Cybersecurity Newsletter Weekly, Chrome 0-Day, 22.2 Tbps DDoS Attack & More
A rapid cascade of cyber events Chrome zero-day, a record DDoS, Cisco IOS exploit, and Kali Linux upgrade highlight how threat activity keeps accelerating.
Category: Malware
Read More
PlugX and Bookworm Deployed via DLL Side‑Loading in Targeted Cyber Espionage Campaign
A sophisticated cyber campaign used DLL side‑loading to deliver a hybrid PlugX variant and the Bookworm backdoor to telecom and ASEAN networks, revealing renewed tactics by China‑linked threat actors.
Weaponized “Microsoft Teams” Installer Delivers Oyster Backdoor via Poisoned Search Results
A targeted malvertising campaign redirected users from Bing to a fake Teams download site, where a signed MSTeamsSetup.exe installed the Oyster backdoor — blocked just in time by Microsoft Defender ASR.
LAMEHUG Malware Uses AI to Generate Commands and Steal Data
The new LAMEHUG malware uses AI models from Hugging Face to generate Windows commands dynamically. It spreads through phishing, disguises itself as AI apps, and steals system data, documents, and credentials while adapting to different environments.
New XCSSET macOS Malware Variant Targets Firefox with Clipper Module
A new XCSSET malware variant for macOS introduces a clipboard hijacker to steal cryptocurrency and expands to Firefox browser data theft. Security researchers warn developers to inspect Xcode projects and apply strong defenses against this evolving threat.
Rhysida Hackers Claim Attack on Maryland Department of Transportation
The Rhysida ransomware gang claims to have breached Maryland’s Department of Transportation, leaking personal data and demanding a $3.3 million ransom. Officials confirmed data loss affecting Maryland Transit Administration systems but said core services remain operational.
Fake Russian Antivirus App Exposed as Powerful Spyware
Cybersecurity researchers have exposed GuardCB, a fake Russian antivirus app that hides powerful spyware. The malware, known as Android.Backdoor.916.origin, can spy on calls, texts, passwords, and even live stream audio and video from infected devices. Targeting Russian businesses, the app pretends to run virus scans while secretly exfiltrating sensitive data.
NPM Package Malware Uses Steganographic QR Codes to Steal Data
Cybersecurity researchers have uncovered a new form of supply chain attack hidden within the npm ecosystem. A malicious npm package was discovered embedding malware inside steganographic QR codes, a technique designed to slip past traditional security defenses. The attack highlights growing risks in opensource software dependencies and developer tools How the Malware Works The compromised…
Exposed Docker Daemons Fuel ShadowV2 Botnet Attacks
A new cloud native botnet called ShadowV2 is taking aim at organizations worldwide. By abusing exposed Docker daemons and blending into legitimate cloud environments, the malware enables large scale distributed denial of service (DDoS) attacks while evading traditional defenses. With over 24,000 Docker instances exposed online, the potential for exploitation is significant What is ShadowV2?…