-->
#1 Trusted Cybersecurity News Platform
Followed by 5.70+ million
The Hacker News Logo
Get the Latest News
cybersecurity

Malware | Breaking Cybersecurity News | The Hacker News

Category — Malware
Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Aug 14, 2026 Malware / Cybercrime
Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available for registration and is then snapped up by another party. During the first half of 2026, 50,400 dropcatch domains were re-registered each day in the generic top-level domains (gTLDs) like ".com" alone, a figure that jumps to around 65,000 when country code top-level domains (ccTLDs) are taken into consideration. These account for nearly 20$ of all daily gTLD and ccTLD registrations, meaning one out of five newly registered domains is a dropcatch domain. "These domains can be particularly interesting, even dangerous, because they inherit reputation and sometimes connections from their previous life," Infoblox said in an exhaustive three-part report shared with The Ha...
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

Aug 14, 2026 Malware / Threat Intelligence
The threat actor known as HoneyMyte (aka  Mustang Panda ) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information. Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, with CoolClient consistently deployed as a secondary backdoor following a  PlugX  infection. The kernel component is deployed when CoolClient has full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If those conditions are not met, the malware skips driver deployment and proceeds to the final-stage implant. Kaspersky has also published file hashes, paths, and C2 domains as indicators of compromise (IoCs). "Our analysis confirms that the investigated malware is a new CoolClient variant ...
Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups

Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups

Aug 14, 2026 Cybercrime / Offensive Operation
A new White House memo signed by U.S. President Donald Trump has instructed the National Coordination Center (NCC) to establish a program that would allow private sector companies to take advantage of their "innovative capabilities" to break into foreign Transnational Criminal Organizations (TCOs) and disrupt them. "By partnering with vetted United States companies subject to the direction and oversight of the Federal Government, we will enhance our ability to counter TCO threats and combat transnational cybercrime, fraud, and other predatory schemes against American citizens," the memo reads . To that end, the NCC has been tasked with setting up a program within 60 days that allows authorized companies to conduct two types of operations against TCOs upon obtaining approval: cyber surveillance operations, which can access sensitive data without authorization from the owner or operator, and cyber effects operations, which can result in disruption, denial, degrad...
cyber security

AI Is Flooding Security with Bugs Nobody Proved

websiteSANSVulnerability / Artificial intelligence
Stephen Sims on why unproven AI findings pile up as a triage burden. Read the full SANS blog.
cyber security

Exploit Time Just Dropped From 30 Days to 30 Minutes

websiteRecoAI Security / SaaS Security
Download the 11-step checklist CISOs use to close exposure windows first.
China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

Aug 14, 2026 United States
The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud. "Both missions are administered from a single control panel, XG-Web , a browser-centric remote-access and information-stealing framework that turns a victim's browser into a full remote-control channel and reaches from there into the host and the internal network behind it," Broadcom's Symantec and Carbon Black Threat Hunter Team said . Jewelbug is assessed to be a China-based hackers-for-hire group that runs parallel operations, including espionage against governments and militaries across the Middle East, Southeast Asia and South Asia, and a for-profit cryptocurrency fraud business. "The group has developed five generations of command-and-control (C&C) code and a family of implants spanning browsers, Windows endpoints, Linux servers and network devices,...
ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

Aug 13, 2026 Hacking News / Cybersecurity News
Some weeks have one big security story. Others bring many smaller updates that are easy to miss but still matter. This week has plenty of them, covering cloud services, AI tools, malware, data breaches, scams, and new attack methods. The latest ThreatsDay Bulletin puts all of these short updates in one place, so you can quickly catch up on what happened, what changed, and what security teams should know. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.
⚡ Top Stories This Week
Expert Insights Articles Videos
Cybersecurity Resources