Malware

Threat actors have been leveraging link wrapping services for clandestine malware delivery as part of a new phishing campaign aimed at credential exfiltration, reports The Hacker News.

Multiple local internet service providers across Russia have been targeted by Russian state-backed advanced persistent threat operation Secret Blizzard, also known as Turla, to compromise foreign embassies in Moscow with the ApolloShadow malware as part of a cyberespionage campaign that has been underway since last year, according to The Record, a news site by cybersecurity firm Recorded Future.

Knockoff cryptocurrency trading apps have been leveraged to distribute the new credential- and crytowallet-targeting JSCEAL V8 JavaScript malware as part of a new malvertising campaign, according to The Hacker News.

North Korean hacking collective Lazarus Group has been lacing open-source packages with advanced malware as part of efforts to escalate its cyberespionage activities, according to SiliconANGLE.

Darktrace says this is the first known instance of an SAP NetWeaver bug with the AutoColor malware.

Attacks involving the new RedHook Android banking trojan have been launched against Vietnamese mobile users as part of a phishing campaign, reports The Cyber Express.

BleepingComputer reports that threat actors attempted to compromise a U.S.-based chemicals firm with an updated version of the Auto-Color Linux backdoor through the abuse of the critical SAP NetWeaver flaw, tracked as CVE-2025-31324, as part of a thwarted attack in late April.