Sonatype uncovers the PolinRider loader in 12 releases across 10 hijacked packages. See how the npm PolinRider loader uses Ethereum to fetch malware.

Related Posts:

• Trojanized Inno Setup Installers Deliver Proxyware and Compute Hijackers
• LuaJIT XLoader Infostealer Spreads via Fake Orders
• BITTER PapRAT Malware Targets South Asian Organizations

The post PolinRider Loader Hits 10 Hijacked npm Packages Using Ethereum Dead-Drop Resolver appeared first on Daily CyberSecurity.

Microsoft exposes a campaign using trojanized installers. See how Inno Setup trojanized installers silently deploy WorldProxyPool, BOINC, and adware.

Related Posts:

• PolinRider Loader Hits 10 Hijacked npm Packages Using Ethereum Dead-Drop Resolver
• LuaJIT XLoader Infostealer Spreads via Fake Orders
• BITTER PapRAT Malware Targets South Asian Organizations

The post Trojanized Inno Setup Installers Deliver Proxyware and Compute Hijackers appeared first on Daily CyberSecurity.

Morphisec exposes a LuaJIT XLoader infostealer campaign. Learn how the XLoader infostealer abuses JScript and shared-section injection.

Related Posts:

• BITTER PapRAT Malware Targets South Asian Organizations
• Apple Mercenary Spyware Threat Prompts Global Alerts
• Hugging Face Malware Campaign Infects AI GPU Servers

The post LuaJIT XLoader Infostealer Spreads via Fake Orders appeared first on Daily CyberSecurity.

Fortinet exposes the PapRAT malware campaign. See how the BITTER PapRAT malware uses three infection chains and Rust to spy on South Asian targets.

Related Posts:

• Apple Mercenary Spyware Threat Prompts Global Alerts
• Hugging Face Malware Campaign Infects AI GPU Servers
• PSK Agent RAT Hits Magento Stores Through StyleSmuggler Exploitation

The post BITTER PapRAT Malware Targets South Asian Organizations appeared first on Daily CyberSecurity.

Apple issued warnings across 99 nations as the Apple mercenary spyware threat targets investigative journalists with sophisticated surveillance tools.

Related Posts:

• BITTER PapRAT Malware Targets South Asian Organizations
• Hugging Face Malware Campaign Infects AI GPU Servers
• PSK Agent RAT Hits Magento Stores Through StyleSmuggler Exploitation

The post Apple Mercenary Spyware Threat Prompts Global Alerts appeared first on Daily CyberSecurity.

Pluto Research exposes Hugging Face malware. This Hugging Face malware campaign drops cryptominers and backdoors on self-hosted AI servers.

Related Posts:

• PSK Agent RAT Hits Magento Stores Through StyleSmuggler Exploitation
• Google Disrupts Videostrong XCPE Botnet on Android TV
• NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks

The post Hugging Face Malware Campaign Infects AI GPU Servers appeared first on Daily CyberSecurity.

StyleSmuggler exploitation of CVE-2026-75650 drops the PSK Agent RAT and a PHP webshell on Magento stores. See how to detect and respond.

Related Posts:

• Hugging Face Malware Campaign Infects AI GPU Servers
• Google Disrupts Videostrong XCPE Botnet on Android TV
• NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks

The post PSK Agent RAT Hits Magento Stores Through StyleSmuggler Exploitation appeared first on Daily CyberSecurity.

Cisco Talos uncovers the NIK C2 framework. This Windows NIK C2 framework abuses OpenAI APIs to analyze stolen victim data and deploy screen lockers.

Related Posts:

• Rust Doorway Botnet Exploits Routers, Cameras, and Servers
• Synology NAS Ransomware Targets Unpatched Devices
• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace

The post NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks appeared first on Daily CyberSecurity.

CloudSEK uncovers the Doorway botnet. The Rust Doorway botnet exploits routers, cameras, and servers to build a global proxy network.

Related Posts:

• NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks
• Synology NAS Ransomware Targets Unpatched Devices
• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace

The post Rust Doorway Botnet Exploits Routers, Cameras, and Servers appeared first on Daily CyberSecurity.

A widespread Synology NAS ransomware wave targets exposed devices via patched DSM vulnerabilities. Update firmware immediately to prevent encryption.

Related Posts:

• NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks
• Rust Doorway Botnet Exploits Routers, Cameras, and Servers
• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace

The post Synology NAS Ransomware Targets Unpatched Devices appeared first on Daily CyberSecurity.

Cursor removed a malicious Claude Code extension backdoor. Learn how the Cursor Claude Code extension backdoor planted SSH keys on up to 5,000 developer PCs.

Related Posts:

• INJ3CTOR3 FreePBX Malware Steals 17 Configuration Files for Off-Box Toll Fraud
• CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices
• Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026

The post Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace appeared first on Daily CyberSecurity.

Cyble reveals how INJ3CTOR3 FreePBX malware steals 17 config files every minute. The JOMANGY INJ3CTOR3 FreePBX malware enables off-box toll fraud.

Related Posts:

• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace
• CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices
• Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026

The post INJ3CTOR3 FreePBX Malware Steals 17 Configuration Files for Off-Box Toll Fraud appeared first on Daily CyberSecurity.

Group-IB exposes CyberDakait Android malware. The Indian CyberDakait Android malware campaign uses 7 trojans to infect 17,960 phones and steal 7.6M SMS.

Related Posts:

• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace
• INJ3CTOR3 FreePBX Malware Steals 17 Configuration Files for Off-Box Toll Fraud
• Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026

The post CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices appeared first on Daily CyberSecurity.

Acronis analyzes Qilin ransomware after 900+ attacks in 2026. See how ESXi Qilin ransomware scripts hijack VMware hosts and leak data on WikiLeaksV2.

Related Posts:

• Malicious Claude Code Extension Injects SSH Backdoor in Cursor Marketplace
• INJ3CTOR3 FreePBX Malware Steals 17 Configuration Files for Off-Box Toll Fraud
• CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices

The post Qilin Ransomware Targets VMware ESXi Servers and Healthcare Networks After Claiming 900 Victims in 2026 appeared first on Daily CyberSecurity.

Check Point reveals the Yoba malware campaign. This GitHub Yoba malware campaign uses signed OpenAI and Anthropic binaries to sideload YobaLoader.

Related Posts:

• Fake FedEx Tax Invoice PDFs Deliver Fileless Sirius Backdoor to Windows Systems
• Fake Phantom, Jupiter, and Bitget Firefox Extensions Steal Crypto Recovery Phrases
• Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack

The post Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries appeared first on Daily CyberSecurity.

Trellix uncovers the Sirius Backdoor in fake FedEx tax invoices. See how the fileless Sirius Backdoor blinds EDRs and survives Windows OS resets.

Related Posts:

• Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries
• Fake Phantom, Jupiter, and Bitget Firefox Extensions Steal Crypto Recovery Phrases
• Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack

The post Fake FedEx Tax Invoice PDFs Deliver Fileless Sirius Backdoor to Windows Systems appeared first on Daily CyberSecurity.

Socket uncovers malicious Firefox extensions spoofing Phantom, Jupiter, and Bitget. These malicious Firefox wallet extensions steal seed phrases.

Related Posts:

• Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries
• Fake FedEx Tax Invoice PDFs Deliver Fileless Sirius Backdoor to Windows Systems
• Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack

The post Fake Phantom, Jupiter, and Bitget Firefox Extensions Steal Crypto Recovery Phrases appeared first on Daily CyberSecurity.

Cisco Talos uncovered the KeyDrift malware UAT-11473 campaign exploiting CVE-2026-20127 to steal IPsec keys from Cisco SD-WAN controllers.

Related Posts:

• GMO Internet Ransom Demand Slashed After Cloud Breach
• Chained PHP2Shell Exploit Roots 25 Firewall Servers Including US Government Systems
• Hive Ransomware Affiliate Artem Stryzhak Sentenced to 70 Months in US Prison

The post UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127 appeared first on Daily CyberSecurity.

Sansec uncovers a Convertr supply chain attack. See how a Plausible Convertr supply chain attack planted a Magecart card and CPF skimmer on stores.

Related Posts:

• Attackers Abuse Claude Sharing Features and Google Ads to Deliver AMOS and Windows RAT
• SiriusQT RAT Combines Hidden Desktop Control With Credential and Wallet Theft
• Fake Chocolatey and Massgrave Sites Deliver Python Armorsteal Malware via SEO Poisoning

The post Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack appeared first on Daily CyberSecurity.

Gen Digital exposes a Claude malware campaign on claude.ai. This fake Download Claude malware campaign uses Google Ads and ClickFix to drop AMOS.

Related Posts:

• Brazilian Magecart Group Hits Convertr Ecommerce Platform in Plausible Analytics Supply Chain Attack
• SiriusQT RAT Combines Hidden Desktop Control With Credential and Wallet Theft
• Fake Chocolatey and Massgrave Sites Deliver Python Armorsteal Malware via SEO Poisoning

The post Attackers Abuse Claude Sharing Features and Google Ads to Deliver AMOS and Windows RAT appeared first on Daily CyberSecurity.