Malware

CVE-2021-26855 and CVE-2026-42897 Malware

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware and Destructive Wipers

Kaspersky reports NightEagle, Hacking Cat and Toy Ghouls targeting Russian enterprises with VPN compromise, Exchange attacks, GhostContainer and Gorilla RAT backdoors, ransomware and destructive wipers.

Zentrya One Desk 18 Sept 2026 10 min read

Malware

Iran-Linked Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

Cybersecurity and intelligence agencies from the United Kingdom, United States and Netherlands have exposed an Iranian state-linked cyber-espionage campaign using sophisticated Windows malware to monitor dissidents, activists and journalists around the world.

Zentrya One Desk 16 Sept 2026 6 min read

critical Malware

Russian State-Sponsored Hackers Used Claude to Rebuild Malware After Detection

A Russian state-linked cyber-espionage operation has used Anthropic's Claude AI to create an automated malware-evasion workflow capable of detecting when its malicious tools were identified by security products and then modifying and rebuilding those tools to bypass the detections.

Zentrya One Desk 12 Sept 2026 11 min read

critical Malware

Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis

A Russia-aligned threat actor has embedded an adversarial prompt inside malicious code to manipulate AI-powered malware analysis systems, attempting to trigger safety protections and prevent automated tools from examining the actual payload.

Zentrya One Desk 11 Sept 2026 8 min read

critical Malware

Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

Threat actors are exploiting vulnerabilities in Cisco Secure Firewall Management Center (FMC) to gain access to enterprise environments, steal credentials and ultimately deploy Qilin ransomware, turning vulnerable security infrastructure into an entry point for broader network compromise.

Zentrya One Desk 11 Sept 2026 8 min read

Malware

Gigabud Malware Creates Android Work Profiles to Evade Banking App Security Checks

The Android banking malware known as Gigabud is using a previously documented Android enterprise feature in an unusual way—creating work profiles to conceal malicious activity from security checks performed by banking applications.

Zentrya One Desk 10 Sept 2026 6 min read

Malware

Infostealer Logs Reveal Stolen AI Session Tokens Capable of Bypassing MFA

Cybercriminals are increasingly targeting artificial intelligence accounts by stealing browser session tokens and API credentials from infected devices. These stolen artifacts may allow attackers to access AI services without entering a username, password, or multi-factor authentication (MFA) code.

Zentrya One Desk 10 Sept 2026 8 min read

critical CVE-2025-53521 Malware

F5 BIG-IP APM Malware Hides Web Shell in Apache Memory to Evade Disk Scans

Security researchers have uncovered a sophisticated malware implant targeting F5 BIG-IP Access Policy Manager (APM) appliances that can conceal a PHP web shell entirely within Apache process memory, allowing attackers to maintain server-side code execution while leaving the targeted PHP files on disk unchanged.

Zentrya One Desk 09 Sept 2026 9 min read

high Malware

JSCeal Malware Steals Browser Sessions to Bypass Google Authentication and Target Crypto Users

A sophisticated malware strain known as JSCeal is using stolen browser session cookies to potentially bypass Google authentication and gain unauthorized access to accounts without requiring the victim’s password or a fresh authentication challenge.

Zentrya One Desk 08 Sept 2026 8 min read