Malware

Malware

Over 100 Compromised Websites Spread LunexStealer Through Fake Cloudflare Verification Pages

More than 100 compromised websites are spreading LunexStealer through fake Cloudflare verification pages using ClickFix and EtherHiding techniques, according to CERT-UA.

Zentrya One Desk 08 Oct 2026 2 min read

Malware

New ClickFix Attack Hides Malware in Browser Cache to Bypass Windows Run Limits

A new ClickFix attack hides malicious VBScript payloads inside browser cache files disguised as PNG images, bypassing Windows Run character limits and deploying credential-stealing malware.

Zentrya One Desk 06 Oct 2026 3 min read

Malware

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT Malware via ClickFix

Attackers abuse ChatGPT Custom GPTs and sponsored Google results to redirect victims to ClickFix pages that execute PowerShell and install remote access trojan malware.

Zentrya One Desk 30 Sept 2026 3 min read

Malware

Star Blizzard Targets 100+ Organizations With Fake Event Invites and CosmicPulse Backdoor

Russia-linked Star Blizzard targets more than 100 organizations using fake event invitations, the new RedFlick malware delivery technique and the CosmicPulse Windows backdoor.

Zentrya One Desk 30 Sept 2026 3 min read

Malware

101 Malicious npm Packages Secretly Add Developers to WhatsApp Groups

Researchers uncover 101 malicious npm packages in the PhantomSub campaign that abuse authenticated WhatsApp sessions to secretly add developers to attacker-controlled groups and channels.

Zentrya One Desk 30 Sept 2026 3 min read

Malware

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Researchers uncover malicious Terraform providers and Go modules delivering Graphalgo-linked Go malware using Slack and Ethereum blockchain infrastructure for command and control.

Zentrya One Desk 26 Sept 2026 3 min read

Malware

CLOSEDQUORUM Malware Lets Four AI Models Vote on Its Next Move

Cisco Talos uncovers CLOSEDQUORUM, experimental Windows malware that lets DeepSeek, Qwen, Mistral and Gemini vote on whether to steal data, inject code or establish persistence.

Zentrya One Desk 26 Sept 2026 3 min read

Malware

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Compromised MemTensor packages on npm and PyPI deliver the cross-platform sckit credential stealer, targeting GitHub, AWS, SSH, npm, PyPI and developer secrets.

Zentrya One Desk 24 Sept 2026 3 min read

Malware

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

TASK#STOMP is a new PowerShell backdoor that steals business documents, Wi-Fi passwords and clipboard data while using scheduled tasks and dual C2 servers for persistent access.

Zentrya One Desk 22 Sept 2026 3 min read

Malware

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Researchers uncover ChainScript, a Node.js RAT delivered through ClickFix lures that uses a Polygon smart contract to dynamically locate and rotate its WebSocket C2 infrastructure.

Zentrya One Desk 22 Sept 2026 3 min read

Malware

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Steals Passwords

Researchers link Handala Hack to HEAVYGRAM, a Telegram-controlled Windows backdoor capable of stealing passwords, messages, screenshots and other sensitive data.

Zentrya One Desk 18 Sept 2026 3 min read

Malware

China-Aligned FamousSparrow Deploys New SparroWocky Backdoor Across Latin America

ESET researchers uncover SparroWocky, a new modular C++ backdoor used by China-aligned FamousSparrow in cyberespionage attacks targeting governments across Latin America.

Zentrya One Desk 18 Sept 2026 3 min read