Stories tagged “Malware.”
30 stories
The best antivirus software to protect your computer in 2026
ZDNET experts put every product through rigorous testing and research to curate the best options for you. Our favorite antivirus software protects your PC, laptop, and mobile devices from malware without costing a fortune.
A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal card data and send it to attackers in real time.
Researchers at Socket discovered hundreds of fake Chrome VPN extensions that impersonated well-known VPN and proxy services, routing users' traffic through SOCKS5 proxies operated by a single provider. The extensions were downloaded nearly 75,000 times, mainly by Russian …
Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro that has been observed delivering a browser wallet and credential stealer.
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems.
ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script …
Gen Threat Labs followed two H1 2026 campaigns where attackers used legitimate accounts, browser settings, and blockchain data as part of the attack path. The campaigns targeted users in Czechia, Slovakia, Poland, and Lithuania, using normal business emails with attachmen…
GitHub's supply chain engineering team expanded malware advisories to eight ecosystems by building on OpenSSF's shared malicious packages data. Dependabot now flags malware in npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer dependencies.
A hacker, Connor Riley Moucka, pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy over the 2024 breaches of Snowflake customer accounts. The intrusions reached at least 165 organizations and exposed records belonging to at le…
A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake sof…
Google has locked hundreds of Blogger websites after a false positive claimed they violated its 'Malware and Similar Malicious Content' policy. The issue affects many legitimate blogs that do not host malware or have malicious scripts.
Researchers disclosed a long-running supply chain attack on QuickFox VPN that used a trojanized Windows installer to deliver the FDMTP backdoor, with tactical overlaps pointing to the Chinese state-sponsored group Mustang Panda.
A new version of the XCSSET malware targets thousands of macOS users through compromised Xcode projects and GitHub repositories. The malware features enhanced evasion techniques and introduces two new components.
A massive supply-chain attack has compromised over 1,300 packages on the Node Package Manager (npm) registry, including popular ones like Keyv and Cacheable. The attack, named 'ChainDrop', has been linked to a self-propagating malware that steals sensitive information and…
A credential-stealing npm worm has spread across hundreds of packages, compromising developer and CI environments. The worm harvests repository, package registry, cloud, and private-key material, and uses available npm publishing access to poison more packages.
SOCRadar details DOUBLECUP, a Russian loader-as-a-service active since June 2026 that uses ClickFix lures to stage steganographic PNG images in browser caches, delivering CountLoader and a previously undocumented DeviceManager RAT.
A global campaign targeting hospitality Wi-Fi networks has been linked to the Russian threat actor Midnight Blizzard. The attackers use custom malware to steal Microsoft 365 accounts and have been active since at least early May.
Security researchers have discovered three attacks that allow malware on already-compromised Windows devices to abuse Google Password Manager's synced passkeys to take over accounts, bypass user verification, and extract passkey private keys.
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.
A fake version of the Roblox utility Xeno Executor is spreading malware that provides remote access and steals sensitive information. The malware is being promoted to Roblox players through gaming forums and Discord communities.
Google Password Manager attacks could let malware hijack passkey-protected accounts without a fingerprint, PIN, or any other authentication factor appearing on the victim's screen. Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenti…
The INC Ransomware operation has emerged as the dominant threat actor exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. Fixes for the vulnerability pair were released by SonicWall in mid-July 2026.
The Android RAT BTMOB has developed an underground ecosystem with a criminal software business that has become increasingly difficult for its original operator to control. The official operator has repeatedly reduced the price, while third parties advertise alleged access…
A Chinese threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. The kit targets iOS versions 18.4 through 18.7 and has been observed to employ watering holes as a starting point …
Google is preparing a new Chrome security feature that would block policy-installed extensions from hijacking the New Tab page or changing the default search engine. This feature is aimed at protecting consumer PCs from malware that abuses enterprise policies to install m…
Hackers modified a JavaScript file served by Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities.
A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report.
A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025.
The Arch Linux User Repository (AUR) is experiencing another wave of malicious packages, leading the Arch Linux team to temporarily halt package adoptions.
Arch Linux's DevOps team has disabled package adoption in the Arch User Repository (AUR) due to a surge in malicious adoptions and commits. This action follows a series of attacks involving a remote-access trojan (RAT) distributed via compromised orphaned packages.