Malware Security News

Malware families, new samples, and analysis of the techniques malicious software uses to infect and persist on systems.

Malware covers everything from commodity trojans and infostealers to sophisticated custom implants used in targeted intrusions. New samples, family updates and analyst write-ups on how a given piece of malware infects, persists and talks to its operators land here. Worth pairing with the ransomware and APT feeds, since most major campaigns rely on custom or repurposed malware.

Recent Malware items

New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MS...
@bleepingcomputer · Nov 12, 2026
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks https://ift.tt/yl7hNTu
@ctinow · Nov 12, 2026
Hackers compromise 4,800 GitHub accounts to steal cloud credentials A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 reposito...
@bleepingcomputer · Nov 12, 2026
CVE-2026-124004 XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator...
@cveNotify · Nov 12, 2026
Netryx RAT Emerges Publicly as Development Accelerates and LLM Integration Takes Shape | iQBlack Threat Intel Insight Executive SummaryNetryx RAT has begun to gain public visibility as a new remote-ac...
@malwr · Nov 12, 2026
Gootloader Malware Disrupted in International Cyber Operation https://ift.tt/B3qSlmL
@ctinow · Nov 12, 2026
CVE-2026-126724 Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authenticatio...
@cveNotify · Nov 12, 2026
CVE-2026-126722 Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide...
@cveNotify · Nov 12, 2026
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories https://ift.tt/kNwdrUp
@ctinow · Nov 12, 2026
International operation dismantles malware networks, exposes 6.4 million stolen credentials https://cyberscoop.com/operation-endgame-malware-takedown-gootloader-stealc-europol/
@PentestingNews · Nov 12, 2026
Microsoft researchers uncover growing GSocket backdoor activity on Linux servers https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/
@secharvester · Nov 12, 2026
Microsoft uncovers 59 Linux kernel bugs, including 8 with working root exploits. Also in this week's #ThreatsDay : • Falcon browser spyware • GSocket backdoor surge • Europol server takedown • $6.43B...
@thehackernews · Nov 12, 2026
International operation dismantles malware networks, exposes 6.4 million stolen credentials https://ift.tt/cXMxFDi
@ctinow · Nov 12, 2026
186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers https://ift.tt/Ux6lAW7
@ctinow · Nov 12, 2026
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths https://ift.tt/iEdk1wv
@ctinow · Nov 12, 2026
Police dismantle Gootloader, CastleRAT, StealC malware infrastructure Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, Castl...
@bleepingcomputer · Nov 12, 2026
Predator, Pegasus and Graphite: Governments Accused of Spyware Abuse Face Little Accountability https://securityaffairs.com/202922/malware/predator-pegasus-and-graphite-governments-accused-of-spyware-...
@PentestingNews · Nov 12, 2026
186 fake domains impersonate ChatGPT, Claude, Gemini and 24 other AI brands. A mistyped URL can lead to fake security checks, malware downloads or Chrome extensions that hijack searches. How the schem...
@thehackernews · Nov 12, 2026
Police dismantle Gootloader, CastleRAT, StealC malware infrastructure https://ift.tt/pItPOGE
@ctinow · Nov 12, 2026
Predator, Pegasus and Graphite: Governments Accused of Spyware Abuse Face Little Accountability https://ift.tt/HEw8JsT
@ctinow · Nov 12, 2026
Your Endpoint Management Platform Could Be Your Biggest Security Risk Endpoint management platforms can become powerful attack tools when compromised, allowing hackers to deploy malware, execute comma...
@bleepingcomputer · Nov 12, 2026
Large-scale attack pushes secret-stealing malware to 65K+ GitHub repos https://ift.tt/nuXrRhS
@ctinow · Nov 12, 2026
Webinar: Cyber Unpacked S3:E2 // IR Beyond Malware: Investigating Business Email Compromise And Fraud https://ift.tt/wWHU6PV
@ctinow · Nov 12, 2026
Cyber Unpacked S3:E2 // IR Beyond Malware: Investigating Business Email Compromise And Fraud https://ift.tt/MQPZkCD
@ctinow · Nov 12, 2026
The danger behind fake job interviews has once again put North Korean cyber operations in the spotlight. But how do these actors actually gain access and operate? ⚡️ Get a rare look inside DPRK operat...
@anyrun_app · Nov 12, 2026
ScreenConnect attackers have a new target: IT support technicians. SCKit malware exploits a patched 9.9-rated flaw and attempts to hijack technician sessions to spread across MSP customer networks. Th...
@thehackernews · Nov 12, 2026
CVE-2026-83542 Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on th...
@cveNotify · Nov 12, 2026
Hackers Deploy Malware in Fresh ScreenConnect Campaign https://ift.tt/3JWmnkc
@ctinow · Nov 12, 2026
8,000 gitbub repos got a credential stealer pushed with stolen tokens and the attacker reverted the commits afterwards https://safedep.io/blog/github-actions-wfx-credential-stealer
@secharvester · Nov 12, 2026
I am not joking when I say I don't go outside. Some people joke, or they're being hyperbolic to imply they're introverted, but I am being completely serious when I say I don't go outside. I don't have...
@vxunderground · Nov 12, 2026

Other topics

CVE
Recent CVE identifiers and vulnerability disclosures aggregated from security feeds: new IDs, published advisories, and the vendors and products they affect.
Ransomware
Ransomware attacks, extortion group activity, victim disclosures and decryptor releases.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Data Breach
Confirmed and reported data breaches: what was exposed, which organizations were affected, and how the incident came to light.
Exploit
Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.