Fake Adobe Acrobat pages distribute signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, CloudSEK’s researchers say.

StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using…

WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access…

Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active…

Microsoft addressed 1,413 security vulnerabilities in its October 2026 Patch Tuesday update, making it the company’s largest monthly…

Google Ads deliver a tech support scam kit that shows fake security alerts, makes browsers appear locked and…

FortiGuard found SectopRAT hidden in modified audio software files, using staged loading to steal browser data and remotely control infected Windows PCs.

Varonis Threat Labs discovered AvisLoader, a Windows malware loader that uses the Tox peer-to-peer network for C2 and arrives through a malicious ClickFix lure.

TASK#STOMP Windows backdoor uses PowerShell, scheduled tasks and runtime C# compilation to steal business documents and maintain remote access.

Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.

Kaspersky links OctLurk and SilkLurk to cyberespionage attacks stealing passwords, emails and files from government systems in six countries since January 2025.

Dolphin X malware targets more than 300 apps and includes an AI Profiler that scores infected Windows PCs to help criminals identify high-value victims quickly.

Fortinet has found a new TrickBot variant hiding commands in DNS traffic and using scheduled tasks and added modules to maintain access on infected Windows PCs.

Connecting certain LG monitors prompts Windows Update to install an LG app without consent, while the software runs at startup and displays McAfee trial adverts.

Kaspersky says OkoBot targets crypto users through fake software, stealing wallet files, seed phrases and passwords while recording activity inside wallet apps.

Microsoft details GigaWiper, a destructive Windows backdoor that can wipe disks, encrypt files and give attackers remote access to compromised systems globally.

JFrog warns of malicious npm packages that mimic PostCSS tooling, drop a Windows RAT, and target Chrome-stored passwords through a staged infection setup route.