Malware | Breaking Cybersecurity News | The Hacker News

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are using AI to speed things up. Others are leaving their own attack files exposed. Not exactly careful work. Different stories, familiar weak spots. Here's what showed up this week. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba . The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver a malware family called YobaLoader. "The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security protections," Check Point Research said in an analysis. To add to the project's credibility, the attackers set up GitHub.io pages to describe the capabilities of the software. Although the GitHub projects' popularity is not manipulated using techniques like ghost networks , signs point to the use of SEO poisoning tactics to ensure that links to them are sur...

GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said . The feature, which currently supports only npm packages, is available in public preview for all GitHub Enterprise Cloud customers, including data-resident GitHub Enterprise Cloud. According to the Microsoft subsidiary, the firewall is placed between endpoints or internal registries and the upstream package repositories so as to deter malware attacks that compromise systems when packages are installed. This behavior can expose users to severe security risks, especially when artificial intelligence (AI) agents and CI runners automatically install dependencies to complete a task or build without their explicit permission. The idea is that endpoints like coding ...

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift , is designed to copy the keys that encrypt traffic between sites and store them for later use,  Cisco Talos said  on October 28. Talos calls the attacks historical but does not specify when they occurred or whether any keys were sent. The flaw is tracked as  CVE-2026-20127  and has a CVSS score of 10.0. It allows an unauthenticated remote attacker to bypass authentication and gain administrative privileges on these control systems. On a Controller, the attacker can log in as a high-privileged internal account that is not root. When Cisco  disclosed the flaw in February , Talos tracked its exploitation as UAT-8616, a cluster of activity it said went back to at least 2023. In  Cisco's traditional key exchange , each SD-WAN router periodically generates an AE...

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google  its full catalog , along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only on devices running Android 17 QPR2 or later in  supported countries , which do not include the US. Today, a user installing apps from a third-party store must first enable the store to install apps, then confirm each install and each update. From December 1, a store in Google's  Registered App Stores program  gets that permission automatically once it is approved, and its updates run in the background under the user's own update settings. Google  announced the program in March , alongside changes it said resolved its disputes with Epic Games. Joining is optional, and sto...