-->
#1 Trusted Cybersecurity News Platform
Followed by 5.70+ million
The Hacker News Logo
Get the Latest News
cybersecurity

Malware | Breaking Cybersecurity News | The Hacker News

Category — Malware
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Sep 23, 2026 Malware / Supply Chain
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido , the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/docker (1,449 downloads) gocommunity.io/orderedbtree gogets.dev/btreex The malware deployed through these packages demonstrates overlaps with Graphalgo , a campaign that was first documented by ReversingLabs earlier this February and attributed to North Korean (aka DPRK) threat actors. As part of this effort, prospective developers are approached via social platforms like LinkedIn and Facebook, or through job offerings on forums by posing as non-existent Web3 companies, and then asked to complete a coding task by providing a benign GitHub repository that introduces the malicio...
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move

This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move

Sep 23, 2026 Artificial Intelligence / Malware
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is. Talos found the malware with  CAIRN , an open-source tool it released the same day to hunt for malware that uses AI services. The malware is at least three months old, because Talos's analysis of the code is dated June 17, 2026. The researchers did not describe how the malware would get onto a victim's computer. It said clues in the code tied the developer to criminal forum posts about carding, the trade in stolen card data, dating to 2025. How the AI Vote Works Malware usually takes orders from a command-and-control (C2) server that the attacker runs. CLOSEDQUORUM instead asks up t...
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI

Sep 23, 2026 Malware / Cloud Security
Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit designed for Windows, Linux, and macOS. According to reports from Aikido , SafeDep , Socket , and StepSecurity , the libraries in question below - @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23 and 0.1.25 (versions 0.1.22 and 0.1.24 are clean) MemoryOS version 2.0.34 (project currently quarantined on PyPI) The malicious npm package versions include a "hidden Go payload into a legitimate AI memory integration. Versions 0.1.21, 0.1.23, and 0.1.25 contain code that launches the payload when the agent gateway starts and whenever the plugin handles a memory-recall event," StepSecurity said. "The launcher passes the host process environment and, during recall, the user's prompt text directly to the malicious executable."
cyber security

Do You Need to Protect AI, Use AI, or Govern AI? SANS has Mapped All Three.

websiteSANS InstituteAI in Cybersecurity
Free frameworks, guidelines, and role-based AI security training, gathered in one place.
cyber security

Mikko Hyppönen and Enterprise CISOs on What AI-Speed Attacks Actually Change

websitePicus SecurityAI Security / Threat Detection
Join the summit where leading security teams lay out how they prepare for attackers with AI on their side.
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

Sep 23, 2026 Zero-Day / Vulnerability
A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break out of the browser's sandbox and achieve remote code execution. "UTA0565 masqueraded as various entities including media organizations and a non-governmental organization (NGO)," Volexity researchers Damien Cash and Tom Lancaster said in an analysis published this week. "Notably, this threat actor's campaigns differed from previously documented attacks by using multiple fake websites to deceive victims." One such campaign targeted Asian government entities with Chinese- and English-language phishing emails that urged recipients to support Hong Kong activist Cho...
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials

Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials

Sep 22, 2026 Supply Chain Attack / Malware
Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731." In total, 11 versions of the package were published in quick succession on the same day over an approximately 45-minute time period. The npm user account no longer exists as of writing. "The first version of tw-pkgprobe-7731 posed as an authorized security research probe," ReversingLabs researcher Lucija Valentić said in a report published today. "Comments inside the package describe it as an 'Authorized bug-bounty research probe (Twilio HackerOne program)' that 'runs only inside Twilio's serverless packager sandbox' and ...
⚡ Top Stories This Week
Expert Insights Articles Videos
Cybersecurity Resources