Malware
Curated coverage and analysis in this editorial area.
Node.js Turns Trojan Horse: Signed Runtime Hides Targeted Malware
Symantec uncovers threat actors abusing node.exe — a legitimate, signed binary — to deliver malicious payloads against government and…
Guildma's Brazilian Geofencing: Malware That Only Shows Up for Real Targets
A SANS researcher documented Guildma (Astaroth), a Latin American banking trojan active since 2017, delivering its payload exclusively…
Check Point Unveils Pipeline That Reads JSCeal Without Executing It
Check Point Research has released an open-source toolkit for statically deobfuscating JSCeal payloads on V8 bytecode. The pipeline suc…
ValleyRAT Backdoor Hides in Signed Adware, Bypasses AV via DLL Sideloading
The Silver Fox group is distributing the ValleyRAT backdoor — also known as Winos 4.0 — packaged inside QN Wallpaper, a legitimate, di…
Android Malware Impersonates Indeed: Spyware and Anti-Uninstall via Accessibility
Malwarebytes analyzed fake Android apps impersonating Indeed for job interviews. The Trojan droppers install spyware, seize device con…
InstallFix Campaign Clones Claude Code to Spread Malware Without Exploits
Cybercriminals are using malvertising and cloned sites to distribute stealers and backdoors. The attack exploits no software vulnerabi…
First Car Head Unit Malware Discovered: Vehicles Recruited into Proxy Botnet
Kaspersky has identified the first malware with a dedicated infection chain for Android automotive head units. It exploits the privile…
DOUBLECUP: The Fake Steganography That Exposes Criminal Payloads to a Simple grep
The DOUBLECUP loader promises advanced steganography but hides PowerShell code in plaintext after the PNG file. Extractable with FINDS…
HollowGraph: APT Malware Turns M365 Calendars into Covert C2 Channel
HollowGraph exploits the Microsoft Graph API to transform compromised account calendars into bidirectional command-and-control channel…
SynkLoader: The 'Kitchen Sink' Malware Attacking via Microsoft Teams
Expel researchers have uncovered SynkLoader, a modular, multi-language malware family that uses Microsoft Teams phishing to breach cor…
Android Malware in Car Head Units: Vehicles Become Gig-Economy Nodes
Kaspersky discovered in June 2026 a new Android malware family that infects DoFun automotive head units through their built-in TWCore…
Lumma Stealer Hides in Pirated 'The Odyssey' Downloads: The Hidden Extension Trick
Cybercriminals are distributing Lumma Stealer via Windows executables disguised as pirated copies of The Odyssey (2026) on torrent tra…