Malware
Curated coverage and analysis in this editorial area.
PoeLLM: The Malware Hiding C2 Servers in a GitHub Poem
The PoeLLM botnet has compromised over 3,400 AI servers by exploiting CVE-2026-42271. Command-and-control addresses are concealed in a…
MALFEX: Over 40,000 Malicious npm Downloads, Three Packages Still Active as of October 2026
The MALFEX campaign has distributed over 40,000 downloads of malicious npm packages. function-flag remains installable with over 37,00…
BPFDoor and AVERAT: New Variants Target Telecom Network Edge
Rapid7 has documented new variants of the BPFDoor Linux backdoor and the AVERAT implant deployed against telecom network-edge operator…
SC Malware Turns Cleanup Into a Regeneration Trigger
SC malware attacks WordPress with eight interdependent persistence points. Removing the visible plugin activates the recovery mechanis…
NeedyMantis Exposes APT Post-Compromise Arsenal: Permanent Access via DLL Sideloading
Microsoft Threat Intelligence has disclosed NeedyMantis, a modular post-compromise malware framework active since at least October 202…
PamStealer: The macOS Malware That Only Decrypts Its Payload With a Live C2 Server
Jamf Threat Labs analyzed a new PamStealer variant that uses ECDH Curve25519 key exchange with its C2 server to decrypt the final payl…
PamStealer Wavel: The C2 Becomes the Cryptographic Key, Static Analysis Hits a Wall
The Wavel variant of the macOS infostealer PamStealer introduces a server-side decryption chain using ECDH Curve25519. The final paylo…
Kothamine RAT Abuses Tailscale's tailcat for SOC-Invisible C2
The Kothamine RAT leverages tailcat, an open-source Tailscale tool, to establish encrypted C2 channels without accounts or traceable I…
MacSync Weaponizes iCloud Calendar: Public Calendars Become C2 Dead Drops
The MacSync malware exploits public iCloud calendars as dead drops to hide shell commands in the DESCRIPTION field. The technique bypa…
Fake SSN Site Delivers StreamRat and XWorm with Platform-Specific Payloads
CERT-AGID analyzed a campaign abusing the Italian National Health Service brand to distribute full-featured RATs on Android and Window…
LausivLoader Weaponizes Environment Variables to Break Staged Analysis
A LausivLoader sample spotted in late August 2025 inside a .r01 malspam attachment demonstrates how ordinary environment-variable inhe…
Malware in Terraform Providers: SHA256 Hash and Blockchain Used for Activation
North Korean threat actors published malicious Terraform providers in the HashiCorp Registry and Go modules on fake sites, extending t…