Malware
Curated coverage and analysis in this editorial area.
LausivLoader Uses Inherited Environment Variables as Unusual Inter-Stage Channel
The LausivLoader malware exploits ordinary process environment inheritance to pass file paths between JavaScript and PowerShell stages…
SparroWocky: New APT Backdoor Targets Latin American Governments
ESET discovers SparroWocky, the modular backdoor from China-aligned FamousSparrow that replaced SparrowDoor in August 2025. Eight Lati…
KREMLIN Banking Malware Bypasses Chrome and Edge Using Ethereum Smart Contracts
The Brazilian KREMLIN toolkit installs malicious extensions on Chrome and Edge by subverting Chromium's Secure Preferences integrity c…
BambooToken: Malware Framework Uses MQTT for C2 on Windows and Linux
Black Lotus Labs has identified BambooToken, a malware framework active since 2023 that adopts the MQTT protocol for command and contr…
Hacking Cat: Pro-Ukraine Hacktivism Arms Itself with Custom Malware
Hacking Cat has evolved from defacement to custom destructive malware. Kaspersky reports Gorilla RAT and Monkey Ransomware, with possi…
MantaxOtax: The Android Ransomware That Controls, Spies On, and Torments Victims
Zimperium zLabs discovered MantaxOtax, a hybrid Android malware combining AES ransomware with full-spectrum spyware, remote device con…
Gigabud Moves Banking Theft Into Work Profile: The Malware That Fools Fraud Detection
The GoldFactory group has weaponized a fork of the open-source Shelter app, dubbed Vwork, to clone banking apps inside hidden Android…
The Malware Marketplace That Weaponizes Banality to Evade SOCs
The CL-CRI-1171 cluster has operated for two years as a pay-per-install marketplace. Its deliberately generic loader flies under SOC r…
PoisonedRefresh: The Memory-Only Web Shell That Evades Disk Forensics on F5 BIG-IP APM
PoisonedRefresh infects F5 BIG-IP APM servers by exploiting CVE-2025-53521 and hides its web shell exclusively in memory, leaving on-d…
JSCeal Steals Session Cookies to Bypass Google Authentication
The JSCeal malware compiles JavaScript into V8 bytecode to steal session cookies and circumvent Google authentication systems. Check P…
HAProxy Turned Trojan: North Korean APT Weaponizes the Load Balancer
Rapid7 Labs has uncovered a Linux toolkit that weaponizes HAProxy itself. A source-level backdoor, watchdog thread, and polymorphic st…
BraZetsu: The Brazilian Malware Turning Every PC into a Dark Web Product
The Exilware threat actor's BraZetsu framework automates the compromise of Windows hosts and their resale on an underground marketplac…