Latest Malware News & Analysis | Hexnode Threat Watch

Malware

x47.c Windows Botnet Credential Theft and AI-Assisted Persistence

x47.c Windows Botnet: Credential Theft and AI-Assisted Persistence

Oct 6

5 min read

NeedyMantis malware

NeedyMantis malware: How a modular toolkit supports targeted intrusions

Sep 29

6 min read

PeopleSoft WAF Bypass Lets UNC6240 Reopen a Critical RCE Campaign

PeopleSoft WAF Bypass Lets UNC6240 Reopen a Critical RCE Campaign

Sep 28

4 min read

Ukrainian Business Sites Become ClickFix Launchpads for Psychedelic Stealer

Ukrainian Business Sites Become ClickFix Launchpads for Psychedelic Stealer

Sep 25

5 min read

malicious terraform providers

Malicious Terraform Providers Deliver Go Malware via HashiCorp

Sep 24

6 min read

AI Memory Packages Become Credential-Stealing Supply-Chain Implants

AI Memory Packages Become Credential-Stealing Supply-Chain Implants

Sep 24

4 min read

ChainScript Uses ClickFix and Polygon to Keep RAT Infrastructure Moving

ChainScript Uses ClickFix and Polygon to Keep RAT Infrastructure Moving

Sep 22

5 min read

Jade Sleet FLATROOF

Jade Sleet FLATROOF and ROOFDECK: Securing DevOps Macs Against Backdoors

Sep 22

6 min read

task#stomp powershell backdoor

TASK#STOMP PowerShell Backdoor Steals Business Documents

Sep 22

6 min read

waterplum cyber actor

WaterPlum Cyber Actor Targets Developers via Fake Interviews

Sep 21

5 min read

One Click on Windows Opens the Door to GRAYRABBIT

One Click on Windows Opens the Door to GRAYRABBIT

Sep 18

5 min read

Android Work Profiles Become a Banking Malware Hideout

Android Work Profiles Become a Banking Malware Hideout

Sep 18

5 min read

ted linux toolkit

TED Linux Toolkit: North Korean APT Compromises HAProxy

Sep 18

6 min read

Red Heron Gitea RCE How CVE-2026-60004 Led to Linux Compromise

Red Heron Gitea RCE: How CVE-2026-60004 Led to Linux Compromise

Sep 17

8 min read

cve 2026 27540

CVE-2026-27540: Active Exploits Hit WooCommerce Lead Plugin

Sep 17

4 min read

hbo max reddit account hijack

HBO Max Reddit Account Hijack: ClickFix Ads Push Windows and macOS Infostealers

Sep 16

5 min read

PivotC2 Turns an Old Fortinet Flaw Into a Fresh Intrusion Path

PivotC2 Turns an Old Fortinet Flaw Into a Fresh Intrusion Path

Sep 14

7 min read

F5 BIG-IP APM Rootkit How PoisonedRefresh Hides a Web Shell in Memory

F5 BIG-IP APM Rootkit: How PoisonedRefresh Hides a Web Shell in Memory

Sep 9

7 min read

PEEP Malware Turns Chrome and Edge Into Post-Compromise Backdoor

PEEP Malware Turns Chrome and Edge Into Post-Compromise Backdoors

Sep 8

7 min read

REVSTEALER

REVSTEALER, ProManager, WinUpdate, SoftManager and LockAppHost: How the Modules Put Windows at Risk

Sep 8

11 min read

cve 2026 14894

CVE-2026-14894: Super Forms, Elementor Pro RCE Under Attack

Sep 7

7 min read

ted backdoor

Ted Backdoor Hijacks HAProxy to Intercept Web Traffic

Sep 7

7 min read

Coder Registry Compromise Pushed Credential-Stealing Terraform Modules

Coder Registry Compromise Pushed Credential-Stealing Terraform Modules

Sep 4

9 min read

TWINLOOT Hides C2 in Microsoft 365 to Steal Credentials and Pivot Internally

TWINLOOT Hides C2 in Microsoft 365 to Steal Credentials and Pivot Internally

Sep 1

4 min read

papercut cve 2026 82078

PaperCut CVE-2026-82078: Second Emergency Patch After Attackers Broke the First Fix

Sep 1

6 min read

uat 10147

UAT-10147 Deploys SPECTRE Backdoor With EDR Bypass, Linux Rootkit

Aug 28

7 min read

Dysphoria Botnet Turns Weak Edge Devices Into DDoS and Proxy Infrastructure

Dysphoria Botnet Turns Weak Edge Devices Into DDoS and Proxy Infrastructure

Aug 20

6 min read

AI-powered-malware-lab

Sophos Discovers AI-Powered Malware Lab Targeting EDR

Aug 20

5 min read

ChocoPoC-malware

ChocoPoC Malware: Trojanized GitHub Exploits Target Security Researchers

Aug 19

4 min read

Veil-malware

Veil Malware: How Attackers Use Blogspot to Deliver Fileless Payloads

Aug 19

5 min read

Injective-SDK-npm-compromise

Injective SDK npm Compromise: Supply-Chain Attack Steals Wallet Keys

Aug 19

3 min read

Pass-ta-key

Pass-ta-key Attacks: Why Endpoint Security Still Matters in a Passkey World

Aug 19

3 min read

Shai-Hulud-PyPI-attack

New Shai-Hulud attack trojanizes 19 science-focused PyPI packages

Aug 19

5 min read

clickfix macos malware

ClickFix macOS Malware Steals Keychain Data, Drains Crypto

Aug 7

6 min read

Arch Linux AUR Malware Campaign Halts Package Adoption and Pushes

Arch Linux AUR Malware Campaign Halts Package Adoption and Pushes

Aug 3

8 min read

Fake Claude App Delivers SectopRAT Through Bing Ads

Fake Claude App Delivers SectopRAT Through Bing Ads: What Enterprises Need to Know

Jul 28

9 min read

UAC-0145 Uses ClickFix Against Windows Devices and COWARDDUCK Against Android

UAC-0145 Uses ClickFix Against Windows Devices and COWARDDUCK Against Android

Jul 28

6 min read

FakeGit Malware: How 7600 Fake GitHub Repositories Spread SmartLoader and StealC

FakeGit Malware: How 7,600 Fake GitHub Repositories Spread SmartLoader and StealC

Jul 27

6 min read

Dolphin X Malware AI-Powered Victim Ranking Raises Enterprise Endpoint Risk

Dolphin X Malware: AI-Powered Victim Ranking Raises Enterprise Endpoint Risk

Jul 27

5 min read

7-Zip RCE Bug Highlights the Hidden Cost of Manual App Updates

7-Zip RCE Bug Highlights the Hidden Cost of Manual App Updates

Jul 21

4 min read

okobot malware

OkoBot Malware Uses ClickFix and Fake GitHub Repositories

Jul 17

6 min read

fake github repositories

Fake GitHub Repositories Push BoryptGrab Infostealer: What Enterprises Should Know

Jul 15

6 min read

Nihon Kotsu Cyberattack Disrupts Japans Largest Taxi Operator After Malware Incident

Nihon Kotsu Cyberattack Disrupts Japan’s Largest Taxi Operator After Malware Incident

Jul 14

6 min read

Compromised-jscrambler-npm-Releases-Drop-Rust-Infostealer-During-Install-and-Runtime

Compromised jscrambler npm Releases Drop Rust Infostealer During Install and Runtime

Jul 14

5 min read

Microsoft Teams EtherRAT Phishing Uses Fake IT Support Calls to Deliver Malware

Microsoft Teams EtherRAT Phishing Uses Fake IT Support Calls to Deliver Malware

Jul 8

6 min read

Operation Navy Ghost Malicious PyPI Packages Backdoor Telegram Bot Server

Operation Navy Ghost: Malicious PyPI Packages Backdoor Telegram Bot Servers

Jul 1

5 min read

Edgecution Turns Microsoft Edge Native Messaging Into a Ransomware Access Bridge

Edgecution Turns Microsoft Edge Native Messaging Into a Ransomware Access Bridge

Jun 29

5 min read

WhatsApp Business Document Lures Install ManageEngine for Remote Access

WhatsApp Business Document Lures Install ManageEngine for Remote Access

Jun 25

5 min read

Rokarolla Android Trojan Combines Banking Overlays With Full Device Control

Rokarolla Android Trojan Combines Banking Overlays With Full Device Control

Jun 19

5 min read

USB LNK Worm Turns Clipboard Theft Into a Tor-Backed Windows Backdoor

USB LNK Worm Turns Clipboard Theft Into a Tor-Backed Windows Backdoor

Jun 19

5 min read

arch linux aur compromise

Arch Linux AUR Compromise Linked to Atomic Arch Supply-Chain Attack

Jun 17

6 min read

NFCShare Android Malware Uses Fake Banking Updates on GitHub to Steal Payment Cards

NFCShare Android Malware Uses Fake Banking Updates on GitHub to Steal Payment Cards

Jun 9

6 min read

magecart stripe abuse

Magecart Skimmer Abuses Stripe API and Google Tag Manager to Steal Checkout Data

Jun 9

6 min read