHT.

The compromised Go module injects malicious code into the "ssh/terminal/terminal.go" file, specifically within the "ReadPassword()" function.

Threat actors use a fake Ivanti certificate for authentication, which, although unencrypted, can serve as a network signature for detection.

The compromises are attributed to the exploitation of CVE-2025-64328, a vulnerability with a CVSS score of 8.6, which allows for post-authentication command injection.

Once the threat actor establishes persistence, it can return and expand access.