Malware
Curated coverage and analysis in this editorial area.
PamStealer Wavel: The C2 Becomes the Cryptographic Key, Static Analysis Hits a Wall
The Wavel variant of the macOS infostealer PamStealer introduces a server-side decryption chain using ECDH Curve25519. The final paylo…
Kothamine RAT Abuses Tailscale's tailcat for SOC-Invisible C2
The Kothamine RAT leverages tailcat, an open-source Tailscale tool, to establish encrypted C2 channels without accounts or traceable I…
MacSync Weaponizes iCloud Calendar: Public Calendars Become C2 Dead Drops
The MacSync malware exploits public iCloud calendars as dead drops to hide shell commands in the DESCRIPTION field. The technique bypa…
Fake SSN Site Delivers StreamRat and XWorm with Platform-Specific Payloads
CERT-AGID analyzed a campaign abusing the Italian National Health Service brand to distribute full-featured RATs on Android and Window…
LausivLoader Weaponizes Environment Variables to Break Staged Analysis
A LausivLoader sample spotted in late August 2025 inside a .r01 malspam attachment demonstrates how ordinary environment-variable inhe…
Malware in Terraform Providers: SHA256 Hash and Blockchain Used for Activation
North Korean threat actors published malicious Terraform providers in the HashiCorp Registry and Go modules on fake sites, extending t…
LausivLoader: The Malware That Defeats Fragmented Analysis
A multi-stage loader discovered in late August 2025 exploits environment-variable inheritance to pass data between JavaScript and Powe…
ClosedQuorum: The First Windows Malware That Lets an AI Panel Decide C2 Commands
Cisco Talos has documented ClosedQuorum, the first publicly reported Windows implant that delegates tactical command-and-control decis…
TASK#STOMP: The Windows Backdoor With Five Persistence Mechanisms
The TASK#STOMP malware steals documents and Wi-Fi passwords through two synchronized PowerShell modules. A September 21, 2026 Securoni…
TerminalFix Destroys PNG Images to Bury Malware Deeper
The TerminalFix campaign hides Windows executables inside the RGBA pixels of PNG files, using every available bit rather than just the…
Sonoma: The Mac Malware Turning iCloud CalDAV Into a Criminal CDN
The Crazy Evil gang is distributing Sonoma, a macOS infostealer that abuses iCloud CalDAV as a staging CDN and uses in-process PAM to…
RatHat: Android Malware Uses Generative AI to Automate Remote Device Control
Zimperium zLabs has uncovered RatHat, an Android malware documented on September 16, 2026, that integrates a generative AI-driven UI a…