Malware

Malware

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT Malware via ClickFix

Attackers abuse ChatGPT Custom GPTs and sponsored Google results to redirect victims to ClickFix pages that execute PowerShell and install remote access trojan malware.

Zentrya One Desk 5d ago 3 min read

Malware

Star Blizzard Targets 100+ Organizations With Fake Event Invites and CosmicPulse Backdoor

Russia-linked Star Blizzard targets more than 100 organizations using fake event invitations, the new RedFlick malware delivery technique and the CosmicPulse Windows backdoor.

Zentrya One Desk 5d ago 3 min read

Malware

101 Malicious npm Packages Secretly Add Developers to WhatsApp Groups

Researchers uncover 101 malicious npm packages in the PhantomSub campaign that abuse authenticated WhatsApp sessions to secretly add developers to attacker-controlled groups and channels.

Zentrya One Desk 5d ago 3 min read

Malware

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Researchers uncover malicious Terraform providers and Go modules delivering Graphalgo-linked Go malware using Slack and Ethereum blockchain infrastructure for command and control.

Zentrya One Desk 26 Sept 2026 3 min read

Malware

CLOSEDQUORUM Malware Lets Four AI Models Vote on Its Next Move

Cisco Talos uncovers CLOSEDQUORUM, experimental Windows malware that lets DeepSeek, Qwen, Mistral and Gemini vote on whether to steal data, inject code or establish persistence.

Zentrya One Desk 26 Sept 2026 3 min read

Malware

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Compromised MemTensor packages on npm and PyPI deliver the cross-platform sckit credential stealer, targeting GitHub, AWS, SSH, npm, PyPI and developer secrets.

Zentrya One Desk 24 Sept 2026 3 min read

Malware

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

TASK#STOMP is a new PowerShell backdoor that steals business documents, Wi-Fi passwords and clipboard data while using scheduled tasks and dual C2 servers for persistent access.

Zentrya One Desk 22 Sept 2026 3 min read

Malware

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Researchers uncover ChainScript, a Node.js RAT delivered through ClickFix lures that uses a Polygon smart contract to dynamically locate and rotate its WebSocket C2 infrastructure.

Zentrya One Desk 22 Sept 2026 3 min read

Malware

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Steals Passwords

Researchers link Handala Hack to HEAVYGRAM, a Telegram-controlled Windows backdoor capable of stealing passwords, messages, screenshots and other sensitive data.

Zentrya One Desk 18 Sept 2026 3 min read

Malware

China-Aligned FamousSparrow Deploys New SparroWocky Backdoor Across Latin America

ESET researchers uncover SparroWocky, a new modular C++ backdoor used by China-aligned FamousSparrow in cyberespionage attacks targeting governments across Latin America.

Zentrya One Desk 18 Sept 2026 3 min read

CVE-2021-26855 and CVE-2026-42897 Malware

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware and Destructive Wipers

Kaspersky reports NightEagle, Hacking Cat and Toy Ghouls targeting Russian enterprises with VPN compromise, Exchange attacks, GhostContainer and Gorilla RAT backdoors, ransomware and destructive wipers.

Zentrya One Desk 18 Sept 2026 10 min read

Malware

Iran-Linked Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

Cybersecurity and intelligence agencies from the United Kingdom, United States and Netherlands have exposed an Iranian state-linked cyber-espionage campaign using sophisticated Windows malware to monitor dissidents, activists and journalists around the world.

Zentrya One Desk 16 Sept 2026 6 min read