Malware
19 articles RSS
Pluto Security Says a Hugging Face Cryptomining Campaign Returned With 19 More Repositories, Its Flagship Model Scanning Clean
Pluto Security counts 31 malicious Hugging Face repositories in two waves that abuse trust_remote_code to run a miner; the second-wave flagship model scanned clean and reached 28,412 downloads.
LiteLLM Says Stolen GitHub CLI Tokens and a Lookalike Repository Were Used to Publish Malicious 1.107.0 Releases to PyPI and Docker
LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and backdoor; the project says attackers used stolen GitHub CLI tokens and a lookalike repository to publish it.
Microsoft Removes WMIC From Windows 11 24H2 and 25H2, Closing Out a 25-Year-Old Tool Abused as a LOLBIN
Microsoft has pulled the WMIC command-line utility from Windows 11 24H2, 25H2, and 26H1 builds, ending a tool long abused by ransomware and other attackers.
Malicious 'Solidity Pro' VS Code Extensions Steal Crypto Wallets and Developer Credentials via Telegram Exfiltration
Yeeth Security found 'Solidity Pro' VS Code extensions that evolved from a delayed Cloudflare-Worker dropper into a Telegram-based wallet and credential stealer targeting web3 developers.
Malware Attack Forces South Carolina Health System AnMed to Close 79 of 106 Facilities
AnMed shut most of its clinics after a malware disruption hit its network; emergency rooms stayed open and physician offices began reopening Tuesday.
Sysdig Documents JadePuffer, Which It Calls the First Ransomware Attack Run End-to-End by an AI Agent Exploiting a Langflow Flaw
Sysdig says JadePuffer used an LLM agent to exploit Langflow flaw CVE-2025-3248, run 600-plus payloads, and encrypt 1,342 Nacos config items.
Symantec Links a Self-Destructing 'Mistic' Backdoor to the KongTuke Access Broker Feeding Six Ransomware Crews
Symantec ties the in-memory Mistic backdoor to access broker KongTuke, whose footholds have fed Qilin, Akira, Black Basta and other ransomware groups since April 2026.
Operation Endgame Disrupts StealC and Amadey Malware as Microsoft Uses AI and a RICO Suit to Treat Them as One Conspiracy
Law enforcement seized 326 servers and froze 47 million dollars in crypto, while Microsoft filed RICO claims against five defendants after AI tools tied the two malware suites to shared infrastructure.
DAEMON Tools Lite Backdoored for 27 Days: Supply Chain Attack Targeted Government and Scientific Organizations in Russia, Belarus, and Thailand
Kaspersky found official DAEMON Tools Lite installers trojanized from April 8 to May 5, 2026, deploying a multi-stage backdoor to over a dozen targeted machines. CISA added CVE-2026-8398 to its KEV catalog on May 27.
Microsoft Dismantles Fox Tempest, a Malware-Signing Service That Issued Over a Thousand Fraudulent Certificates Through Azure
Microsoft's Digital Crimes Unit seized signspace.cloud and revoked more than 1,000 fraudulent code-signing certificates after Fox Tempest sold access to Azure Artifact Signing for $5,000–$9,000 per transaction to ransomware groups including Rhysida, Akira, and Qilin.
Flashpoint Report Finds Agentic AI Discussions on Criminal Forums Surged 1,500 Percent as Infostealers Fuel 3.3 Billion Stolen Credentials
Flashpoint's 2026 report documents a 1,500 percent spike in AI-related criminal forum activity, 3.3 billion stolen credentials from infostealers, and a 53 percent rise in ransomware incidents.
Qilin Ransomware Group Targets German Political Party Die Linke, Claiming 1.5 Terabytes of Stolen Data
Qilin ransomware group claims attack on German political party Die Linke, threatening to leak 1.5 terabytes of internal data in what the party calls a hybrid warfare operation.