Malware

The malware uses a unique Unicode-based method to hide the user’s password in a fake Zoom configuration file.

Google report focuses on exploit of CVE-2026-88772, which executed lateral movement a month before a patch existed.

Instructions to visit a malicious website were delivered through the real ChatGPT site.

The malicious npm packages, collectively downloaded 490,000 times, exploit the "Baileys" WhatsApp open-source project to subscribe developers to various WhatsApp groups.

NeedyMantis uses a DLL sideloading technique, where a malicious DLL file, often disguised with a legitimate program's file name, is loaded by a legitimate application.

Researchers at Bay Area Labs have identified "Poper Blocker," an ad-blocking extension with a "Featured" badge and "Established Publisher" status from Google, as malware.

The attack chain begins with a fake CAPTCHA page, leading to the deployment of a fully-featured command-and-control (C2) agent.

The latest PamStealer variant, observed by Jamf Threat Labs, continues to use a JavaScript for Automation (JXA) dropper but has updated its lure and delivery mechanisms.