Malware

HackRead reports that information-stealing MacSync malware has been deployed through the exploitation of Google Ads and bogus Claude AI guides as part of a new ClickFix attack campaign.

Infosecurity Magazine reports that more clandestine and persistent intrusions have been conducted by the WorldLeaks ransomware operation through the new advanced RustyRocket malware.

The Lazarus Group's operation, codenamed "graphalgo," began in May 2025.

The current LummaStealer campaigns are heavily reliant on CastleLoader, a modular malware loader that executes payloads in memory with extensive obfuscation.

The loader uses a novel string mutation mechanism and in-memory execution to evade detection.

SecurityWeek reports that novel commercial spyware toolkit ZeroDayRAT could be leveraged to enable total remote compromise of both Android and iOS devices.

Organizations in the cryptocurrency sector have had their Windows and macOS systems targeted by North Korean hacking operation UNC1069 in financially-motivated malware campaigns, according to BleepingComputer.