Malware
Curated coverage and analysis in this editorial area.
Selected coverage
ROMULUS: The ClickFix Platform Delivering Malware Across Six Servers
All technical details come from a single Infosecurity Magazine article reporting on Vedere Labs research; the vendor's original blog p…
Midnight Mimosa: The Malware Living in Firmware Before You Even Power On
Bitdefender has uncovered Midnight Mimosa, a pre-installed firmware malware on budget Android phones with system-level privileges. Dev…
FakeGit Hits 17,610 GitHub Repos: Re-aiming Evades Takedowns
The FakeGit malware campaign reactivated on Oct. 4 with 17,610 malicious repositories. Its re-aiming mechanism renders traditional blo…
FakeGit Resurrects 17,610 Repositories: Reactive Cleanup on GitHub Is No Longer Enough
The FakeGit campaign returned on October 4, 2026 with 17,610 GitHub repositories. SmartLoader delivers StealC, leveraging legitimate a…
Midnight Mimosa: Malware Preinstalled on Thousands of Android Smartphones
The Midnight Mimosa campaign has infected the firmware of thousands of budget Android devices. The malware generates ad fraud and turn…
UAC-0099 Weaponizes Notepad++: How a Fake Plugin Becomes a Backdoor
The Russia-aligned UAC-0099 group deploys the MATCHBOIL.V2 loader by exploiting Notepad++'s plugin architecture. The LUNCHPOKE-BURNYBE…
PoeLLM: The Malware Hiding C2 Servers in a GitHub Poem
The PoeLLM botnet has compromised over 3,400 AI servers by exploiting CVE-2026-42271. Command-and-control addresses are concealed in a…
MALFEX: Over 40,000 Malicious npm Downloads, Three Packages Still Active as of October 2026
The MALFEX campaign has distributed over 40,000 downloads of malicious npm packages. function-flag remains installable with over 37,00…
BPFDoor and AVERAT: New Variants Target Telecom Network Edge
Rapid7 has documented new variants of the BPFDoor Linux backdoor and the AVERAT implant deployed against telecom network-edge operator…
SC Malware Turns Cleanup Into a Regeneration Trigger
SC malware attacks WordPress with eight interdependent persistence points. Removing the visible plugin activates the recovery mechanis…
NeedyMantis Exposes APT Post-Compromise Arsenal: Permanent Access via DLL Sideloading
Microsoft Threat Intelligence has disclosed NeedyMantis, a modular post-compromise malware framework active since at least October 202…
PamStealer: The macOS Malware That Only Decrypts Its Payload With a Live C2 Server
Jamf Threat Labs analyzed a new PamStealer variant that uses ECDH Curve25519 key exchange with its C2 server to decrypt the final payl…