Malware | Breaking Cybersecurity News | The Hacker News

The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and Félix Aime said in a technical report shared with The Hacker News. "Then, the delivery infrastructure delivers a platform-specific N-day exploit chain targeting either iOS or Android." The end goal of the attacks is to serve payloads capable of stealing browser cookies, and in some cases, Wi-Fi passwords or full mobile device data. The activity, codenamed Poisoned Source , was discovered by the French cybersecurity company in mid-October 2026. A defining aspect of the campaign is the use of three infection vectors - Compromise of legitimate websites to inject malicio...

A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET. "DarkVigil implants are typically deployed through popular Chinese applications," ESET researcher Anh Ho said in a report shared with The Hacker News. "By abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe." Some of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to. Active since at least September 15, 2023, SlippyNunc...

Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016. The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the accounts of organizations, as well as creating, distributing, and using malicious software." In one September 2025 case highlighted by the ministry, the attackers are said to have sent a phishing email to an unnamed organization, masquerading it as business correspondence and instructing recipients to open a reconciliation report that triggered the execution of malware. The incident resulted in losses of 660,000 rubles ($8,000) from the organization's bank account, with the attackers transferring the funds to accounts under their control. "The attacks utilized a vast ...

Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. "It was not a single isolated breach or a simple phishing incident," the company said . "The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method." The starting point has been traced back to a supply chain attack targeting one of its engineers from the Wallet DevOps team (named "Engineer A"), who downloaded a trojanized Homebrew installer to install a popular artificial intelligence (AI) tool after searching for it on a search engine....

An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory . In a later disclosure , OPSSHIELD said about 2,950 customer servers ran the script, which sent the files it collected back to the attacker. OPSSHIELD first named cPGuard 5.88.25 as the fix. Its later disclosure says version 5.88.26 removes the backdoor, and a follow-up update removes a scheduled task the script also left. Admins should install the latest version and then check that those files are gone. Credentials the script copied may still work after the update, so any server that may have run the script also needs new passwords and keys. At 02:06 UTC, the attacker, who has not been identified, used compromised credentials to get into cPGuard's update system. ...