Malware

The "Google Notes" extension, identified by McAfee researchers, operates by requesting broad permissions, including access to all websites, browsing history, and the clipboard, which are unusual for a note-taking application.

The Ousaban campaign begins with a phishing PDF disguised as a corrupted file, prompting users to click an "Update" button.

This activity is part of a large, multi-language campaign that distributes malicious installer archives hosted on spoofed websites, according to a recent report by The Hacker News.

RustDuck targets a variety of IoT devices, including routers, cameras, and Android set-top boxes, as well as exposed servers running software like ThinkPHP and Jenkins.

The TaskWeaver loader delivers Djinn Stealer, which targets dev credentials and AI tokens.

The StegoAd campaign employed steganography to hide malicious JavaScript within image and font files, making the extensions appear legitimate and functional.

Attackers are employing sophisticated tactics, hiding malicious code behind convincing government branding and legal references to trick victims into downloading a ZIP archive, according to CYFIRMA.

The StrikeShark campaign exhibits a broad geographic reach, targeting a diplomatic organization in Indonesia, government entities in Taiwan, software development companies globally, and other sectors in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia.