Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts

Fire Ant Evolves: From Hypervisors to Trusted Infrastructure      

Gryxa: The AI-Built Toolkit That Watches How You Remove It

ValleyRAT masquerading as adware  

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds  

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Uncovering StreamRat: From Meta Ads to Full Device Takeover  

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon September 2, 2026

Mini Shai-Hulud’s Latest Wave: 280 New Places It Hunts for Your Secrets  

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist 

Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Peer Pressure: Inside the Sality Botnet Disruption Operation

Graph-Based Learning for Android Authorship Attribution: A Comparative Analysis of GNN Models

Stability and Hopf Criteria in a Malware Dissemination Model for Wireless Sensor Networks with Distributed Recovery Delays

PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation

REPLICANT: Learning Policies for Evading and Hardening Malware Detectors

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

International Press – Newsletter

Cybercrime

FulcrumSec claims Manchester Airports hack, theft of 86 GB of data

Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation  

FBI investigation leads to five Venezuelan nationals pleading guilty to attempting to jackpot Kansas ATMs  

FBI Probes Service Selling 153M+ Drivers Licenses

Two Nigerian Nationals Extradited from Nigeria to the United States to Face Sextortion Charges in North Carolina and Mississippi  

The Town 2025 ticketing data sold as a Ticketmaster breach 

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon September 2, 2026  

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal   

Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Malware

Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts

Gryxa: The AI-Built Toolkit That Watches How You Remove It

ValleyRAT masquerading as adware  

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds  

Mini Shai-Hulud’s Latest Wave: 280 New Places It Hunts for Your Secrets  

Hacking

Eclypsium flags 1,051 CVEs in infrastructure advisories 

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP  

Kaspersky zero-day exploit HardBreacher 

PrettyPrague: GenDigital Avast Antivirus ZeroDay Elevation of Privileges Vulnerability  

Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack 

Can AI Create PLC Attacks? Yes, But It’s Not That Easy Yet  

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon 

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking  

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

When Sorting Leads To Confusion  

Intelligence and Information Warfare  

Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist

Fire Ant Evolves: From Hypervisors to Trusted Infrastructure

Insights into Suspected DPRK Workers: Red Flags to Look Out For   

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set  

Leaked Russian Cyber-Operations Training Materials  

Threat Intelligence Report: University Leak Exposes Russia’s Military Cyber Training Pipeline  

Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia

How the Russians Got Inside My Phone

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors    

Cybersecurity

Judge says Pentagon’s measures against Anthropic were ‘illegal and baseless’  

How AI could make it harder for governments to use hacking tools  

Own a gun? Go to church? Do yoga? AI can find out in seconds        

Path to Astra: critical capabilities and frontier safeguards  

PostGREShell: The database powering much of the internet had an open door for 12 years 

Fighting AI with AI: The US’s New Cyber Rules of Engagement 

ATM Flaws Reveal Key Weaknesses in the Software Supply Chain 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor      

FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution     

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads  

SLEEPWALKER: A Passive Backdoor With Its Own Command Language  

Tortoiseshell: New Toolset and Operational Infrastructure Exposed  

Dark Caracal Reloaded: New Malware, Same Hunting Grounds

Cambodia-focused cluster uses multistage infection chain with localized lures  

BlueDelta Targets Defense and Diplomacy with HOOKEDGE  

XAI-Guided Graph-Based Feature Engineering and Heterogeneous Ensemble Learning for Android Malware Detection

BotScan: An adaptive active probing approach for identifying live IoT Botnet C2 servers at scale

EGAMA-RC: Risk-Calibrated Evidence-Gated Adaptive Malware Analysis for Robust and Interpretable Memory-Forensic Triage

Survival of~the~Stealthiest: Evolving Low-Entropy Ransomware via~Genetic Algorithms

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

International Press – Newsletter

Cybercrime

iAuthFlow v2 Enrolls Google Passkeys That Survive Password Resets     

Fake GTA VI ISO circulates on the internet a few days after leak, internet sleuths claim 113GB download is padded malware        

Taiwan charges 9 over illegal AI server exports to China, including Nvidia and Super Micro staff  

Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly

58 arrests in global effort to dismantle West African organized crime groups

Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain       

RTM Locker interview: a ransomware actor on the RaaS market 

Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate  

Love Electric driver data for sale: NI, licence numbers 

Ransomware group says it stole Berlin data, offers it for auction  

Malware 

FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution     

19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads  

SLEEPWALKER: A Passive Backdoor With Its Own Command Language  

Hacking

One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin  

A Tale of Two SOCs: Insights From Two Red Team Assessments  

Three UK airports hit by cyber-attack with data of 8.7m customers accessed   

New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

PaperCut Releases Emergency Patch for Exploited Zero-Day

Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities   

The Hugging Face incident and the road ahead

Power Leak: Amazon Kiro IDE Prompt Injection Enables Data Exfiltration      

Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users’ Reservations in Tests

UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range  

PaperCut Actively Exploited: A Pre-Auth RCE Chain  

Intelligence and Information Warfare  

Iranian hackers shut down UK power plant  

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor    

Digdir stabilizes solutions after cyberattack  

Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure

The infrastructure quartermaster: inside a China-nexus state enablement model     

Disrupting a new covert influence campaign from Russia 

Tortoiseshell: New Toolset and Operational Infrastructure Exposed

Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day

Dark Caracal Reloaded: New Malware, Same Hunting Grounds  

Cambodia-focused cluster uses multistage infection chain with localized lures

BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Cybersecurity

Warning about the risks of road meters  

One billion people are now protected with passkeys on WhatsApp, plus more account security features

An ID Check Breach Timeline: 2011–2026 

Internet Exposure Reduction Guidance 

Meta agrees to pay $18 billion to settle US lawsuits over children’s social media addiction  

DECLARING A NATIONAL EMERGENCY TO SECURE THE UNITED STATES BULK-POWER SYSTEM  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Akira Hits Safe Mode: Ransomware Rebooting Around EDR 

Multi-Functional Linux Botnet “Evooo1Bot”     

StubMaker RubyGems Campaign Delivers a Windows Infostealer  

Hunting MacSync Stealer infrastructure through behavioral pivots 

Manic: Blend between Banking Malware & Spyware  

Clop Returns with Custom Implant in Mass-Extortion Campaign

The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile

Striking gold: Inside the GoldDigger Android malware     

SilkParasite: Tracking a China-Nexus APT Across Central Asia

Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant  

The invisible passenger in your car

Malware Crypting Services and the Threat Actors Who Sell Them 

Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign  

Survival of~the~Stealthiest: Evolving Low-Entropy Ransomware via~Genetic Algorithms

Malformer: A Multi-Modal Malware Detector Using Transformers

XAI-Guided Graph-Based Feature Engineering and Heterogeneous Ensemble Learning for Android Malware Detection

An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

International Press – Newsletter

Cybercrime

McDonald’s employee data listed for sale in wider Entra campaign      

$7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret 

Live Stripe keys for 659 merchants, published for free  

Clop Returns with Custom Implant in Mass-Extortion Campaign  
Justice Department Secures $400M Settlement with TikTok and ByteDance to Resolve Children’s Privacy Litigation       

Malware

Akira Hits Safe Mode: Ransomware Rebooting Around EDR 

Hunting MacSync Stealer infrastructure through behavioral pivots 

Manic: Blend between Banking Malware & Spyware  

The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile

The invisible passenger in your car

Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign  

Hacking

Large-scale DDoS attacks disrupted Threema secure messaging service

The LiteLLM Supply-Chain Attack — TeamPCP “SANDCLOCK” CI/CD Credential-Harvesting Campaign via a Backdoored Trivy GitHub Action  

Actively exploited vulnerability in Zimbra Collaboration Suite

AI-assisted tool helped secure satellite communication system after 2022 Russian hacking

Expired credit cards revived by researchers to make unauthorized payments     

CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks

When the NASA Ground Station Has No Lock on the Door: Unauthenticated Command Execution in AIT-GUI (GHSA-p9r8-2q67-fp86)      

Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories  

Intelligence and Information Warfare  

Operation CameraSwarm:  Over 14,000 Dahua cameras compromised across Ukraine and Russia 

17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities  

Defending Against an Active Threat to Siemens S7 Series PLCs  

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns  

Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia  

SilkParasite: Tracking a China-Nexus APT Across Central Asia

Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network    

Cybersecurity

France probes unprecedented cyberattack after tax data of 678,000 users stolen 

Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them  

SafePal Unauthorized Access To A Subset Of Customer Order Information 

This ‘adversarial’ pattern can prevent surveillance cameras from detecting you 

France’s cybersecurity problem demands strong political will  

The Powerful Chinese AI Model Experts Warned About—and Waited for—Is Here 

OpenAI president says companies should do 10 things ASAP to defend against AI cyber threats 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM

ShieldBreak – August 2026 disclosure  

Kimwolf v7: An Evolution of the Kimwolf Botnet 

CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors 

China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers  

Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme  

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection  

Concept Drift Detection and Adaptive Retraining of Malware Classification Models

A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models

C-GUARD: Context-Adaptive Conformal Gating for Improving Robustness Against Evasive Windows PE Malware

An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

International Press – Newsletter

Cybercrime

ExfilSquad Targets New Victims, Shares Data via Torrents  

Israeli population registry for sale, but the data is old  

Before Fraud Transacts  

ExfilSquad Targets New Victims, Shares Data via Torrents

Fake CAPTCHA, Real Business: Traffic Distribution for Hire  

7.3M chess.com records leaked, and the data is real

Drop Something? Don’t Worry, Someone Caught it      

Malware

ShieldBreak – August 2026 disclosure  

Kimwolf v7: An Evolution of the Kimwolf Botnet 

AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers  

Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme  

737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection  

Hacking

Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations  

AI assistant hacks gym website in first known Australian autonomous cyber attack  

Zoomsday

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

It’s a pre-auth, stupid!  

A root remote command execution on macOS with M5 in 2026?

Intelligence and Information Warfare  

Follow-Up Analysis of the 29 December 2025 Energy Sector Incident    

New Jersey, Alabama Join States Targeted in Water Cyberattacks 

Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM  

China-linked hackers hit Taiwan in unprecedented ‘autonomous’ AI cyber attack  

State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day Exploit  

Social engineering performed by UAC-0145: compromising in the employment process 

Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side  

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure 

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

How Tehran’s Use of Cyber Operations in the U.S.-Iran Conflict Has Evolved  

Cybersecurity

How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta

Responding to the next frontier of critical cyber capabilities      

Facebook is paying controversial creators to produce rage-bait content  

Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC  

The August 2026 Security Update Review 

Cyberattack on logistics giant CEVA delivers customer data into the wrong hands

About Apple threat notifications and protecting against mercenary spyware

If Apple sends you a push notification alerting you to a spyware attack, take it seriously 

AI isn’t changing how companies work. It’s changing what a company is 

Swarms of OpenAI systems set up their own chatrooms to discuss and carry out hacks, company reveals 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

International Press – Newsletter

Cybercrime

CareCloud begins to notify hundreds of thousands after hackers stole medical records  

Żabka alleged data leak: 541k Jira tickets, 89 repos  

ExfilSquad Targets Misconfigured Microsoft Power Pages Portals  

Cyberattack hits Liechtenstein’s register of people behind companies and foundations  

Canadian Man Pleads Guilty to Hacking U.S. Cloud Storage Provider and Extorting Its Customers for Millions   

Major hedge funds targeted in wave of attempted cyberattacks

Belarusian leader of international ransomware scheme known as “Ransom Cartel” sentenced to 16 years in prison  

Scammers target OnlyFans users with deepfakes

UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments  

Malware

Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums   

DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs  

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

Wallet-depleting macOS malware wants your crypto     

Hacking

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Rapid Response: Critical N-able N-central Vulnerability and Active Exploitation 

Swiss federal IT office hit by cyberattack  

OVSwrap: another Linux local root vulnerability 

Incident Report: unsanctioned agent behaviour during cyber testing  

Meta says its AI model hacked into another company during testing  

Natjack A NEW ATTACK CLASS AGAINST NETWORK INFRASTRUCTURE DEVICES  

XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638)  

Black Hat USA 2026: The ‘Breaking’ News: The OpenAI–Hugging Face Incident  

Hackers Stalked Me by Hijacking a Smartwatch for Kids  

Security update available for Metabase – Please upgrade now 

CSS:the bomb inside your inbox  

Intelligence and Information Warfare  

DarkSword’s Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster

China launches mysterious probe into security of Palo Alto Networks’ products

The Fourth Battlefield: The Growing Role of Cyber Operations in Global Conflict  

Republic of Georgia alleges foreign disinfo campaign sought to scare off Russian tourists

Cybersecurity

EU in talks with OpenAI, Anthropic after rogue AI agent hacks  

Commission publishes new guidance to support timely Cyber Resilience Act implementation  

Western government leaders call for a focus on infrastructure resilience, not AI hype

Brazil Health Surveillance Database Exposed 79GB of Sensitive Records     

Chinese router vendor denies its firmware contains backdoors – but pauses downloads to fix security issues anyway

ENDLESSDOORS Is Phoning Home. Pick Up  

Meta fined $567m in largest child safety ruling against social media giant 

Hackers targeted US private equity, other firms including Blackstone, CME, data shows  

Military device manufacturer discloses cyber incident to SEC 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

TAG-195 Upgrades MaaS Ecosystem with Modular Tools 

Inside a DPRK BlueNoroff ClickFix Kit

SourTrade: Browser-Assembled Malware Delivered Through Malvertising  

MedusaHVNC: A Hidden Desktop That Steals Live Windows Sessions  

Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service  

Dysphoria: A Rising Star in Botnets – Evolution and In-Depth Technical Analysis  

Adform compromised to serve crypto stealer via supply chain attack  

Cato CTRL Threat Research: SilverFox Evolves: Abuse of New Drivers and Trusted Software Hijacking Enable Remote Access with ValleyRAT in Japan

Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon  

ClickFix, EtherHiding & a DPRK Wallet Trail

(Joint Cybersecurity Advisory) Warning Against Hacking Attacks on Korean Citizens and Businesses by State-Backed Hacking Organizations  

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft  

OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia 

Nested Trust: HollowFrame’s Layered Loader and Matryoshka Backdoors

Guarding Organizations Against Malware Risk: A Novel Graph-Based Malware Detection Method

EXE-Bench: Ranking the Tradeoffs of AI-based Windows Malware Detectors for Real-World Usability

Symmetric Dual-Domain Prototype Adaptation for Few-Shot Image-Based Malware Classification

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

UAC-0145 Primary Compromise Vectors as of July 2026  

SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor  

AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware  

Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel  

HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels  

The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results  

UAC-0099: LUNCHPOKE, BURNYBEAR, updated to MATCHBOIL.V2 and using Notepad++ 8.8.3  

Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? 

Thailand’s Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI  

Symmetric Dual-Domain Prototype Adaptation for Few-Shot Image-Based Malware Classification

Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis

(A)iSpy: Parasitic Trojans for Machine Learning Infrastructure

Taming the Security-Energy Paradox: A Green AI Approach to Optimized Android Malware Detection

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

International Press – Newsletter

Cybercrime

Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware  

A blow against one of the world’s most dangerous phishing groups  

The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results

Swiss train maker tells ransomware crooks to get off at the next stop

Europol-led action against nihilistic violent extremist network “The Com”  

Illinois Man Sentenced to Over Six Years in Prison for Identity Theft and Wire Fraud  

Origin Energy investigates alleged cyber attack after hacker claims to have stolen data of two million customers in ransom bid 

Malware

SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor  

HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels  

AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware  

Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel  

Dolphin X Stealer Targets 300+ Apps and Profiles Users with AI  

Hacking

Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)      

World’s Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent

5-Year-Old Pre-Auth nginx RCE Across 13 Call Sites: Two-Pass Capture Clobbering CVE-2026-42533  

Smashing the ServiceNow Sandbox – Pre Authentication RCE  

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC

OpenAI and Hugging Face partner to address security incident during model evaluation  

The Vulnerability That Turned Adobe’s 300M-Install Extension Into a Full WhatsApp Takeover 

CVE-2026-8933: Local Privilege Escalation in Set-Capabilities snap-confine

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access

American Hackers-for-Hire Proposal Sparks Heavy Criticism  

Intelligence and Information Warfare  

Brochure Cybersecurity advisory Russian state actors are compromising IP cameras  

UAC-0145 Primary Compromise Vectors as of July 2026  

Inside Russia’s Camera-Hacking Espionage Campaign 

Blog JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake 

CISA, NSA, FBI and Partners Warn Zimbra Collaboration Suite Users of Ongoing Russian State-Supported Malicious Threat Activity  

UAC-0099: LUNCHPOKE, BURNYBEAR, updated to MATCHBOIL.V2 and using Notepad++ 8.8.3

Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458

Thailand’s Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged  

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure 

Cybersecurity

Zimbra Patches Critical SNMP Command Injection and Four XSS Vulnerabilities

Identity Attacks Overtake Exploits as Top Ransomware Cause  

LG to Ban Residential Proxies from Smart TV Apps  

Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains

Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber  

Google hit with $1 billion EU fine, in ‘constructive’ talks to avoid more penalties  

Is Patching Dead? Vulnerability Management in the Post-Mythos Era

How AI guardrails are impeding the work of offensive cybersecurity researchers  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

International Press – Newsletter

Cybercrime

Armenian National Extradited to the United States Pleads Guilty to Ransomware Extortion Conspiracy  

Investigation into Odido hack points to possible involvement of the Dutch  

German firm files for insolvency, blames cybercrims who shut down production for 6 weeks

Japan’s largest taxi operator shuts systems after cyberattack

Inside Forg365: A Telegram-Distributed Sneaky 2FA-Style PhaaS Targeting Microsoft 365 

Two sentenced for hacking Transport for London in UK’s biggest ever cyber crime case  

Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

Malware

CrashStealer: C++ macOS infostealer posing as crash reporter

Lucide Proxy: Turning Student Web Proxies into DDoS Bots      

AsyncAPI npm organization compromised, 2M weekly downloads affected  

TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains  

NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era  

Hacking

Large-scale exploitation campaign targeting website content management systems (CMS)  

Analyzing AI-Augmented Network Enumeration  

LegacyHive public disclosure 

Claude for-Chrome Extension-Bypass

Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8n  

wp2shell: Pre Authentication RCE in WordPress Core  

OpenSSL HollowByte: A DoS Hiding in 11 Bytes  

wp2shell: Pre Authentication RCE in WordPress Core  

Intelligence and Information Warfare  

EU targets Russian intelligence officers accused of running a yearslong cyberspying campaign  

NSA revives ‘Tailored Access Operations’ name for elite hacking unit  

UK and EU strike Russian cyber networks with new sanctions  

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

NATO logistics, Ukrainian troops are top subjects of Russian camera hacks, advisory says  

Suspected Chinese Operators Use Claude Code and DeepSeek to Target Government and Financial Systems Across Four Countries  

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor

New North Korean campaign uses fake coding interviews to steal developer credentials

Cybersecurity

xAI Grok CLI Uploads Full Repos and Secrets, Opt-Out Ignored  

Satya Nadella’s ‘Reverse Information Paradox’ post draws reactions from AI leaders

BabeLLM: A unified taxonomy for NLP-based LLM cybersecurity applications  

Treasury Sanctions Malware and Infrastructure Providers Supporting Ransomware Attacks Against Americans 

The July 2026 Security Update Review  

A Puerto Rico Government Agency Exposed 1 Million Social Security Numbers 

AI Data Centers Are Being Built Faster Than They Can Be Secured

Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei  

Ernst & Young discloses data breach after support system hack  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

International Press – Newsletter

Cybercrime

The National Police have arrested a suspected collaborator of the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest  

Accenture confirms breach after hacker offers stolen data for sale  

Over 5,800 arrests, USD 293 million intercepted in global fraud bust  

Florida Ransomware Negotiator Who Extorted and Attacked Multiple U.S. Victims Sentenced to Prison 

Felons, Fraudsters Flog Offensive Cybersecurity Startup 

Malware

Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux  

Vibe Coded Extortion: Avalon’s Path from Legal Lure to CrownX Ransom Capabilities

GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories  

Hacking

Bad Epoll: The bug missed by Mythos  

Seven FatFs bugs, one very large blast radius  

Indirect Prompt Injection in Web Content Targets AI Agents  

TrojPix: Electromagnetic Covert Channels via Imperceptible Pixel Modulation  

Januscape: Guest-to-Host Escape in KVM/x86  

Critical Gitea Flaw Under Active Exploitation, Researchers Warn

Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren’t always the most exploited     

New Ghost Phishing Wave Is Breaking Traditional Email Security

Intelligence and Information Warfare  

Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

Hacktivists call out Trump by hacking and defacing US Army websites 

What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out  

CIA Officers Can Sense the Threat Within 

Canadian spy agency says it hacked drug traffickers, extremists, and a ransomware gang last year  

One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement

Cybersecurity

Tenda firmware (multiple versions) contains hidden authentication backdoor 

US cyber agency is using Anthropic’s Mythos to audit government code, sources say

Showdown in Strasbourg: The unexpected return of Chat Control 1.0 

Another massive data breach exposed millions of driver’s license numbers 

Reframing smart glasses as ‘pervert glasses’  

EU takes member states to court over unimplemented cybersecurity law 

npm install-time security and GAT bypass2fa deprecation 

Unfit to Boot: Breaking U-Boot’s FIT Signature Verification  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

International Press – Newsletter

Cybercrime

Blackfield ransomware asks Nidec Corporation for $2 million ransom

XSS forum: from DaMaGeLaB to the 2025 takedown   

No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack 

Alleged Member of Criminal Cyber Hacking Group “Scattered Spider” Arrested in Finland and Extradited to the United States 

SOCRadar Links FortiBleed Campaign to INC and Lynx Ransomware Operations

FBI Seizes NetNut Proxy Platform, Popa Botnet 

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks       

Cyber Criminal Group TeamPCP  

Malware

Hijacked npm Packages Use Novel VSCode Autorun and Blockchain Dead Drops to Deploy a Credential/Crypto Stealer  

Inside StegoAd: How a Threat Actor Evolved to Fuel Silent Ad Fraud and Credential Theft at Scale 

A Djinn in the Machine: TaskWeaver’s Node.js Intrusion Chain  

Chromium extension uses AI‑related branding to redirect browser search  

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique      

Hacking

Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild

CVE-2026-48558: SimpleHelp Authentication Bypass Indicators of Compromise   

GuardFall: a universal shell injection vulnerability in open-source AI agents  

Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

Hidden LLM Backdoors Could Detonate At Massive Scale 

Intelligence and Information Warfare  

Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials

UNC5792 – Reward

Mustang Panda targets India’s government and energy sectors with ZOHOMURK and MINIRECON

PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems

Espionage Against the European Parliament         

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Cybersecurity

It’s time to reserve your WhatsApp username

Massive breach spills credentials for thousands of sensitive networks  

Over 900 Oracle E-Business instances exposed to ongoing attacks 

Google Android: the Court of Justice upholds Google’s fine of around €4.1 billion 

Which industry & country has the worst email security? An analysis of 5,800+ domains for SPF, DMARC, DKIM & MTA-STS protocols

China Has Matched Anthropic in Cybersecurity, Resetting AI Race      

Google’s Continued Disruption of Malicious Residential Proxy Networks 

Claude Fable 5 isn’t permanently leaving subscriptions, Anthropic says

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers  

A VBScript campaign distributed through WhatsApp deploying RMM software 

Lost in relocation: analysis of a new loader distributing CASTLESTEALER  

PSA: Supply Chain Compromise Targets ShapedPlugin, Backdoored Pro Plugins Distributed via Official Channels

From PostCSS Masquerading to Windows RAT  

Prinz Eugen ransomware: a deep dive into a new Go-based encryptor

From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet      

Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker  

ESET takes part in Operation Endgame to disrupt Amadey and Stealc 

StealC you later: Proofpoint and IBM X-Force support Operation Endgame disruptions 

Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker 

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox 

Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem  

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure  

DroidBreaker: Practical and Functional Problem-Space Attacks on Machine-Learning Android Malware Detectors

Burnyard: Future of Malware Analysis

Consistent and Compatible Modelling of Cyber Intrusions and Incident Response Demonstrated in the Context of Malware Attacks on Critical Infrastructure

An Explainable Hybrid Pipeline for Malware Classification: Benchmark Construction, Feature Reduction, and Security-Oriented Evaluation

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

International Press – Newsletter

Cybercrime

The Broker Behind FortiBleed: Anatomy of a Russian-Speaking Access Operation  

Security News This Week: Hackers Claim to Leak Stolen Madison Square Garden Data 

Scaling cybercrime disruption through innovation and AI

Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks

Third Defendant Sentenced To Prison For Hacking Fantasy Sports And Betting Website    

ACE, UEFA, UC3 and Mexican Authorities Disrupt Major PirloTV-Linked Sports Piracy Ring Serving Latin America

India’s Tata Electronics hit by cyber breach claiming to expose Apple, Tesla trade secrets     

Polymarket to Refund Users After Hackers Steal $3M in Frontend Attack      

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access  

Malware

More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers  

A VBScript campaign distributed through WhatsApp deploying RMM software 

Prinz Eugen ransomware: a deep dive into a new Go-based encryptor

Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker  

Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem  

Hacking

Introducing usbliter8 

Squidbleed (CVE-2026-47729) Heartbleed’s ancient cousin, hiding in Squid since 1997  

PSA: Supply Chain Compromise Targets ShapedPlugin, Backdoored Pro Plugins Distributed via Official Channels  

DifyTap: Zafran discovers how attackers can silently wiretap AI data across tenants on a platform powering 1M+ apps  

When Defenses Become Attack Surface: CVE-2026-20971, a Samsung Kernel UAF  

Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager   

AISLE Discovers 6 New CVEs in curl, Including the Oldest Issue Ever Reported 

A new unpatchable flaw in Apple chips opens the door to an iPhone jailbreak  

Elite network says it was hacked after members’ personal data was left exposed  

New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503)  

Intelligence and Information Warfare  

Claude Fable 5 Resurfaces in Android App as NSA Breach Testimony Reshapes Ban  

From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet

Five Eyes cyber security agencies statement The AI shift in cyber risk: why leaders must act now   

Weaponized AI: Inside The Criminal Ecosystem Fueling The Fifth Wave of Cybercrime  

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox  

Russia Breaks Into Human Rights Activist’s Phone With Cellebrite 

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

Russian Intelligence Services Continue to Target Commercial Messaging Applications  

Cybersecurity

Deutsche Bahn halts trains nationwide amid IT meltdown

How to Disappear From the Internet in 7 Days 

The quantum threat: Navigating cryptographic risks in a new computing era

Dozens of America’s largest companies have no simple way to report security flaws      

Xsolis Data Breach Affects 1.4 Million Individuals  

‘Wake-up call’: Europe reacts to Anthropic halting access to its Fable 5 and Mythos 5 AI models  

Meta Pauses Employee-Tracking Program Following Internal Data Leak 

State of SDLC Security 2026 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

Malware Newsletter

OptinMonster supply chain attack hits 1.2 million sites  

Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research   

Rokarolla : Android Banker with Complete Device Takeover Capabilities  

FishMonger’s arsenal upgraded: SprySOCKS for Windows

Analysis of APT37 NarwhalRAT Leveraging MS-Themed Phishing and Dead-drop C2

The macOS Tahoe artifact that tracks every menu selection a user makes  

easy-day-js: Supply Chain Campaign Targets Mastra npm Packages

WordPress PBN Plugin Drops Dual Webshells via Database Injection     

Hidden in Teams: DragonForce Attackers Weaponize Microsoft Teams Relays to Stay Hidden

Italian Invoice-Themed Phishing Campaign Delivers UpCrypter and NeptuneRAT

Multiple JetBrains IDE plugins caught stealing AI keys

Dozens of malicious wallpapers found on Steam Workshop: gamers’ accounts at risk  

Crypto Clipper uses Tor and worm-like propagation for persistence and control      

Sayonara, SocGholish: Operation Endgame Disrupts Major Cybercrime Operation  

Killing me gently: Inside Gentlemen’s EDR killer framework 

Cognitive Network Intrusion Detection Systems: Anomaly and Malware Detection for Zero-Day Attack Resilience

Multi-View Decompilation for LLM-Based Malware Classification

Anywhere, Any-Stymie: Remote Activation of Trojan Malware on LiDAR with Modulated Signals

Scalable Malware Family Classification Using Quantum Kernel Based Machine Learning

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)