Malware – Page 38 – ADMIN.FOUNDATION

Fake Cloudflare CAPTCHA Pages Deliver Infiniti Stealer Malware on macOS

A newly discovered macOS infostealer dubbed Infiniti Stealer is being actively distributed through deceptive Cloudflare-style CAPTCHA pages, marking a notable evolution in social engineering attacks targeting Apple users. Initially tracked as “NukeChai…

·

Cloudflare, cyber security, Cyber Security News, macOS, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
New Ghost Campaign Uses Fake npm Progress Bars to Phish Sudo Passwords

ReversingLabs researchers identify a new Ghost campaign using fake npm install logs and progress bars to phish for sudo passwords and steal crypto wallets from developers.

·

Cyber Attack, cybersecurity, Developers, Malware, npm, Phishing, Phishing Scam, SCAM, Security, Sudo

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
New ClickFix Attack Exploits Windows Run Dialog and macOS Terminal to Deploy Malware

Threat actors are standardizing a powerful ClickFix-based attack that abuses the Windows Run dialog box and macOS Terminal to deliver malware while sidestepping traditional browser protections. Insikt Group has tracked five distinct ClickFix activity c…

·

cyber security, Cyber Security News, Malware, Windows

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
New PXA Stealer Malware Targets Banks, Uses Telegram to Exfiltrate Data

CyberProof researchers have detected a 10% surge in PXA Stealer attacks targeting financial institutions in Q1 2026. Learn…

·

CyberProof, cybersecurity, Infostealer, Malware, PXA Stealer, Security

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
GhostClaw AI Malware Targets macOS Users with Credential-Stealing Payloads

GhostClaw is a multi-stage macOS infostealer that now abuses both GitHub and AI-assisted development workflows to harvest credentials and deploy secondary payloads, significantly widening its potential victim base. Jamf Threat Labs has since expanded o…

·

AI, cyber security, Cyber Security News, macOS, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Suspected Hijacked Developer Accounts Spread npm Malware

Sonatype uncovers a sophisticated malware campaign using hijacked npm developer accounts to steal API keys and passwords. Is your dev environment at risk?

·

Cyber Attack, cybersecurity, Developer, Malware, npm, Security, Sonatype

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Torg Grabber Malware Shifts from Telegram Exfiltration to Encrypted REST API for C2

A fast-evolving information‑stealing malware dubbed “Torg Grabber” that has shifted from simple Telegram‑based exfiltration to a hardened, encrypted REST API command‑and‑control (C2) channel fronted by Cloudflare. The operation surfaced when a 747 KB 6…

·

cyber security, Cyber Security News, Malware, Telegram

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Fake Screenshot Lures Target Web3 Support Staff with Multi-Stage Malware Attack

Fake screenshot links are being used to quietly deploy a multi‑stage backdoor against Web3 customer support teams, in a campaign assessed to be linked to the Chinese financially motivated group APT‑Q‑27 (GoldenEyeDog). The operation abuses live chat wo…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Kiss Loader Malware Targets with Early Bird APC Injection in New Attack Campaign

A newly identified malware loader dubbed “Kiss Loader” is emerging as a potential threat, leveraging advanced process injection techniques and dynamic delivery infrastructure. The loader, still under active development at the time of discovery, demonst…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Fake npm Install Messages Conceal RAT Malware in New Open Source Supply Chain Attack

Fake npm install messages are the latest social engineering trick in the open source supply chain, with attackers abusing npm post‑install scripts to silently deploy a crypto‑stealing remote access trojan (RAT) in what ReversingLabs is calling the “Gho…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

Category: Malware