malware

The extortion group ShinyHunters claims it breached the FBI and obtained highly sensitive medical records of personnel, reportedly leaked as part of an attempted extortion scheme. Malwarebytes reports on the alleged theft of medical and other private data. The FBI has not been confirmed as commenting, and the scale and authenticity of the claimed leak remain unverified, but the targeting of a US law enforcement agency is drawing close attention in the cybersecurity community.

Screenshot service Gyazo suffered a data breach affecting 23.6 million users, with personal information exposed. The incident is reported alongside a separate malware operation called TASK#STOMP that steals documents from infected machines. Security observers are treating both as reminders of growing risks around stored user data and targeted document theft, as details of the breach's scope continue to circulate.

Security researchers report a new Android malware dubbed RatHat that tracks users' screen touches to capture passwords and other sensitive credentials. By logging tap patterns, the malware can infer what victims type even without a keylogger. Android users are being warned to install apps only from trusted sources and keep devices updated.

Reports indicate that access to artificial intelligence tools is becoming a commodity traded among cybercriminals, with stolen or resold credentials and subscription accounts allowing low-skill actors to use powerful AI services for fraud, malware and other schemes. The trend lowers the barrier to entry for online crime and raises new questions about how AI providers secure their platforms against misuse.

GitHub has re-enabled Actions, but security researchers warn that a smaller variant of the Shai-Hulud payload remains active, keeping supply-chain risk alive for developers who rely on automated workflows. The report, covered by BleepingComputer, suggests teams should stay cautious, audit their pipelines, and treat the malware threat as ongoing rather than resolved.

Security researchers report that the Lunex Stealer malware abuses a legitimately signed AMD driver to disable security monitoring on infected Windows machines, allowing it to steal saved browser credentials undetected. The technique, known as bring-your-own-vulnerable-driver, exploits a vulnerable driver to gain elevated access and silence endpoint defenses before harvesting sensitive data.

Researchers describe CARBONATO as the first known botnet whose command-and-control engine is an AI agent, meaning the malware can reportedly make operational decisions itself rather than following fixed instructions from attackers. The botnet is said to have been active since October 2024. Security experts are highlighting the development as a sign that AI is moving into offensive cyber tools, raising concerns about more adaptive and harder-to-take-down botnets.

Reports from Italian media highlight that malware is growing by 2,065%, with artificial intelligence increasingly being used to power online attacks. The coverage points to a sharp escalation in cyber threats as AI tools make malicious software easier to develop and harder to detect, raising concerns among security experts and prompting debate about how businesses and institutions should respond to this new wave of AI-assisted cybercrime.

A fake TVTap app hosted on a site imitating the Google Play Store is distributing RemControl, a new Android banking trojan. Security outlet Punto Informatico reports the malware can target users' banking credentials once installed. The warning is circulating among Italian-speaking tech audiences, who are being urged to avoid third-party app stores and download apps only from official sources.

Security researchers are warning about PamStealer, a new infostealer targeting macOS that is distributed through counterfeit Wavel applications. Once installed, the malware harvests system passwords and browser data from infected machines, putting user credentials at risk. Mac users are being urged to download software only from official sources and to be cautious of fake app installers circulating online.

Cybersecurity firms report attackers are exploiting a previously unknown vulnerability in Citrix NetScaler, tracked as CVE-2026-88772, to deploy custom web shells and tunneling malware. The attackers reportedly gain root access, steal credentials, and move into victims' internal networks. Security teams are urged to check exposed NetScaler appliances for signs of compromise and apply patches as they become available.

A new explainer examines bulletproof hosting, the practice of internet providers knowingly renting server space to criminals and ignoring abuse complaints or takedown requests. The article outlines how these operators shield malware campaigns, phishing and other cybercrime, and looks at how investigators use open-source techniques to trace and identify the networks behind them.

Cybersecurity researchers report a scam website posing as a preorder page for an iPhone Duo, which is not a real Apple product. Visitors lured into entering payment or personal details are then targeted with DarkSword, a malicious software attack. The scheme appears designed to exploit hype around new iPhone launches to trick buyers into downloading malware.

Commenters are mocking the release of GLM-5.3, an AI model they say can generate cyber exploits faster than existing tools. Critics sarcastically congratulate the makers for crossing the line between innovation and chaos, arguing that even 'limited' access to such capabilities amounts to opening a Pandora's box for malware creation and offensive security work.

A critical vulnerability, CVE-2026-88772 with a CVSS score of 9.5, has been disclosed in Citrix NetScaler ADC and Gateway products. The DTLS memory overflow allows unauthenticated attackers to achieve shellcode execution. According to Mandiant and Google Threat Intelligence, it has been actively exploited since September to gain root access and deploy the WHIPSHOT and SLAPSHOT malware. Administrators are urged to patch immediately.

Security researchers report a malicious ChatGPT Custom GPT being used to push a remote access trojan through the ClickFix social engineering technique, which tricks users into running commands themselves. The finding highlights how attackers are abusing OpenAI's custom GPT ecosystem as a delivery vector, raising fresh concerns about moderation and vetting of third-party GPTs.

Security researchers at SafeDep report a self-spreading Linux worm, dubbed DirtyBlanket, distributed through nine malicious npm packages impersonating popular libraries such as Express and React. Once installed, the malware targets developers' Linux machines and propagates further, making supply-chain attacks on the JavaScript ecosystem a renewed concern for developers reviewing dependencies.