Malware

Keenadu Firmware Backdoor Infects Android Tablets Through Signed OTA Updates

Kaspersky researchers have uncovered a sophisticated Android firmware backdoor, dubbed Keenadu, which silently harvests data and enables remote control of infected devices. The malware is embedded in device firmware, affecting brands including Alldocube, and is delivered through signed OTA updates dating back to August 2023. Unlike conventional malware, Keenadu operates at the firmware level, loading into the […]

Keenadu Firmware Backdoor Infects Android Tablets Through Signed OTA Updates Read More »

SmartLoader Attack Leverages Trojanized Oura MCP Server to Deploy StealC Infostealer

Cybersecurity researchers have uncovered a sophisticated campaign using a trojanized Model Context Protocol (MCP) server linked to Oura Health to deliver the StealC information stealer. According to Straiker’s AI Research (STAR) Labs, attackers cloned the legitimate Oura MCP server—which normally connects AI assistants to Oura Ring health data—and created fake forks, contributor accounts, and a deceptive infrastructure to build

SmartLoader Attack Leverages Trojanized Oura MCP Server to Deploy StealC Infostealer Read More »

Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens

Cybersecurity researchers have identified a case in which an information-stealing malware successfully extracted sensitive configuration files linked to OpenClaw, the open-source AI agent platform previously known as Clawdbot and Moltbot. According to researchers at Hudson Rock, the incident represents a turning point in infostealer evolution. Instead of focusing solely on browser credentials, threat actors are now harvesting

Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens Read More »

New ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Exfiltration

Cybersecurity experts have uncovered a new mobile spyware platform called ZeroDayRAT, being marketed on Telegram as a tool for stealing sensitive data and conducting real-time surveillance on Android and iOS devices. Daniel Kelley, a security researcher at iVerify, explained, “The developer operates dedicated channels for sales, customer support, and updates, giving buyers access to a fully functional

New ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Exfiltration Read More »

Microsoft Reveals DNS-Based ClickFix Attack Leveraging Nslookup for Malware Staging

Microsoft has uncovered a new evolution of the ClickFix social engineering technique, where attackers manipulate users into executing a DNS lookup command to retrieve malicious payloads. The campaign demonstrates how threat actors continue refining ClickFix methods to bypass traditional security defenses. How the DNS-Based ClickFix Variant Works In this newly observed attack chain, victims are

Microsoft Reveals DNS-Based ClickFix Attack Leveraging Nslookup for Malware Staging Read More »

Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Organizations

A previously undocumented cyber threat actor has been tied to malware attacks against Ukrainian organizations using a strain known as CANFAIL, according to Google Threat Intelligence Group (GTIG). GTIG notes that this group is likely connected to Russian intelligence services and has primarily targeted defense, military, government, and energy entities within Ukraine at both regional

Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Organizations Read More »

UAT-9921 Deploys VoidLink Malware Against Technology and Financial Sectors

A previously unknown threat actor, tracked as UAT-9921, has been linked to sophisticated campaigns targeting technology and financial services organizations. The adversary employs a modular malware framework named VoidLink, capable of long term, stealthy access across Linux and Windows systems, according to findings by Cisco Talos. VoidLink demonstrates advanced capabilities, including kernel level rootkits, on-demand plugin compilation, and

UAT-9921 Deploys VoidLink Malware Against Technology and Financial Sectors Read More »

Malicious Chrome Extensions Exposed for Stealing Business Data, Emails, and Browsing History

Browser extensions are once again under scrutiny after multiple investigations revealed coordinated campaigns abusing Google Chrome add ons to steal business intelligence, authentication codes, emails, and browsing history. Security researchers have identified several malicious extensions impersonating productivity tools, AI assistants, and social media customization plugins. These threats specifically target platforms such as Meta Business Suite, Facebook Business Manager, Google Chrome,

Malicious Chrome Extensions Exposed for Stealing Business Data, Emails, and Browsing History Read More »

Lazarus Campaign Injects Malicious Packages into npm and PyPI Ecosystems

Cybersecurity researchers have uncovered a new wave of malicious packages in the npm and Python Package Index (PyPI) ecosystems linked to the North Korea-backed Lazarus Group. The campaign, dubbed graphalgo, has been active since May 2025 and leverages fake recruitment efforts to compromise developer systems. Campaign Overview Attackers create a convincing narrative around a fictitious company

Lazarus Campaign Injects Malicious Packages into npm and PyPI Ecosystems Read More »

First Malicious Outlook Add-In Discovered Stealing Over 4,000 Microsoft Credentials

Cybersecurity researchers have uncovered what is believed to be the first malicious Microsoft Outlook add-in observed in active attacks. The discovery highlights a new evolution in supply chain threats targeting trusted software marketplaces. According to security firm Koi Security, an unidentified attacker hijacked a previously legitimate but abandoned Outlook add-in domain to host a fraudulent

First Malicious Outlook Add-In Discovered Stealing Over 4,000 Microsoft Credentials Read More »