Python NodeStealer now adds keylogging, clipboard, and screenshot spyware plus dual Telegram C2. See how the NodeStealer spyware upgrade works.

Related Posts:

• Pegasus Spyware Hits Serbian Student Activist via Zero-Click iMessage
• Node.js Malware Attacks Target Tech and Finance Sectors
• Packagist Themes iOS Spyware Steals Crypto Wallet Seeds

The post Python NodeStealer Adds Keylogging and Screen Capture Spyware appeared first on Daily CyberSecurity.

The Toy Ghouls backdoor hides C2 traffic in HiveMQ MQTT and Element messenger. See how the Bearlyfy group's custom malware works.

Related Posts:

• US Offers $10M for IRGC Cyber Leader
• Coder Registry Attack: Hijacked Cloudflare Pool Served Malicious Terraform Modules
• AWS Password Spraying Campaign Targets Root Accounts

The post Toy Ghouls Backdoor Uses HiveMQ and Element for C2 appeared first on Daily CyberSecurity.

Zscaler details the C2Looper backdoor, a Rust backdoor tied to ransomware that uses GitHub for C2 and likely spreads through ClickFix lures.

Related Posts:

• WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns
• Manic Android Malware Steals Data Without Active Internet
• Android Head Unit Malware Recruits Vehicles into Botnet

The post C2Looper: Rust Backdoor Uses GitHub for C2 Control appeared first on Daily CyberSecurity.

Acronis ties a new PATCHCORD malware APT36 campaign to Afghan telecom and Indian targets. SHEETCORD malware abuses Google Sheets for C2.

Related Posts:

• HoneyMyte CoolClient Rootkit Deploys Kernel Driver
• DOJ Charges 17 Iranians in Mabna Institute Cyber Theft
• Armored Likho Still Toolkit Deploys Covert Spying Implants

The post PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign appeared first on Daily CyberSecurity.

The Aeternum blockchain botnet hides C2 commands inside Polygon smart contracts, evading takedowns while dropping XWorm and XMRig payloads.

Related Posts:

• GEEKOM Mini PC Driver Downloads Found Bundled With Backdoor Since 2024
• Abyssos Modular RAT: Zscaler ThreatLabz Analysis
• DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT

The post Aeternum Blockchain Botnet Hides C2 Commands in Polygon Smart Contracts appeared first on Daily CyberSecurity.

ChainDrop npm worm infected 400+ packages, stealing cloud keys and CI secrets via blockchain C2. Unit 42 details the full attack chain and fixes.

Related Posts:

• Fake Zoom Installer Drops Overlord RAT on macOS
• macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate
• Fake AI Tools Malware Targets Developers Through GitHub

The post ChainDrop npm Worm Hits 400+ Packages via Blockchain C2 appeared first on Daily CyberSecurity.