Amatera Infostealer: Delivery, Capabilities, and MaaS Model
Amatera, a Windows infostealer, spreads via ClickFix and other vectors, offers subscription-based MaaS, and harvests credentials, cookies, crypto wallets.
malware
15 stories
Claude Code Extension Compromise Exposes VS Code Users to Persistent SSH Backdoor
The Anthropic Claude Code VS Code extension was tampered with to add a persistent SSH backdoor, affecting up to 5,000 users via the Cursor marketplace.
Yoba Crypto Miner Campaign Uses Signed AI Binaries to Deploy Malicious DLLs
Threat actors use signed OpenAI and Anthropic executables to sideload malicious DLLs and run crypto miners under the guise of AI desktop apps.
Mirai ASLR bypass Enables PHP2Shell Compromise
Mirai operators now use an ASLR bypass to compromise PHP2Shell installations, forcing immediate patching and hardening of affected web servers.
MythicRatatoskr Backdoor Uses Yggdrasil Mesh to Hide C&C, Enables Sandworm Data-Wipe
A Go-based backdoor deployed by UAC-0099 and later used by Sandworm hides its command server inside the Yggdrasil mesh, enabling a data-wipe on a Ukrainian.
MATCHBOIL: New Tricks, Same Old Evil Intentions
MATCHBOIL, a C# downloader used by UAC-0099, has evolved with enhanced obfuscation and sandbox detection. In December 2025, a manufacturing firm was infected.
GlassWorm VS Code Themes and Ransomware Affiliate Betrayal Highlight Weekly Threat Brief
Examine recent threat intelligence findings detailing GlassWorm VS Code theme extensions, ransomware affiliate betrayals, and open access infrastructure.
Venezuelan Cartel Malware Developer Arrested for ATM Jackpotting Operations
Law enforcement arrested a Venezuelan cartel malware developer linked to international ATM jackpotting operations, targeting physical banking infrastructure.
How SMB Cybersecurity Complexity Threatens Advanced Protection Goals
ESET research reveals that 58 percent of SMBs feel vulnerable amid state-backed cyber threats and AI-driven attacks, battling SMB cybersecurity complexity.
Russian Threat Actor UAC-0099 Refines MatchBoil Malware Against Ukrainian Targets
Russian cyber-espionage group UAC-0099 has upgraded its flagship MatchBoil malware dropper with stealthier techniques in recent campaigns targeting Ukrainian.
Threat Actors Abuse the Action1 RMM Tool via Phishing Campaigns
Security analysts discover threat actors abusing legitimate Action1 RMM tool installations delivered through deceptive phishing emails and VBS scripts.
North Korean Actors Deploy Malicious Terraform Providers to Distribute Go Malware via HashiCorp Registry
Researchers reveal DPRK-linked actors using HashiCorp's Terraform Registry to deliver Go-based malware with blockchain and Slack C2 channels.
SideCopy ReverseRAT: Targeting Indian Academic Institutions with Sophisticated Spear-Phishing Campaigns
SideCopy threat actor utilizes ReverseRAT malware in spear-phishing campaigns to target Indian academic institutions, expanding their strategic focus beyond.
ChainScript RAT Shows Why Relying on Indicator-Based Detection Is No Longer Viable
New ChainScript RAT uses Polygon smart contracts to rotate C2, exposing the limits of traditional indicator-based defenses.
npm supply chain attack RedC2 Deploys AI-Powered Linux Backdoor
Trend Micro researchers detail an npm supply chain attack RedC2 that drops an AI‑enabled Linux backdoor, exposing Node.js ecosystems to advanced command‑and‑con