Malware

BleepingComputer reports that the novel self-propagating GlassWorm malware has been injected into a dozen OpenVSX and Microsoft VSCode extensions, which have been downloaded 35,800 times, as part of an ongoing supply chain intrusion.

The YESROBOT and MAYBEROBOT backdoors are spread using ClickFix lures.

BleepingComputer reports that fraudulent software download sites for the Homebrew, LogMeIn, and TradingView platforms have been leveraged to compromise macOS developers with the Atomic macOS Stealer, or AMOS, and Odyssey information-stealing payloads as part of a new ClickFix attack campaign.

Intrusions with the newly emergent CAPI Backdoor have been launched against automotive and e-commerce firms across Russia as part of a new phishing campaign, The Hacker News reports.

The attackers are using phishing emails with PDF attachments that contain malicious links, posing as official documents from the Ministry of Finance.

Chinese fintech and cryptocurrency organizations have been subjected to attacks spreading the ValleyRAT backdoor via Windows Scheduled Task exploitation and DLL side-loading as part of the Operation Silk Lure cyberespionage campaign, GBHackers News reports.

Android users across India have been subjected to intrusions spreading the reemergent GhostBat RAT malware as part of a new campaign, reports The Cyber Express.

The new TA585 threat group abuses compromised websites and GitHub issues to spread malware.