4+ day, 16+ hour ago   (605+ words) The operation marks a significant evolution of ClickFix social engineering: rather than persuading users to execute PowerShell commands or install malware on an operating system, attackers manipulate them into running malicious code inside Chrome itself. The document claims to disclose…...

6+ day, 16+ hour ago   (613+ words) A trojanized Minecraft optimization mod posing as a companion to the legitimate Lithium project has been used to deploy Myth Stealer 3.2-FIX, a password-stealing malware family with remote-access, surveillance, persistence, and victim-harassment capabilities. The counterfeit manifest even references the genuine…...

1+ week, 5+ day ago   (571+ words) Threat actors are exploiting demand for generative AI tools to distribute RevStealer, a Windows-focused information stealer hidden inside a trojanized Electron application that impersonates a free desktop version of Anthropic’s Claude Opus 5. The primary lure, branded “Claude Opus 5 Free Desktop,…...

1+ week, 6+ day ago   (501+ words) A Magecart campaign dubbed HexMage has compromised more than 40 e-commerce storefronts across at least 15 countries, using Ethereum smart contracts as a resilient delivery mechanism for payment-card skimmers. Because the malicious code is injected into the store itself, every customer who…...

2+ week, 1+ day ago   (413+ words) A newly documented TerminalFix campaign is using fake Cloudflare CAPTCHA prompts to trick users into manually executing malicious PowerShell commands, ultimately turning compromised Windows devices into reverse-tunnel pivot points for attackers. Rather than exploiting a browser vulnerability, the campaign relies…...

2+ week, 5+ day ago   (548+ words) Victims can complete a legitimate Microsoft sign-in and MFA challenge, yet unknowingly authorize an attacker-controlled session. The PhaaS operation was advertised on Telegram from mid-February 2026 and was later documented by Sekoia researchers as a turnkey Microsoft device-code phishing kit. Its…...

3+ week, 2+ day ago   (394+ words) A Chinese-speaking cybercrime group, tracked as UAT-10147, targeting vulnerable Windows and Linux web servers worldwide to deploy BadIIS malware, steal data, and manipulate search engine results for financial gain. An operational security lapse exposed an attacker download server at 139.180.197[.]150, where…...

3+ week, 3+ day ago   (414+ words) MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network patterns to steal credentials, browser data, cloud access keys, SSH material, and sensitive user files. Initial execution commonly begins…...

3+ week, 3+ day ago   (549+ words) Threat actors are increasingly abusing the popularity of generative AI brands to distribute malware, turning trusted names such as Claude, ChatGPT and Microsoft Copilot into convincing lures for infostealers, browser hijackers and remote-access backdoors. Sophos X-Ops reviewed 12 months of Managed…...

3+ week, 4+ day ago   (474+ words) Researchers first identified the campaign in mid-May 2026. They discovered that the operation utilizes a broad range of criminal tools rather than relying on a single ransomware payload. The attackers use hacked WordPress sites as platforms for hosting malware, command-and-control (C2) infrastructure,…...