cPGuard supply chain attack: an update channel compromise pushed a backdoor in versions 5.88.12-5.88.19. Update to 5.88.25 and rotate credentials.

Related Posts:

• Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket
• TeamViewer Client Vulnerability Enables Remote Code Execution
• 7 Unpatched phpMyAdmin Vulnerabilities Exposed

The post cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel appeared first on Daily CyberSecurity.

Cursor removed a malicious Claude Code extension backdoor. Learn how the Cursor Claude Code extension backdoor planted SSH keys on up to 5,000 developer PCs.

Related Posts:

• INJ3CTOR3 FreePBX Malware Steals 17 Configuration Files for Off-Box Toll Fraud
• CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices
• Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026

The post Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace appeared first on Daily CyberSecurity.

Trellix uncovers the Sirius Backdoor in fake FedEx tax invoices. See how the fileless Sirius Backdoor blinds EDRs and survives Windows OS resets.

Related Posts:

• Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries
• Fake Phantom, Jupiter, and Bitget Firefox Extensions Steal Crypto Recovery Phrases
• Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack

The post Fake FedEx Tax Invoice PDFs Deliver Fileless Sirius Backdoor to Windows Systems appeared first on Daily CyberSecurity.

BRONZE SANDCASTLE uses Sandboxie DLL sideloading to run a modified Meterpreter backdoor in memory against targets in Asia and Africa.

Related Posts:

• Skynet LLMjacking Agent Hijacks Exposed AI Models to Hack Servers and Mine Crypto
• INC Ransomware Affiliates Expose Seven Servers Holding Phantom AI Framework and 46 Encryptors
• SafePay Ransomware Hits 600 Victims as FBI, CISA and Allies Issue Joint Warning

The post BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor appeared first on Daily CyberSecurity.

APT28 used the Hookedge backdoor, SSH tunnels, and a new loader to spy on a naval shipbuilder and defense firms in two NATO countries.

Related Posts:

• APT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomatic Agencies
• China-Linked Operator Used AI Agents to Breach 48 Government and Corporate Targets Across Asia
• Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms

The post APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries appeared first on Daily CyberSecurity.

Attackers infected 333 Tor exit nodes with Ebury malware to hijack SSH logins and steal passwords. See how a researcher exposed them.

Related Posts:

• Aoki Infostealer Harvests API Keys and Tokens From AI Coding Assistants
• CL-UNK-1211 Deploys SysGoRAT Malware and AI Scripts Against Government Linux Servers
• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access

The post 333 Tor Exit Nodes Hijacked by Ebury Malware for SSH Attacks appeared first on Daily CyberSecurity.

An active WordPress XSS campaign exploits Ninja Forms flaw CVE-2026-94504 and CVE-2026-93836 to plant hidden admin accounts. Patch now.

Related Posts:

• Apache DolphinScheduler 3.4.3 Fixes Six Authorization Flaws That Leak Passwords and Kubernetes Credentials
• wolfSSH 1.6.0 Fixes Five Flaws, Including Critical Host Key Bypass CVE-2026-16516
• Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027

The post Hackers Exploit Ninja Forms and WPC Product Bundles XSS Flaws to Plant Hidden WordPress Admins appeared first on Daily CyberSecurity.

The ClingSTUN backdoor hijacks unpatched IoT devices and hides in traffic to public STUN servers. Learn how it spreads and how to stop it.

Related Posts:

• Four Attacker Clusters Exploit Citrix NetScaler Flaw CVE-2026-88771 to Plant Web Shells
• Moroccan Intelligence Deploys Vast Surveillance Panopticon
• DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel

The post ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes appeared first on Daily CyberSecurity.

A new DragonForce backdoor hides in Microsoft Teams TURN relays and falls back to MQTT. See how it works and how defenders can spot it.

Related Posts:

• Moroccan Intelligence Deploys Vast Surveillance Panopticon
• New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes
• BPFDoor Backdoor and New AVERAT Implant Hide in SMTP Traffic on Telecom Edge Devices

The post DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel appeared first on Daily CyberSecurity.

UAT-11587 Antino backdoor attacks hit Asian targets. Cisco Talos reveals how the Antino backdoor abuses Microsoft 365 for cyberespionage.

Related Posts:

• PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot
• Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions
• New MacSync macOS Infostealer Targets Crypto Wallets

The post UAT-11587 Targets Asian Governments With Antino Backdoor appeared first on Daily CyberSecurity.

Microsoft details NeedyMantis malware, a modular backdoor that uses DLL sideloading to keep long-term access in telecom, academic, and government networks.

Related Posts:

• UAT-11587 Targets Asian Governments With Antino Backdoor
• PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot
• New MacSync macOS Infostealer Targets Crypto Wallets

The post Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions appeared first on Daily CyberSecurity.

Learn how the new TASK#STOMP PowerShell backdoor steals data. The TASK#STOMP PowerShell backdoor abuses native Windows tools for persistence.

Related Posts:

• Malicious Terraform Providers Spread Graphalgo Go Malware
• CLOSEDQUORUM AI Malware Uses LLMs for Autonomous C2
• WordPress Must-Use Plugin Malware Uses EtherHiding

The post New TASK#STOMP PowerShell Backdoor Targets Windows appeared first on Daily CyberSecurity.