❌

Visualização normal

Antes de ontemCybersecurity News
  • ✇Cybersecurity News
  • SynkLoader Malware Deploys Multi-Language Attack Tools Do Son
    Expel analyzed the SynkLoader malware attack chain. Discover how SynkLoader malware uses Teams phishing and fake lock screens to steal credentials. Related Posts: macOS ClickFix Malware Exploits Polygon C2 WeedHack Malware Still Hits Minecraft Gamers via Fake Sites Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR The post SynkLoader Malware Deploys Multi-Language Attack Tools appeared first on Daily CyberSecurity.
     
  • ↗️

SynkLoader Malware Deploys Multi-Language Attack Tools

✇Cybersecurity News
Por:Do Son
28 de Agosto de 2026, 05:00

Expel analyzed the SynkLoader malware attack chain. Discover how SynkLoader malware uses Teams phishing and fake lock screens to steal credentials.

Related Posts:

The post SynkLoader Malware Deploys Multi-Language Attack Tools appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns Do Son
    WordlistLoader malware delivers Amatera Stealer through ClearFake fake-CAPTCHA campaigns, using stealthy evasion to steal browser data. Related Posts: Clop Deploys Custom Web Shell in PTC Windchill Extortion Attacks C2Looper: Rust Backdoor Uses GitHub for C2 Control Manic Android Malware Steals Data Without Active Internet The post WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns appeared first on Daily CyberSecurity.
     
  • ↗️

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns

✇Cybersecurity News
Por:Do Son
24 de Agosto de 2026, 05:01

WordlistLoader malware delivers Amatera Stealer through ClearFake fake-CAPTCHA campaigns, using stealthy evasion to steal browser data.

Related Posts:

The post WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • Fake AI Tools Malware Targets Developers Through GitHub Do Son
    Fake AI tools malware targets developers in a GitHub infostealer campaign using SmartLoader and blockchain C2. See how it works. Related Posts: macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT Interlock Ransomware Abuses Volatility3 for Credential Theft The post Fake AI Tools Malware Targets Developers Through GitHub appeared first on Daily CyberSecurity.
     
  • ↗️

Fake AI Tools Malware Targets Developers Through GitHub

✇Cybersecurity News
Por:Do Son
11 de Agosto de 2026, 04:42

Fake AI tools malware targets developers in a GitHub infostealer campaign using SmartLoader and blockchain C2. See how it works.

Related Posts:

The post Fake AI Tools Malware Targets Developers Through GitHub appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT Do Son
    DOUBLECUP is a new Russian ClickFix Loader-as-a-Service that drops CountLoader and the DeviceManager RAT using steganography and EtherHiding. Related Posts: macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate Fake AI Tools Malware Targets Developers Through GitHub Interlock Ransomware Abuses Volatility3 for Credential Theft The post DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT appeared first on Daily CyberSecurity.
     
  • ↗️

DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT

✇Cybersecurity News
Por:Do Son
11 de Agosto de 2026, 03:42

DOUBLECUP is a new Russian ClickFix Loader-as-a-Service that drops CountLoader and the DeviceManager RAT using steganography and EtherHiding.

Related Posts:

The post DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT appeared first on Daily CyberSecurity.

  • ✇Firewall Daily – The Cyber Express
  • Two Joyfill npm Packages Found Delivering DEV#POPPER Malware Ashish Khaitan
    Two beta releases of joyfill npm Packages have been found distributing a malware implant capable of delivering the DEV#POPPER remote access trojan (RAT) . The compromised Node.js packages use an import-time loader that retrieves encrypted payloads through blockchain transactions instead of traditional command-and-control infrastructure.  The affected releases are @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4. Joyfill develops software development kits for e
     
  • ↗️

Two Joyfill npm Packages Found Delivering DEV#POPPER Malware

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan
29 de Julho de 2026, 07:51

joyfill npm Packages

Two beta releases of joyfill npm Packages have been found distributing a malware implant capable of delivering the DEV#POPPER remote access trojan (RAT) . The compromised Node.js packages use an import-time loader that retrieves encrypted payloads through blockchain transactions instead of traditional command-and-control infrastructure.  The affected releases are @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4. Joyfill develops software development kits for embedding forms, documents, and PDFs into web and mobile applications. While both packages collectively receive around 16,000 weekly npm downloads, researchers noted that the figure overlaps because @joyfill/components depends on @joyfill/layouts, and it does not represent installations of the compromised beta versions. 

Joyfill npm Packages Deliver DEV#POPPER RAT Malware

Unlike conventional npm attacks that rely on lifecycle scripts, the malicious code executes when the Node.js module is imported. This means the implant activates during package loading, making npm install --ignore-scripts ineffective once the affected module is used.  Socket's analysis identified code patterns matching the PolinRider loader family and linked the final payload to the DEV#POPPER malware family. Researchers emphasized that these findings are based on technical similarities and published research rather than attributing the compromise to a specific threat actor.  According to the report, the compromised joyfill npm Packages are capable of arbitrary code execution across development environments, CI runners, test systems, server-side rendering environments, and production builds. The recovered 77 KB Node.js RAT can collect host information, establish a Socket.IO remote-control channel, execute JavaScript or shell commands, upload files, access clipboard data, and modify developer-related files to maintain persistence. 

Blockchain Infrastructure Powers Multi-Stage Malware 

Investigators found that both malicious releases were published on 28 July 2026 using Node.js 18.20.0 and npm 10.5.0, with the shared prerelease build marker 2773. Source maps indicate the malicious code was present during the build process, although the report states this does not determine whether attackers compromised a developer workstation, source repository, CI pipeline or publishing credentials.  The malware uses a multi-stage delivery process, retrieving encrypted payloads through Tron, Aptos and BNB Smart Chain transactions. Researchers warned that this blockchain-based approach enables attackers to update payloads without publishing new npm releases.  Additional payloads downloaded by the malware included a detached Node.js bootstrap and a Python credential stealer believed, with medium confidence, to be a variant of OmniStealer. 

Recommendations for Developers and Security Teams 

The report also noted significant similarities to an incident analysed by eSentire earlier in 2026, in which DEV#POPPER was deployed via a weaponised GitHub repository. However, researchers believe the current campaign most likely resulted from a maintainer compromise rather than a malicious project clone.  Security teams are advised to remove both affected joyfill npm Packages, replace them with verified versions @joyfill/layouts@0.1.1 and @joyfill/components@4.0.0-rc24, isolate any systems that imported the malicious releases, and rotate credentials from unaffected machines. The researchers also recommend monitoring Node.js environments for unusual blockchain RPC traffic and reviewing systems for persistence mechanisms that may remain even after the packages are removed. 

China-Linked TA4922 Hackers Target UK, Europe With New SilentRunLoader Malware

✇Hackread – Latest Cybersecurity, Tech, Crypto & Hacking News
Por:Waqas
3 de Junho de 2026, 10:30
Proofpoint says TA4922, a suspected China aligned cybercrime group, is targeting UK and European organisations with tax, payroll and benefits themed malware campaigns.

Hackers Hijack JDownloader Site to Deliver Malware Through Installers

✇Hackread – Latest Cybersecurity, Tech, Crypto & Hacking News
Por:Deeba Ahmed
10 de Maio de 2026, 07:27
JDownloader confirms a security breach where hackers manipulated official download links to distribute malicious files between 6 and 7 May 2026.

Active HanGhost Loader Campaign Targets Enterprise Payment and Logistics Workflows

✇Hackread – Latest Cybersecurity, Tech, Crypto & Hacking News
Por:Owais Sultan
15 de Abril de 2026, 05:36
Active HanGhost Loader campaign targets enterprise payment and logistics workflows with fileless attacks, multi-stage execution, and stealthy malware delivery.
❌
❌