malware

A developer reports that GitHub has failed to remove a malicious imitation of their software three weeks after it was flagged. The case has drawn attention to frustrations with the platform's handling of abuse reports, with commenters sharing similar experiences of slow or ineffective takedowns of impersonating and malware-distributing repositories.

The extortion group ShinyHunters claims it breached the FBI and obtained highly sensitive medical records of personnel, reportedly leaked as part of an attempted extortion scheme. Malwarebytes reports on the alleged theft of medical and other private data. The FBI has not been confirmed as commenting, and the scale and authenticity of the claimed leak remain unverified, but the targeting of a US law enforcement agency is drawing close attention in the cybersecurity community.

Screenshot service Gyazo suffered a data breach affecting 23.6 million users, with personal information exposed. The incident is reported alongside a separate malware operation called TASK#STOMP that steals documents from infected machines. Security observers are treating both as reminders of growing risks around stored user data and targeted document theft, as details of the breach's scope continue to circulate.

A new Android threat called RatHat has been reported by Mashable. The malware records screen touches, allowing attackers to capture passwords and other credentials as users type them. It adds to growing concern over Android security and mobile malware capable of harvesting login details directly from infected devices.

Reports indicate that access to artificial intelligence tools is becoming a commodity traded among cybercriminals, with stolen or resold credentials and subscription accounts allowing low-skill actors to use powerful AI services for fraud, malware and other schemes. The trend lowers the barrier to entry for online crime and raises new questions about how AI providers secure their platforms against misuse.

GitHub has re-enabled Actions, but security researchers warn that a smaller variant of the Shai-Hulud payload remains active, keeping supply-chain risk alive for developers who rely on automated workflows. The report, covered by BleepingComputer, suggests teams should stay cautious, audit their pipelines, and treat the malware threat as ongoing rather than resolved.

Phishing is in the spotlight as new reports detail a wave of scams and malware campaigns. Russian state hackers are said to be using a technique called RedFlick to spread malware, while Ukrainian authorities warn consumers about fake electricity bills. Researchers also flagged a remote access trojan distributed through fake Microsoft Store pages, and a report finds phishing exposure nearing 70% across key US industries.

Security researchers report that the Lunex Stealer malware abuses a legitimately signed AMD driver to disable security monitoring on infected Windows machines, allowing it to steal saved browser credentials undetected. The technique, known as bring-your-own-vulnerable-driver, exploits a vulnerable driver to gain elevated access and silence endpoint defenses before harvesting sensitive data.

Researchers describe CARBONATO as the first known botnet whose command-and-control engine is an AI agent, meaning the malware can reportedly make operational decisions itself rather than following fixed instructions from attackers. The botnet is said to have been active since October 2024. Security experts are highlighting the development as a sign that AI is moving into offensive cyber tools, raising concerns about more adaptive and harder-to-take-down botnets.

Reports from Italian media highlight that malware is growing by 2,065%, with artificial intelligence increasingly being used to power online attacks. The coverage points to a sharp escalation in cyber threats as AI tools make malicious software easier to develop and harder to detect, raising concerns among security experts and prompting debate about how businesses and institutions should respond to this new wave of AI-assisted cybercrime.

A fake TVTap app hosted on a site imitating the Google Play Store is distributing RemControl, a new Android banking trojan. Security outlet Punto Informatico reports the malware can target users' banking credentials once installed. The warning is circulating among Italian-speaking tech audiences, who are being urged to avoid third-party app stores and download apps only from official sources.

Security researchers are warning about PamStealer, a new infostealer targeting macOS that is distributed through counterfeit Wavel applications. Once installed, the malware harvests system passwords and browser data from infected machines, putting user credentials at risk. Mac users are being urged to download software only from official sources and to be cautious of fake app installers circulating online.

Security researchers have detailed PolinRider, a loader family that infected more than 30 GitHub repositories in a supply chain attack aimed at stealing environment secrets. The malware stands out for using the Ethereum blockchain as its command-and-control channel, making its infrastructure harder to take down. Cybersecurity commentators are sharing the analysis as a warning to developers to audit dependencies and protect stored secrets.

Cybersecurity firms report attackers are exploiting a previously unknown vulnerability in Citrix NetScaler, tracked as CVE-2026-88772, to deploy custom web shells and tunneling malware. The attackers reportedly gain root access, steal credentials, and move into victims' internal networks. Security teams are urged to check exposed NetScaler appliances for signs of compromise and apply patches as they become available.

Researchers report that a malware operation using an Aotera/Tedy loader has stolen roughly $100,000 in cryptocurrency. The loader injects a Vidar-class infostealer into Windows processes, then launches Chrome or Edge to run malicious scripts inside victims' browser sessions, capturing wallets and credentials. Security observers are warning Windows users to be cautious, as the malware builder is being circulated among underground actors.

Repositories promising a Polymarket copy-trading bot have become one of the most effective lures for malicious code on GitHub in 2026. Developers warn that these projects can be traps designed to steal private keys, and advise anyone considering a trading bot to inspect the code carefully before handing over wallet credentials.

A new explainer examines bulletproof hosting, the practice of internet providers knowingly renting server space to criminals and ignoring abuse complaints or takedown requests. The article outlines how these operators shield malware campaigns, phishing and other cybercrime, and looks at how investigators use open-source techniques to trace and identify the networks behind them.

Cybersecurity firm Group-IB has detailed BraZetsu, a sophisticated Python-based malware framework used by Brazilian threat actor Exilware. The framework reportedly supports initial access broker operations and is described as AI-powered, fueling a broader cybercrime ecosystem across Latin America. Security researchers are sharing the findings, flagging the growing use of automation and AI tooling by criminal groups in the region.

A malware strain called Underground is being linked to the theft of roughly $100,000 in cryptocurrency from more than 350 victims. The malware launches a victim's own signed-in Chrome or Edge browser, fakes a Binance two-factor authentication prompt to capture codes, and drains accounts. It also edits the withdrawal confirmation email inside the victim's webmail so nothing looks wrong, and uses a clipboard clipper to swap wallet addresses during transactions.

Microsoft says malicious actors are currently ahead of defenders in the race to use artificial intelligence, according to a new assessment. The company warns that attackers are quicker to exploit AI tools for phishing, malware and reconnaissance, while defensive adoption lags behind. Security teams are now being urged to accelerate AI deployment before the gap widens further.

Cybersecurity researchers report a scam website posing as a preorder page for an iPhone Duo, which is not a real Apple product. Visitors lured into entering payment or personal details are then targeted with DarkSword, a malicious software attack. The scheme appears designed to exploit hype around new iPhone launches to trick buyers into downloading malware.

Commenters are mocking the release of GLM-5.3, an AI model they say can generate cyber exploits faster than existing tools. Critics sarcastically congratulate the makers for crossing the line between innovation and chaos, arguing that even 'limited' access to such capabilities amounts to opening a Pandora's box for malware creation and offensive security work.

A critical vulnerability, CVE-2026-88772 with a CVSS score of 9.5, has been disclosed in Citrix NetScaler ADC and Gateway products. The DTLS memory overflow allows unauthenticated attackers to achieve shellcode execution. According to Mandiant and Google Threat Intelligence, it has been actively exploited since September to gain root access and deploy the WHIPSHOT and SLAPSHOT malware. Administrators are urged to patch immediately.