Malware

Malicious npm Packages Steal Crypto Keys, CI Secrets, and API Tokens

Cybersecurity researchers have uncovered an active supply chain attack leveraging at least 19 malicious npm packages to harvest credentials, cryptocurrency private keys, CI secrets, and API tokens from developer environments. The campaign, named SANDWORM_MODE by Socket, exhibits worm like behavior similar to earlier Shai Hulud style attacks. The malware is designed not only to extract sensitive […]

Malicious npm Packages Steal Crypto Keys, CI Secrets, and API Tokens Read More »

MuddyWater Targets MENA Organizations Using GhostFetch, CHAR, and HTTP_VIP

The Iranian state aligned threat group MuddyWater, also tracked as Earth Vetala, Mango Sandstorm, and MUDDYCOAST, has initiated a fresh cyber espionage campaign aimed at organizations and individuals across the Middle East and North Africa region. The latest operation, named Operation Olalampo, demonstrates the group’s continued evolution in malware development and operational tactics. According to

MuddyWater Targets MENA Organizations Using GhostFetch, CHAR, and HTTP_VIP Read More »

Cline CLI 2.3.0 Supply Chain Attack Deployed OpenClaw on Developer Systems

A recent software supply chain incident impacted the open source AI coding assistant Cline CLI, after attackers published a compromised version to the npm registry that silently installed OpenClaw on developer systems. On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to release cline@2.3.0. The altered package included

Cline CLI 2.3.0 Supply Chain Attack Deployed OpenClaw on Developer Systems Read More »

ClickFix Campaign Exploits Compromised Websites to Deploy MIMICRAT Malware

Cybersecurity researchers have uncovered a sophisticated ClickFix campaign that leverages compromised legitimate websites to distribute a newly identified remote access trojan named MIMICRAT, also referred to as AstarionRAT. According to Elastic Security Labs, the operation demonstrates significant technical maturity. Attackers are using breached websites across various industries and regions as delivery infrastructure, deploying a multi stage

ClickFix Campaign Exploits Compromised Websites to Deploy MIMICRAT Malware Read More »

PromptSpy Android Malware Exploits Gemini AI to Automate Recent-Apps Persistence

Cybersecurity researchers have uncovered a sophisticated Android malware, named PromptSpy, that leverages Google’s generative AI chatbot Gemini to automate actions and ensure persistence on infected devices. This marks one of the first known cases of malware incorporating generative AI into its operational flow. How PromptSpy Operates PromptSpy is capable of: According to Lukáš Štefanko, Gemini is

PromptSpy Android Malware Exploits Gemini AI to Automate Recent-Apps Persistence Read More »

INTERPOL Operation Red Card 2.0 Leads to 651 Arrests in African Cybercrime Crackdown

An international cybercrime operation targeting online scams has resulted in 651 arrests and the recovery of over $4.3 million, coordinated by law enforcement agencies from 16 African countries. The initiative, named Operation Red Card 2.0, ran from December 8, 2025 to January 30, 2026, focusing on high-yield investment scams, mobile money fraud, and fraudulent mobile

INTERPOL Operation Red Card 2.0 Leads to 651 Arrests in African Cybercrime Crackdown Read More »

Fake IPTV Apps Distribute Massiv Android Malware Targeting Mobile Banking Users

Cybersecurity experts have identified a new Android banking trojan called Massiv, designed to conduct device takeover (DTO) attacks for financial theft. The malware hides inside seemingly legitimate IPTV apps, luring users who are searching for online TV services and giving attackers remote control over infected devices. How Massiv Operates According to ThreatFabric, Massiv first appeared in

Fake IPTV Apps Distribute Massiv Android Malware Targeting Mobile Banking Users Read More »

CRESCENTHARVEST Campaign Targets Iran Protest Supporters with RAT Malware

Cybersecurity researchers have uncovered a new cyber espionage campaign, dubbed CRESCENTHARVEST, that appears to target individuals supporting ongoing protests in Iran. The operation is designed to deploy a remote access trojan, RAT, capable of long term surveillance, credential theft, and sensitive data exfiltration. Security analysts warn that the campaign reflects a broader pattern of nation

CRESCENTHARVEST Campaign Targets Iran Protest Supporters with RAT Malware Read More »

Notepad++ Patches Hijacked Update Mechanism Exploited to Deliver Targeted Malware

The popular text editor Notepad++ has released a critical security update after its software update mechanism was abused in a targeted supply chain attack. The flaw allowed a China linked threat actor to selectively distribute malware to specific users by manipulating the update delivery process. The newly released version 8.9.2 introduces major security reinforcements designed to prevent

Notepad++ Patches Hijacked Update Mechanism Exploited to Deliver Targeted Malware Read More »

Keenadu Firmware Backdoor Infects Android Tablets Through Signed OTA Updates

Kaspersky researchers have uncovered a sophisticated Android firmware backdoor, dubbed Keenadu, which silently harvests data and enables remote control of infected devices. The malware is embedded in device firmware, affecting brands including Alldocube, and is delivered through signed OTA updates dating back to August 2023. Unlike conventional malware, Keenadu operates at the firmware level, loading into the

Keenadu Firmware Backdoor Infects Android Tablets Through Signed OTA Updates Read More »