malware

A developer reports that GitHub has failed to remove a malicious imitation of their software three weeks after it was flagged. The case has drawn attention to frustrations with the platform's handling of abuse reports, with commenters sharing similar experiences of slow or ineffective takedowns of impersonating and malware-distributing repositories.

A new Android threat called RatHat has been reported by Mashable. The malware records screen touches, allowing attackers to capture passwords and other credentials as users type them. It adds to growing concern over Android security and mobile malware capable of harvesting login details directly from infected devices.

Phishing is in the spotlight as new reports detail a wave of scams and malware campaigns. Russian state hackers are said to be using a technique called RedFlick to spread malware, while Ukrainian authorities warn consumers about fake electricity bills. Researchers also flagged a remote access trojan distributed through fake Microsoft Store pages, and a report finds phishing exposure nearing 70% across key US industries.

Reports from Italian media highlight that malware is growing by 2,065%, with artificial intelligence increasingly being used to power online attacks. The coverage points to a sharp escalation in cyber threats as AI tools make malicious software easier to develop and harder to detect, raising concerns among security experts and prompting debate about how businesses and institutions should respond to this new wave of AI-assisted cybercrime.

Security researchers have detailed PolinRider, a loader family that infected more than 30 GitHub repositories in a supply chain attack aimed at stealing environment secrets. The malware stands out for using the Ethereum blockchain as its command-and-control channel, making its infrastructure harder to take down. Cybersecurity commentators are sharing the analysis as a warning to developers to audit dependencies and protect stored secrets.

Researchers report that a malware operation using an Aotera/Tedy loader has stolen roughly $100,000 in cryptocurrency. The loader injects a Vidar-class infostealer into Windows processes, then launches Chrome or Edge to run malicious scripts inside victims' browser sessions, capturing wallets and credentials. Security observers are warning Windows users to be cautious, as the malware builder is being circulated among underground actors.

Cybersecurity firms report attackers are exploiting a previously unknown vulnerability in Citrix NetScaler, tracked as CVE-2026-88772, to deploy custom web shells and tunneling malware. The attackers reportedly gain root access, steal credentials, and move into victims' internal networks. Security teams are urged to check exposed NetScaler appliances for signs of compromise and apply patches as they become available.

Cybersecurity firm Group-IB has detailed BraZetsu, a sophisticated Python-based malware framework used by Brazilian threat actor Exilware. The framework reportedly supports initial access broker operations and is described as AI-powered, fueling a broader cybercrime ecosystem across Latin America. Security researchers are sharing the findings, flagging the growing use of automation and AI tooling by criminal groups in the region.

Repositories promising a Polymarket copy-trading bot have become one of the most effective lures for malicious code on GitHub in 2026. Developers warn that these projects can be traps designed to steal private keys, and advise anyone considering a trading bot to inspect the code carefully before handing over wallet credentials.

Microsoft says malicious actors are currently ahead of defenders in the race to use artificial intelligence, according to a new assessment. The company warns that attackers are quicker to exploit AI tools for phishing, malware and reconnaissance, while defensive adoption lags behind. Security teams are now being urged to accelerate AI deployment before the gap widens further.

A malware strain called Underground is being linked to the theft of roughly $100,000 in cryptocurrency from more than 350 victims. The malware launches a victim's own signed-in Chrome or Edge browser, fakes a Binance two-factor authentication prompt to capture codes, and drains accounts. It also edits the withdrawal confirmation email inside the victim's webmail so nothing looks wrong, and uses a clipboard clipper to swap wallet addresses during transactions.

A critical vulnerability, CVE-2026-88772 with a CVSS score of 9.5, has been disclosed in Citrix NetScaler ADC and Gateway products. The DTLS memory overflow allows unauthenticated attackers to achieve shellcode execution. According to Mandiant and Google Threat Intelligence, it has been actively exploited since September to gain root access and deploy the WHIPSHOT and SLAPSHOT malware. Administrators are urged to patch immediately.

Commenters are mocking the release of GLM-5.3, an AI model they say can generate cyber exploits faster than existing tools. Critics sarcastically congratulate the makers for crossing the line between innovation and chaos, arguing that even 'limited' access to such capabilities amounts to opening a Pandora's box for malware creation and offensive security work.

A new explainer examines bulletproof hosting, the practice of internet providers knowingly renting server space to criminals and ignoring abuse complaints or takedown requests. The article outlines how these operators shield malware campaigns, phishing and other cybercrime, and looks at how investigators use open-source techniques to trace and identify the networks behind them.

Security researchers report a malicious ChatGPT Custom GPT being used to push a remote access trojan through the ClickFix social engineering technique, which tricks users into running commands themselves. The finding highlights how attackers are abusing OpenAI's custom GPT ecosystem as a delivery vector, raising fresh concerns about moderation and vetting of third-party GPTs.

Cybersecurity researchers report a scam website posing as a preorder page for an iPhone Duo, which is not a real Apple product. Visitors lured into entering payment or personal details are then targeted with DarkSword, a malicious software attack. The scheme appears designed to exploit hype around new iPhone launches to trick buyers into downloading malware.