Malware

Editorial illustration of a game controller tipping coins from a crypto wallet beside handcuffs, marking the FBI arrest over a Steam-game malware campaign.

Policy & Government

FBI Arrests 21-Year-Old Zyaire Wilkins Over Steam-Game Malware Campaign Draining Crypto Wallets

A cryptocurrency-user targeting arrest via a novel Steam-games vector — law-enforcement coverage this weekend.

Editorial illustration of a mesh net trawling exposed AI service panels for key tags, marking the NadMesh Go botnet hunting cloud keys and Kubernetes tokens.

Threat Intelligence

Researchers Document “NadMesh” Go Botnet Hunting Exposed AI Services for Cloud Keys and Kubernetes Tokens

A botnet targeting self-hosted AI tooling for cloud keys — defender review for organizations exposing AI services this weekend.

Editorial illustration of seven npm package boxes wired to a blockchain-link control node, marking the ViteVenom campaign against Vite frontend tooling.

Supply Chain Attack

Checkmarx Documents “ViteVenom” Campaign Compromising Seven Vite npm Packages With Blockchain C2

Another JavaScript-ecosystem compromise with a novel blockchain-C2 angle — seven scoped npm packages impersonating the Vite tooling namespace, and defender inventory work this weekend.

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Nation-State Cyber Threats

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

Editorial illustration of a fake fix-it prompt piping browser tokens and documents into a stealer, marking Microsoft's ACR Stealer ClickFix analysis.

Threat Intelligence

Microsoft Defender Experts Documents ACR Stealer Delivered via ClickFix Lures Targeting Browsers and Microsoft 365

Another named stealer joins the ClickFix pattern — a defender posture review across Microsoft 365 environments after Microsoft's published analysis this week.

Editorial illustration of an SVG flag image concealing a hidden payload behind a coding-test window — North Korea Contagious Interview OtterCookie campaign.

Nation-State Cyber Threats

Researchers Document North Korea-Linked "Contagious Interview" Campaign Using SVG Steganography to Deliver OtterCookie-Aligned Malware

Another Contagious Interview variant with a novel SVG delivery angle — a defender-oriented research review of how North Korea-linked actors hid an OtterCookie-aligned payload inside flag images sent through fake coding challenges.

Editorial illustration of a Windows driver box wearing a graphics-card mask, marking the Rust-based LabubaRAT posing as NVIDIA software.

Malware

Researchers Document “LabubaRAT” Rust-Based Windows RAT Posing as NVIDIA Software

A Rust-based Windows remote-access tool with an NVIDIA-impersonation posture — defender research this week from Blackpoint Cyber, published with indicators of compromise for detection teams.

Editorial illustration of a dormant kernel gear reawakening beside a small hidden door, marking Daxin's resurfacing in Taiwan with the new Stupig backdoor.

Nation-State Cyber Threats

Symantec: Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New "Stupig" Backdoor

A dormant China-linked kernel rootkit surfaces again in Taiwan with a new backdoor companion — defender research review this week.

Editorial illustration of stacked app windows on a laptop collapsing toward a password box, marking the ClickLock macOS stealer that forces password entry.

Malware

Researchers Document “ClickLock” macOS Stealer That Reportedly Kills Apps Until Victim Enters Password

A novel macOS stealer technique with credential-and-crypto targeting — defender posture review for Mac-issuing organizations this week.

Editorial illustration of an npm package emitting nested loader boxes toward a node cluster, marking compromised @asyncapi packages delivering a botnet loader.

Supply Chain Attack

Compromised @asyncapi npm Packages Deliver Multi-Stage Botnet Loader

Another JavaScript-ecosystem supply-chain compromise, confirmed by four vendors: four @asyncapi npm packages were observed distributing a multi-stage botnet loader, and all five malicious versions have since been pulled from npm — defender inventory work this week.

Editorial illustration of many package boxes merging into a wave bending a server, representing 148 malicious npm packages building a browser DDoS botnet.

Supply Chain Attack

148 npm Packages Disguised as Student Proxies Reportedly Turned Browsers Into a DDoS Botnet

A large-scale JavaScript-ecosystem supply-chain compromise — defender inventory work this week.

Malware

“CrashStealer” macOS Malware Reportedly Uses a Notarized Dropper to Pass Gatekeeper

A macOS notarization-abuse malware disclosure — defender review for Mac-issuing organizations this week.

See all