-
Malicious Claude Code extensions targeted Windows and macOS developers through Cursor collecting device details and planting files for persistent remote access.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes.
·
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
CloudSyncD macOS backdoor uses a fake Zoom installer to steal Mac passwords, bypass Gatekeeper and connect infected devices to remote C2 servers.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
TASK#STOMP Windows backdoor uses PowerShell, scheduled tasks and runtime C# compilation to steal business documents and maintain remote access.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
FamousSparrow is targeting Latin American governments with SparroWocky, a new C++ backdoor that exfiltrates files, takes screenshots and evades security tools.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Kaspersky links OctLurk and SilkLurk to cyberespionage attacks stealing passwords, emails and files from government systems in six countries since January 2025.
·
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A backdoored ARVE WordPress Plugin release could grant attackers administrator access with one token, but WordPress.org blocked automatic distribution to WordPress sites.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Dr.Web details Siggen Windows backdoor that uses Steam for C2, steals credentials and crypto data and infects Visual Studio projects to spread among developers.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft details GigaWiper, a destructive Windows backdoor that can wipe disks, encrypt files and give attackers remote access to compromised systems globally.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶


