BestHub
Sign in
Tagged articles

Malware

91 articles · Page 1 of 1
Top Architecture Tech Stack
Top Architecture Tech Stack
Aug 31, 2026 · Information Security

Massive Claude Account Hijacking – Why Session Cookies Are the Real Threat

A wave of forced logouts on Claude revealed that attackers steal browser session cookies and payment data, turning AI credit limits into a lucrative commodity, and the article walks through the malware families involved, the limitations of password changes, and a detailed remediation checklist for developers.

AI account securityAPI keyBest Practices
0 likes · 15 min read
Massive Claude Account Hijacking – Why Session Cookies Are the Real Threat
Black & White Path
Black & White Path
Aug 17, 2026 · Information Security

AmnesiaStealer Exposed: How macOS Users Become Browser Botnets with Remote Session Hijacking

Jamf Threat Labs uncovers AmnesiaStealer, a macOS malware that disguises a fake GitHub download, installs a Rust‑based payload, and uses a hidden stream_module to clone users’ Chromium profiles and remotely control browsers via Chrome DevTools Protocol, effectively turning victims into live browser botnets.

AmnesiaStealerChrome DevTools ProtocolMalware
0 likes · 10 min read
AmnesiaStealer Exposed: How macOS Users Become Browser Botnets with Remote Session Hijacking
Black & White Path
Black & White Path
Jul 31, 2026 · Information Security

AI Worm in Microsoft Copilot for Word: Document‑Based Propagation Attack

Security researchers reveal that Microsoft Copilot for Word can be turned into a self‑replicating AI worm: hidden commands in a seemingly harmless document alter financial figures and copy themselves to new files, evading detection and persisting even after the original payload is deleted.

AI wormLLM trust boundaryMalware
0 likes · 9 min read
AI Worm in Microsoft Copilot for Word: Document‑Based Propagation Attack
KooFE Frontend Team
KooFE Frontend Team
Jul 11, 2026 · Information Security

Why Google Removed ModHeader: Inside the Spyware Supply‑Chain Attack

Google removed the popular ModHeader Chrome extension after security researchers reverse‑engineered version 7.0.18 and uncovered a hidden spyware SDK that harvests visited domains, encrypts them, and exfiltrates the data to a fake Stanford‑studies endpoint, with a dormant kill‑switch ready for activation via an update.

Chrome extensionMalwareModHeader
0 likes · 5 min read
Why Google Removed ModHeader: Inside the Spyware Supply‑Chain Attack
Black & White Path
Black & White Path
Jun 19, 2026 · Information Security

No‑Code AI‑Powered Telegram Attack Lets Anyone Control a Remote Bot

A new threat discovered by Palo Alto Networks' Unit42 shows how attackers can use Telegram as a command‑and‑control channel and an LLM to translate natural‑language requests into shell commands, enabling even non‑technical users to remotely control compromised machines while evading traditional detection.

AIMalwareNo-code attack
0 likes · 9 min read
No‑Code AI‑Powered Telegram Attack Lets Anyone Control a Remote Bot
Black & White Path
Black & White Path
May 11, 2026 · Information Security

How OceanLotus weaponized PyPI to deliver ZiChatBot malware using Zulip as C2

OceanLotus (APT32) hijacked three innocuous PyPI packages—uuid32-utils, colorinal, and termncolor—to drop the ZiChatBot malware, which persists via registry or crontab and communicates through the Zulip public chat REST API, making its traffic indistinguishable from legitimate developer traffic and evading network‑based detection.

MalwareOceanLotusPyPI
0 likes · 11 min read
How OceanLotus weaponized PyPI to deliver ZiChatBot malware using Zulip as C2
Black & White Path
Black & White Path
May 9, 2026 · Information Security

Kaspersky Exposes DAEMON Tools Supply Chain Attack Infecting Over 100,000 Users

In May 2026, Kaspersky revealed that the official Windows installer for DAEMON Tools Lite versions 12.5.0.2421‑12.5.0.2434 had been compromised for nearly a month, allowing attackers to inject signed back‑door binaries, establish C2 communication, deliver staged payloads—including a QUIC RAT—to thousands of victims across more than a hundred countries, with high‑value targets primarily in Russia, Belarus and Thailand, before a patched version 12.6.0.2445 was released.

C2DAEMON ToolsKaspersky
0 likes · 7 min read
Kaspersky Exposes DAEMON Tools Supply Chain Attack Infecting Over 100,000 Users
Linux Tech Enthusiast
Linux Tech Enthusiast
May 9, 2026 · Information Security

Xubuntu Download Page Hijacked with Crypto‑Stealing Malware

A security researcher discovered that the official Xubuntu download page was compromised, delivering a ZIP containing a tos.txt file with a bogus 2026 copyright and a malicious Windows executable that functions as a crypto‑clipper, prompting Xubuntu to temporarily disable the download site while investigating the breach.

Crypto ClipperLinuxMalware
0 likes · 3 min read
Xubuntu Download Page Hijacked with Crypto‑Stealing Malware
Black & White Path
Black & White Path
Apr 26, 2026 · Information Security

How a PowerShell Pastebin Steganography Trojan Hijacks Telegram Sessions

The article dissects a recent attack where a PowerShell script hidden in a Pastebin post uses character‑level steganography to retrieve a C2 address, extracts Telegram Desktop's tdata files, compresses them, and exfiltrates the data via a hard‑coded Telegram Bot API, while employing hidden execution, fileless memory loading, environment detection, and self‑destruct on virtual machines.

FilelessMalwarePastebin
0 likes · 4 min read
How a PowerShell Pastebin Steganography Trojan Hijacks Telegram Sessions
21CTO
21CTO
Mar 25, 2026 · Information Security

How a Supply‑Chain Attack Compromised LiteLLM and Stole Every Credential

A supply‑chain breach of the popular LiteLLM Python library injected malicious .pth files that silently harvest SSH keys, cloud credentials, and other secrets, deploy persistent backdoors, and spread through downstream packages, prompting urgent detection and remediation steps for developers.

DevOps SecurityLiteLLMMalware
0 likes · 8 min read
How a Supply‑Chain Attack Compromised LiteLLM and Stole Every Credential
Black & White Path
Black & White Path
Mar 21, 2026 · Information Security

GhostClaw/GhostLoader Malware Deep Dive: GitHub Repo and AI Workflow Attacks on macOS

The report details how the GhostClaw/GhostLoader campaign leverages trusted GitHub repositories and AI‑assisted development workflows to deliver a multi‑stage macOS payload that steals credentials, contacts a single C2 domain, and establishes persistence, while providing blue‑team detection and mitigation guidance.

AI workflowGitHubMalware
0 likes · 18 min read
GhostClaw/GhostLoader Malware Deep Dive: GitHub Repo and AI Workflow Attacks on macOS
Black & White Path
Black & White Path
Mar 13, 2026 · Information Security

Beware: Generative AI as a New Cybercrime Ally—13 Enterprise Attack Vectors

The article analyzes how generative AI is transforming cybercrime by enabling 13 distinct attack methods—from highly personalized phishing emails and AI‑assisted malware creation to automated vulnerability hunting, deep‑fake social engineering, malicious LLMs, and attacks on AI infrastructure—highlighting recent research data and real‑world examples that illustrate the heightened speed, stealth, and accessibility of modern threats.

AI infrastructureLLM securityMalware
0 likes · 13 min read
Beware: Generative AI as a New Cybercrime Ally—13 Enterprise Attack Vectors
Linux Tech Enthusiast
Linux Tech Enthusiast
Mar 8, 2026 · Information Security

Which Linux Antivirus Tools Should You Know? A Detailed Overview

Although Linux is widely regarded as secure, the article explains why antivirus software is still valuable for Linux servers and desktops, and provides a concise review of ten popular Linux antivirus solutions, highlighting their features, licensing, and typical use cases.

AntivirusLinuxMalware
0 likes · 6 min read
Which Linux Antivirus Tools Should You Know? A Detailed Overview
Black & White Path
Black & White Path
Mar 6, 2026 · Industry Insights

Beware Invoice Phishing and Israel’s Cyber Attack on Iran: A Deep Dive into Modern Threats

The article warns of sophisticated invoice‑phishing emails that can implant malware and outlines three practical defenses, then shifts to a detailed analysis of Israel’s cyber strike on Iran’s missile command, explaining the attack’s technical layers, hybrid war model, strategic implications, and future risks.

Malwarecyber warfarehybrid warfare
0 likes · 11 min read
Beware Invoice Phishing and Israel’s Cyber Attack on Iran: A Deep Dive into Modern Threats
Black & White Path
Black & White Path
Mar 6, 2026 · Information Security

How Bing AI’s Recommendations Fueled a Fake OpenClaw Repo Malware Surge

Researchers discovered that threat actors exploit Bing AI’s enhanced search to promote a counterfeit OpenClaw GitHub repository, delivering the Atomic Stealer info‑stealer to macOS users and proxy malware to Windows users, highlighting new security risks in AI‑driven search ecosystems.

AI search abuseBing AIEndpoint Protection
0 likes · 8 min read
How Bing AI’s Recommendations Fueled a Fake OpenClaw Repo Malware Surge
Black & White Path
Black & White Path
Feb 26, 2026 · Information Security

13 Ways Attackers Leverage Generative AI to Exploit Systems

The article outlines thirteen distinct techniques by which cybercriminals exploit generative AI—from hyper‑personalized phishing and AI‑driven malware creation to AI‑coordinated espionage, deep‑fake social engineering, and attacks on AI infrastructure—backed by expert quotes, research findings, and concrete case studies.

AI AgentsAI infrastructureMalware
0 likes · 14 min read
13 Ways Attackers Leverage Generative AI to Exploit Systems
IT Services Circle
IT Services Circle
Feb 24, 2026 · Information Security

Beware Fake 7‑Zip Installers: How a Trojan Turns Your PC into a Residential Proxy Bot

A malicious fake 7‑Zip installer masquerades as the legitimate open‑source archiver, silently deploying a Trojan that creates a residential‑proxy botnet, modifies system services and firewall rules, and can expose users to legal and privacy risks, while Windows Defender now flags it as Trojan:Win32/Malgent!MSR.

7zipMalwareinformation-security
0 likes · 6 min read
Beware Fake 7‑Zip Installers: How a Trojan Turns Your PC into a Residential Proxy Bot
Black & White Path
Black & White Path
Feb 21, 2026 · Information Security

When Search Engines Turn Into Poison: SEO‑Based Malware Targeting Chinese Users

FortiGuard Labs reveals a sophisticated SEO poisoning campaign that lures Chinese Windows users to fake software sites, delivers hidden Hiddengh0st and Winos malware, employs anti‑analysis tricks, establishes persistence, and exfiltrates data, while the article breaks down the full attack chain and offers practical defense steps.

MalwarePersistenceSEO poisoning
0 likes · 7 min read
When Search Engines Turn Into Poison: SEO‑Based Malware Targeting Chinese Users
IT Services Circle
IT Services Circle
Jan 22, 2026 · Information Security

How Malicious Browser Extensions Turned 8.8M Users into Data Spies

A recent security investigation reveals that over 300 seemingly harmless browser extensions were covertly hijacked by the DarkSpectre campaign, silently collecting browsing history, meeting data, and other personal information from more than 8.8 million users across Chrome, Edge, and Firefox for up to seven years.

MalwareSupply Chainbrowser extensions
0 likes · 9 min read
How Malicious Browser Extensions Turned 8.8M Users into Data Spies
Java Tech Enthusiast
Java Tech Enthusiast
Sep 26, 2025 · Information Security

How a Fired Engineer Crippled Eaton's Global Systems with Malicious Java Code

A senior Java developer at Eaton Corporation sabotaged the company's global production system with malicious code before his dismissal, causing a massive outage, data loss, and a four‑year prison sentence, highlighting the severe risk of insider threats and the need for robust access controls and monitoring.

Access ControlJavaMalware
0 likes · 7 min read
How a Fired Engineer Crippled Eaton's Global Systems with Malicious Java Code
Liangxu Linux
Liangxu Linux
Jun 3, 2025 · Information Security

How to Detect and Remove Linux Mining Malware: A Step‑by‑Step Guide

This guide explains how to identify hidden cryptocurrency‑mining processes on a Linux server, stop them, disable the services that restart them, block malicious IPs, clean unauthorized SSH keys, and harden the system with tools such as sysdig, Safedog, and ClamAV.

ClamAVMalwareSecurity
0 likes · 9 min read
How to Detect and Remove Linux Mining Malware: A Step‑by‑Step Guide
21CTO
21CTO
Apr 3, 2025 · Information Security

Why 56% of Open‑Source Packages Trigger Data Leaks – Sonatype’s Q1 2025 Malware Index

Sonatype’s Q1 2025 Open‑Source Malware Index identified 17,954 malicious packages—including hijacked npm crypto modules, a fake Truffle for VS Code extension, and counterfeit Solana packages—revealing that 56% of these components are associated with data breaches, a sharp rise from the 26% reported in Q4 2024, and highlighting the growing prevalence of complex, threat‑laden malware such as droppers and code‑injection threats.

MalwareOpen Source Securitydata breach
0 likes · 2 min read
Why 56% of Open‑Source Packages Trigger Data Leaks – Sonatype’s Q1 2025 Malware Index
21CTO
21CTO
Mar 10, 2025 · Information Security

Malicious Ads Hijack GitHub and Phone‑Cleaning Apps Leak Your Data

Microsoft uncovered a malicious ad campaign that used pirated streaming sites and multi‑layer redirects to deliver GitHub‑hosted malware, while a separate Surfshark report revealed popular phone‑cleaning apps secretly sharing extensive user data with hundreds of third‑party partners.

Ad FraudGitHubMalware
0 likes · 4 min read
Malicious Ads Hijack GitHub and Phone‑Cleaning Apps Leak Your Data
Raymond Ops
Raymond Ops
Dec 29, 2024 · Information Security

What Every Hacker Calls It: A Comprehensive Glossary of Cyber Threats

This article provides a detailed glossary of common hacking terms and techniques—from black‑hat attackers and backdoors to APTs, exploits, and dark‑web concepts—explaining each threat, its purpose, and how it impacts information security.

MalwareThreatsapt
0 likes · 17 min read
What Every Hacker Calls It: A Comprehensive Glossary of Cyber Threats
Open Source Linux
Open Source Linux
Nov 26, 2024 · Information Security

New “Silver Fox” Trojan Targets Chinese Users – How It Spreads and How to Defend

A recent advisory from China’s National Computer Virus Emergency Response Center reveals a new “Silver Fox” Trojan variant distributed via phishing pages and social‑media links, explains its infection process on Windows PCs, and outlines practical prevention steps for enterprises and individual users.

MalwareSilver Fox Trojancyber threat
0 likes · 5 min read
New “Silver Fox” Trojan Targets Chinese Users – How It Spreads and How to Defend
MaGe Linux Operations
MaGe Linux Operations
Nov 26, 2024 · Information Security

New “Silver Fox” Trojan Variant Targets Chinese Users – Spread, Impact, and Prevention

The National Computer Virus Emergency Response Center reports a new “Silver Fox” Trojan variant distributed via phishing links in WeChat groups, disguised as tax‑related installers, which can hijack systems for remote control and fraud, and provides concrete steps for users and enterprises to defend against it.

MalwareViruscybersecurity
0 likes · 6 min read
New “Silver Fox” Trojan Variant Targets Chinese Users – Spread, Impact, and Prevention
Efficient Ops
Efficient Ops
Nov 25, 2024 · Information Security

Uncovering the gpg-agentd Malware: How an Alibaba Cloud Server Was Compromised

This article walks through a real-world intrusion on an Alibaba Cloud CentOS server, detailing how a disguised gpg-agentd process was used to install backdoors, hijack SSH keys, exploit Redis, and launch mass scanning, and provides concrete hardening recommendations to prevent similar attacks.

Linux incident responseMalwareSSH Hardening
0 likes · 13 min read
Uncovering the gpg-agentd Malware: How an Alibaba Cloud Server Was Compromised
21CTO
21CTO
Sep 5, 2024 · Information Security

Can Deleted PyPI Packages Be Hijacked? What It Means for Your CI/CD Security

JFrog’s security team reveals that attackers can hijack deleted PyPI packages by re‑registering the same name, tricking tools like Jenkins into installing malicious code, and outlines the scale of the risk, real‑world examples, and new defenses introduced by PyPI.

CI/CDMalwarePyPI security
0 likes · 6 min read
Can Deleted PyPI Packages Be Hijacked? What It Means for Your CI/CD Security
IT Services Circle
IT Services Circle
Jun 4, 2024 · Information Security

Malware Campaign Using Fake MS Office Crack Tool Spreads RAT, XMRig Miner, and 3Proxy Proxy

A recent ASEC report reveals that a malicious program disguised as the popular Office 2013‑2024 C2R Install crack tool distributes a .NET‑based malware suite that installs Orcus RAT, the XMRig cryptocurrency miner, and the 3Proxy proxy tool, primarily targeting Korean users and persisting via scheduled tasks and PowerShell updates.

3ProxyKorean usersMalware
0 likes · 5 min read
Malware Campaign Using Fake MS Office Crack Tool Spreads RAT, XMRig Miner, and 3Proxy Proxy
MaGe Linux Operations
MaGe Linux Operations
Mar 24, 2024 · Information Security

What Every Hacker Should Know: 27 Common Terms and Attack Techniques

This article provides a comprehensive glossary of 27 common hacking terms—from black‑hat and backdoor to zero‑day exploits and dark‑web concepts—explaining each technique, malware type, and security threat in clear, concise English for anyone interested in cybersecurity fundamentals.

Malwareaptcybersecurity
0 likes · 18 min read
What Every Hacker Should Know: 27 Common Terms and Attack Techniques
IT Services Circle
IT Services Circle
Dec 4, 2023 · Information Security

Supply‑Chain Vulnerabilities in the JavaScript/npm Ecosystem: Notable Cases and Lessons

This article surveys a series of high‑profile supply‑chain attacks on the JavaScript/npm ecosystem—such as left‑pad removal, malicious faker.js updates, cross‑env hijacking, is‑promise bugs, getcookies backdoors, event‑stream social‑engineering, ESLint credential leaks, manifest obfuscation, and politically‑motivated code injections—highlighting how tiny, widely‑used packages can become vectors for large‑scale compromise and what developers can do to mitigate the risk.

MalwareSecuritySupply Chain
0 likes · 17 min read
Supply‑Chain Vulnerabilities in the JavaScript/npm Ecosystem: Notable Cases and Lessons
Liangxu Linux
Liangxu Linux
Jun 20, 2023 · Information Security

How AI Hallucinations Fuel Fake NPM Package Attacks and What You Can Do

The article explains how ChatGPT's hallucinations can generate non‑existent package links that attackers register and weaponize, demonstrates the attack with a fake Node.js npm package, and offers practical steps to detect and prevent such supply‑chain threats.

AI securityChatGPT hallucinationMalware
0 likes · 5 min read
How AI Hallucinations Fuel Fake NPM Package Attacks and What You Can Do
Open Source Linux
Open Source Linux
May 22, 2023 · Information Security

Top 10 Linux Antivirus Solutions to Secure Your Servers

This article reviews the ten most effective Linux antivirus tools, explains why protection is essential despite Linux's inherent security, and provides concise descriptions of each solution—including Avast, Chkrootkit, ESET NOD32, F‑PROT, Panda Cloud Cleaner, Rootkit Hunter, ClamAV, Firetools, Comodo, and Sophos—to help users choose the right protection for their systems.

AntivirusLinuxMalware
0 likes · 7 min read
Top 10 Linux Antivirus Solutions to Secure Your Servers
IT Services Circle
IT Services Circle
Feb 24, 2023 · Information Security

The Dark Side of ChatGPT: Scams, Prompt Injection, and Security Risks

The article examines how the rapid popularity of ChatGPT has spurred both legitimate opportunities and a surge in illicit activities, including account resale, scam scripts generated via prompt injection, and the creation of malware, highlighting the need for stricter regulation and security awareness.

AI misuseAI securityChatGPT
0 likes · 6 min read
The Dark Side of ChatGPT: Scams, Prompt Injection, and Security Risks
Programmer DD
Programmer DD
Dec 21, 2022 · Information Security

Hidden Threats in Docker Hub: 1,652 Malicious Images Uncovered by Sysdig

Sysdig’s analysis of over 250,000 public Linux images on Docker Hub revealed 1,652 images containing hidden malware, including mining tools, embedded credentials, proxy‑avoidance scripts, and malicious websites, highlighting the urgent need for robust image‑scanning and credential‑management practices.

Credential ManagementDockerMalware
0 likes · 4 min read
Hidden Threats in Docker Hub: 1,652 Malicious Images Uncovered by Sysdig
21CTO
21CTO
Dec 3, 2022 · Information Security

How Redigo Malware Exploits Redis CVE-2022-0543 to Plant Stealthy Backdoors

Redigo, a Go‑based malware discovered by AquaSec, continuously scans for unpatched Redis servers vulnerable to CVE‑2022‑0543, uses Redis commands to load a malicious module that creates a hidden backdoor for arbitrary command execution, gathers system data, and may enlist the host in DDoS or crypto‑mining botnets.

CVE-2022-0543Malwarebackdoor
0 likes · 4 min read
How Redigo Malware Exploits Redis CVE-2022-0543 to Plant Stealthy Backdoors
MaGe Linux Operations
MaGe Linux Operations
Oct 28, 2022 · Information Security

Hidden Malware in Fake GitHub PoCs: Researchers Find 4,893 Malicious Repos

Researchers from the Leiden Institute of Advanced Computer Science analyzed over 47,000 GitHub repositories, uncovering that many fake proof‑of‑concept exploits conceal malware, with nearly 5,000 repositories deemed malicious and detailed case studies revealing hidden trojans, Cobalt Strike tools, and stealthy information stealers.

GitHubMalwareproof of concept
0 likes · 6 min read
Hidden Malware in Fake GitHub PoCs: Researchers Find 4,893 Malicious Repos
php Courses
php Courses
Oct 18, 2022 · Information Security

In-Memory PHP Trojan: Source Code, Explanation, and Mitigation

This article explains the concept of in‑memory PHP trojans, provides simple obfuscated source code that deletes itself and persists in RAM, discusses their stealth characteristics, and offers a basic mitigation strategy of terminating the process and removing the generated files.

MalwareMemory TrojanPHP
0 likes · 3 min read
In-Memory PHP Trojan: Source Code, Explanation, and Mitigation
Laravel Tech Community
Laravel Tech Community
Sep 20, 2022 · Information Security

NSA TAO Cyber Attack on Northwestern Polytechnical University: Investigation and Technical Analysis

An in‑depth investigation by China’s national computer emergency response center and 360 Company uncovered a sophisticated cyber‑attack on Northwestern Polytechnical University orchestrated by the U.S. NSA’s Tailored Access Operations unit, detailing the attack infrastructure, weaponised tools, data theft and broader implications for Chinese critical sectors.

MalwareNSANorthwestern Polytechnical University
0 likes · 9 min read
NSA TAO Cyber Attack on Northwestern Polytechnical University: Investigation and Technical Analysis
Sohu Tech Products
Sohu Tech Products
Sep 7, 2022 · Information Security

Phishing Techniques: Theory, Classification, and Defense Strategies

The article provides a comprehensive overview of phishing as a social‑engineering attack, detailing its various techniques—including email deception, spear‑phishing, whaling, malware‑based lures, domain spoofing, vishing, SMS and QR‑code scams—and offers practical defense measures such as anti‑phishing tools, multi‑factor authentication, content filtering, and security standards.

Malwaredefense strategiesemail-security
0 likes · 14 min read
Phishing Techniques: Theory, Classification, and Defense Strategies
Open Source Linux
Open Source Linux
Jul 11, 2022 · Information Security

What Is Symbiote? Inside the New Highly Evasive Linux Rootkit

Researchers from Intezer and BlackBerry uncovered Symbiote, a novel Linux rootkit that loads as a shared library via LD_PRELOAD, hijacks libc and libpcap, uses BPF hooking to hide malicious traffic, and targets credential theft and remote access, especially in Latin American financial sectors.

BPFLD_PRELOADLinux
0 likes · 5 min read
What Is Symbiote? Inside the New Highly Evasive Linux Rootkit
Python Programming Learning Circle
Python Programming Learning Circle
May 30, 2022 · Information Security

Mozilla Blocks Malicious Firefox Add-ons “Bypass” and “Bypass XM” and Details Security Risks and Updates

Mozilla’s security team has blocked the malicious Firefox add-ons “Bypass” and “Bypass XM”, which abused the browser’s proxy API to hijack updates and bypass paywalls, affecting hundreds of thousands of users, and introduced new fallback mechanisms and a “Proxy Failover” extension in Firefox 93.

Add-onsFirefoxMalware
0 likes · 5 min read
Mozilla Blocks Malicious Firefox Add-ons “Bypass” and “Bypass XM” and Details Security Risks and Updates
21CTO
21CTO
May 26, 2022 · Information Security

How a Malicious PyPI Package Stole Secrets and What It Means for PyPI Security

Recent investigations reveal that the malicious PyPI package “ctx” harvested environment variables, encoded them in base64, and sent them to a Heroku endpoint, while attackers also hijacked the package’s maintainer account via domain takeover, highlighting serious vulnerabilities in PyPI’s package and account security processes.

Domain HijackingMalwarePyPI
0 likes · 5 min read
How a Malicious PyPI Package Stole Secrets and What It Means for PyPI Security
Java Captain
Java Captain
Apr 30, 2022 · Information Security

Understanding Chat Application Security: Encryption, Network Monitoring, and Potential Vulnerabilities

The article explains how modern chat applications protect communication with asymmetric and symmetric encryption, why network eavesdropping alone cannot reveal messages, and how installed monitoring software or system vulnerabilities can still expose chat records, emphasizing the need for regular updates and careful device usage.

Malwarechat securityencryption
0 likes · 9 min read
Understanding Chat Application Security: Encryption, Network Monitoring, and Potential Vulnerabilities
IT Services Circle
IT Services Circle
Apr 24, 2022 · Information Security

Inno Stealer Malware Disguised as Windows 11 Installer Targets Users

A new Inno Stealer malware campaign masquerades as a legitimate Windows 11 upgrade installer, using a spoofed Microsoft site to distribute an infected ISO that creates hidden scripts, disables security, and steals browser data and cryptocurrency wallets, posing a serious information‑security threat.

Inno StealerMalwareWindows 11
0 likes · 4 min read
Inno Stealer Malware Disguised as Windows 11 Installer Targets Users
Programmer DD
Programmer DD
Mar 18, 2022 · Information Security

How a Node‑IPC Supply‑Chain Attack Hijacked Vue‑CLI Projects

A malicious update to the npm package node‑ipc, used by vue‑cli, injected anti‑war code that creates unwanted files, overwrites system directories for Russian and Belarusian IPs, and sparked a community response that led to a patched vue‑cli release and detailed remediation steps.

MalwareOpen Source SecurityVue CLI
0 likes · 5 min read
How a Node‑IPC Supply‑Chain Attack Hijacked Vue‑CLI Projects
21CTO
21CTO
Jan 22, 2022 · Information Security

What’s Driving the Surge of Linux‑Based IoT Malware in 2021?

The article examines how the proliferation of Linux‑powered IoT devices has made them prime targets for malware families like XorDDoS, Mirai and Mozi, highlighting their rapid growth, attack techniques, and recommended defensive measures for operators.

DDoSIoT securityLinux
0 likes · 8 min read
What’s Driving the Surge of Linux‑Based IoT Malware in 2021?
Java Architect Essentials
Java Architect Essentials
Jun 12, 2021 · Information Security

China's First Nationwide Case of Illegal WeChat Data Harvesting via "Clean Fan" Software

In September 2022, Nantong police uncovered China's first nationwide case of illegal WeChat user data harvesting using a "clean fan" application, leading to the arrest of eight suspects who were convicted for illegally obtaining computer system data and controlling systems, highlighting severe information security risks.

ChinaMalwareWeChat
0 likes · 7 min read
China's First Nationwide Case of Illegal WeChat Data Harvesting via "Clean Fan" Software
Programmer DD
Programmer DD
Apr 22, 2021 · Information Security

How Hackers Hijack GitHub Actions to Run Free Crypto Mining

Hackers exploit GitHub Actions by submitting malicious pull requests that add hidden workflows, downloading and executing crypto‑mining binaries on GitHub’s free servers, a technique that has spread to other CI platforms and poses a persistent security challenge.

CI/CD SecurityGitHub ActionsMalware
0 likes · 9 min read
How Hackers Hijack GitHub Actions to Run Free Crypto Mining
ITPUB
ITPUB
Apr 13, 2021 · Information Security

How Hackers Hijack GitHub Actions to Run Free Crypto Mining

Amid soaring cryptocurrency prices, hackers exploit GitHub Actions by submitting malicious pull requests that run hidden XMRig mining code on GitHub’s free CI servers, a technique detailed through a French developer’s investigation, code analysis, attack scale, and mitigation advice.

CI/CDGitHub ActionsMalware
0 likes · 11 min read
How Hackers Hijack GitHub Actions to Run Free Crypto Mining
Java Architect Essentials
Java Architect Essentials
Apr 5, 2021 · Information Security

Malicious Qike PDF Converter Spreads via Silent Downloaders, Causes High CPU Usage

Huorong’s threat intelligence team discovered that the Qike PDF Converter distributes a hidden malicious proxy module through download‑site installers, leading to unexplained high CPU usage, persistent system services, and widespread infection traced back to a Hangzhou tech company, urging users to update antivirus definitions and remove the software.

HuorongMalwareWindows
0 likes · 5 min read
Malicious Qike PDF Converter Spreads via Silent Downloaders, Causes High CPU Usage
Programmer DD
Programmer DD
Sep 16, 2020 · Information Security

How TeamTNT Hijacked Cloud Infrastructure Using Weave Scope

In a recent attack, the cyber‑crime group TeamTNT leveraged the open‑source monitoring tool Weave Scope to silently control Docker and Kubernetes cloud environments without deploying malicious code, highlighting critical misconfigurations and the growing sophistication of cloud‑native threats.

DockerKubernetesMalware
0 likes · 5 min read
How TeamTNT Hijacked Cloud Infrastructure Using Weave Scope
Liangxu Linux
Liangxu Linux
Aug 16, 2020 · Information Security

How Doki Malware Exploits Misconfigured Docker APIs to Mine Cryptocurrency

The Ngrok‑based Doki malware silently scans for Docker API endpoints with weak configurations, hijacks containers to run crypto miners, uses the Dogecoin blockchain for dynamic C2 domains, and evades detection, highlighting the critical need to secure Docker APIs.

Cryptocurrency MiningDockerMalware
0 likes · 6 min read
How Doki Malware Exploits Misconfigured Docker APIs to Mine Cryptocurrency
Tencent Cloud Developer
Tencent Cloud Developer
Jul 27, 2020 · Information Security

Tencent Game Security 2019 Annual Report: Cheating, Black Markets, and Account Security Trends

The 2019 Tencent Game Security report reveals rising cheat samples on PC and mobile, dominant custom cheats, emerging subtle cheating tactics, a diversified black‑market selling fake IDs and compromised devices, rampant account theft largely through scams, and improved player reporting that boosted detection rates.

Game SecurityGaming IndustryMalware
0 likes · 9 min read
Tencent Game Security 2019 Annual Report: Cheating, Black Markets, and Account Security Trends
ITPUB
ITPUB
Dec 12, 2019 · Information Security

Master Linux Incident Response: Step-by-Step Malware Detection and Removal

This guide outlines a comprehensive Linux incident‑response workflow—identifying suspicious behavior, locating and terminating malicious processes, eliminating virus files, closing persistence mechanisms, and hardening the system—while providing concrete shell commands, monitoring techniques, and remediation tips to effectively combat Linux malware.

LinuxMalwareShell
0 likes · 9 min read
Master Linux Incident Response: Step-by-Step Malware Detection and Removal
ITPUB
ITPUB
May 19, 2019 · Information Security

Uncovering a SQL Server Job That Hid a Persistent Malware Loader

This article details a multi‑stage, file‑less attack that leveraged weak SQL Server credentials, Transact‑SQL stored procedures, and WMI to download and execute a downloader (cabs.exe) which fetched multiple botnet components, and explains the forensic steps and remediation measures taken to eradicate the threat.

MalwareSQL ServerStored Procedure
0 likes · 7 min read
Uncovering a SQL Server Job That Hid a Persistent Malware Loader
21CTO
21CTO
Feb 7, 2019 · Information Security

How the 'SpeakUp' Linux Backdoor Hijacks Servers and Mines Monero

A newly discovered Linux backdoor called SpeakUp, exploiting the ThinkPHP CVE‑2018‑20062 flaw, spreads via a built‑in Python script, hijacks cron for persistence, leverages multiple CVEs to compromise servers, and mines Monero, with infections concentrated in China and South America.

CVELinuxMalware
0 likes · 4 min read
How the 'SpeakUp' Linux Backdoor Hijacks Servers and Mines Monero
21CTO
21CTO
Nov 27, 2018 · Information Security

event-stream NPM Trojan: How a Bitcoin‑Mining Backdoor Sneaked In

The article explains how the popular Node.js package event-stream was transferred to a new maintainer who injected a malicious flatmap-stream module that steals Bitcoin, outlines the timeline of the supply‑chain attack, and provides steps for developers to detect and remediate the infection.

Event StreamMalwareSecurity
0 likes · 6 min read
event-stream NPM Trojan: How a Bitcoin‑Mining Backdoor Sneaked In
ITPUB
ITPUB
Nov 26, 2018 · Information Security

Inside Linux.BtcMine.174: How Dr.Web’s New Malware Hijacks Linux Systems

Dr.Web’s recent report reveals Linux.BtcMine.174, a sophisticated 1000‑line shell‑script trojan that exploits Dirty COW or CVE‑2013‑2094 for root access, disables dozens of antivirus processes, mines cryptocurrency, and spreads via SSH‑collected hosts, with its components’ SHA‑1 hashes published on GitHub.

Cryptocurrency MiningLinuxMalware
0 likes · 3 min read
Inside Linux.BtcMine.174: How Dr.Web’s New Malware Hijacks Linux Systems
ITPUB
ITPUB
May 29, 2018 · Information Security

How Roaming Mantis Malware Hijacks DNS to Infect Android, iOS, and PCs

The Roaming Mantis malware exploits compromised routers to perform DNS hijacking, redirecting Android, iOS, and desktop users to malicious sites that install fake updates, steal credentials, and run CoinHive mining scripts, while spreading across more than twenty languages worldwide.

AndroidDNS hijackingMalware
0 likes · 6 min read
How Roaming Mantis Malware Hijacks DNS to Infect Android, iOS, and PCs
Efficient Ops
Efficient Ops
Aug 14, 2017 · Information Security

Critical Xshell Backdoor Alert: How Malicious DLLs Leak Data and What to Do

A recent security advisory reveals that popular remote terminal Xshell versions contain a backdoor in the nssock2.dll component, enabling shellcode to harvest host information, generate monthly DGA domains, and potentially expose sensitive data, prompting immediate version checks and upgrades.

DGAMalwareXshell
0 likes · 6 min read
Critical Xshell Backdoor Alert: How Malicious DLLs Leak Data and What to Do
MaGe Linux Operations
MaGe Linux Operations
Jun 4, 2017 · Information Security

How Fireball Malware Hijacked 250 Million Browsers – Origins, Impact, and Defense

Check Point researchers reveal that the Fireball malware, linked to Chinese firm Rafotech, has infected up to 250 million Windows and macOS computers worldwide by bundling malicious browser extensions, hijacking search engines, and enabling extensive data theft, prompting detailed analysis of its origin, impact, and mitigation steps.

FireballMalwareRafotech
0 likes · 7 min read
How Fireball Malware Hijacked 250 Million Browsers – Origins, Impact, and Defense
MaGe Linux Operations
MaGe Linux Operations
Mar 24, 2017 · Information Security

How We Detected and Eliminated a Struts2 Mining Malware Attack

This article recounts a recent incident where a Struts2 vulnerability was exploited to run mining malware, detailing the discovery process, forensic analysis of services, processes, network listeners, and the step‑by‑step remediation measures including script‑based scans, permission hardening, and upgrading Struts2.

MalwareStruts2Vulnerability
0 likes · 4 min read
How We Detected and Eliminated a Struts2 Mining Malware Attack
Efficient Ops
Efficient Ops
Jan 5, 2017 · Information Security

How I Rescued a Compromised Ubuntu Server: Step‑by‑Step Intrusion Response

After a sudden traffic surge and loss of SSH access on an Ubuntu 12.04 server, I worked with the data‑center team to trace malicious outbound connections, identify compromised binaries, remove persistent backdoor scripts, and implement firewall rules and logging practices to prevent future intrusions.

Malwareforensicsiptables
0 likes · 8 min read
How I Rescued a Compromised Ubuntu Server: Step‑by‑Step Intrusion Response
Alibaba Cloud Infrastructure
Alibaba Cloud Infrastructure
Sep 22, 2016 · Information Security

2016 China Internet Counterfeit App Landscape Report

Based on Alibaba security data from January to August 2016, an analysis of 240 popular Android apps across 16 industry categories found that 83% had counterfeit versions, totaling 8,267 fake apps that infected 67.9 million devices, with social networking apps leading the fraud landscape.

Android SecurityChinaMalware
0 likes · 3 min read
2016 China Internet Counterfeit App Landscape Report
ITPUB
ITPUB
Jul 22, 2016 · Information Security

How Mining Trojans Hijack Linux Servers: Sample 101 Analysis and Defense

The article examines a cryptocurrency mining trojan (sample 101), detailing its process list, malicious startup scripts, SSH key injection, service deployment, removal steps, and offers practical defense measures against such malware infections.

CronCryptocurrency MiningLinux
0 likes · 7 min read
How Mining Trojans Hijack Linux Servers: Sample 101 Analysis and Defense
MaGe Linux Operations
MaGe Linux Operations
Apr 23, 2016 · Information Security

From Staog to Windigo: A 20‑Year Journey Through Linux Malware

This article chronicles the evolution of Linux malware from the first recognized virus Staog in 1996 through notable threats such as Bliss, Slapper, Badbunny, Snakso, Hand of Thief, Windigo and the Shellshock‑related Mayhem botnet, highlighting how increasing Linux adoption has attracted attackers.

LinuxMalwarecyber threats
0 likes · 6 min read
From Staog to Windigo: A 20‑Year Journey Through Linux Malware
21CTO
21CTO
Mar 20, 2016 · Information Security

7 Surprising Attack Techniques Hackers Use to Exploit Everyday Users

This article surveys seven modern hacking tricks—from fake Wi‑Fi hotspots and cookie theft to file‑name deception, path hijacking, hosts‑file redirection, watering‑hole attacks, and bait‑replacement—explaining how they work, why they succeed, and practical defenses for users and developers.

MalwareWeb Securityinformation security
0 likes · 13 min read
7 Surprising Attack Techniques Hackers Use to Exploit Everyday Users
ITPUB
ITPUB
Mar 14, 2016 · Information Security

How to Diagnose and Remove Hidden Malware Causing Network Flood on a Linux Server

A step‑by‑step guide shows how to identify abnormal NIC traffic, locate malicious init scripts and hidden processes, use simple shell scripts and netstat to pinpoint the offending connection, and clean a compromised Linux server to restore normal network performance.

LinuxMalwareSecurity
0 likes · 10 min read
How to Diagnose and Remove Hidden Malware Causing Network Flood on a Linux Server
Efficient Ops
Efficient Ops
Feb 28, 2016 · Information Security

How Much Do Hackers Spend and Earn? A Deep Dive into Cybercrime Economics

This article breaks down the monthly expenses hackers incur for tools, services, and infrastructure, then reveals how much they can earn through ransomware, malicious certificates, fake antivirus, IP reputation abuse, web shells, and user data trading, highlighting the lucrative yet risky nature of cybercrime.

Malwarecybersecuritydata theft
0 likes · 9 min read
How Much Do Hackers Spend and Earn? A Deep Dive into Cybercrime Economics
ITPUB
ITPUB
Nov 6, 2015 · Information Security

How I Decompiled a Malicious Android App and Uncovered Its Hidden Email Spy

A user received a suspicious SMS with a malicious app link, prompting an analyst to download, decompile, and dissect the Android malware, revealing hidden Device Admin permissions, obfuscated code, DES-encrypted credentials, and the attacker’s email address, ultimately exposing how the trojan steals personal data.

AndroidDES EncryptionMalware
0 likes · 4 min read
How I Decompiled a Malicious Android App and Uncovered Its Hidden Email Spy
21CTO
21CTO
Sep 22, 2015 · Information Security

What Was XcodeGhost? Inside the 2015 iOS Supply‑Chain Attack and Its Aftermath

The article chronicles the 2015 XcodeGhost incident, detailing how a malicious Xcode version infected dozens of popular iOS apps, the response from Tencent, Apple, and security researchers, and the lessons learned for developers and the broader mobile security community.

App StoreMalwareXcodeGhost
0 likes · 13 min read
What Was XcodeGhost? Inside the 2015 iOS Supply‑Chain Attack and Its Aftermath