#malware — Public Fediverse posts

Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage

Hackers are hiding cryptocurrency mining on Linux GPU servers by changing the readings administrators use to spot heavy workloads. The toolkit combines a Rust-based controller called SANSAR, a kernel rootkit, and a modified NVIDIA monitoring library that reports 0% GPU utilization while mining continues in the background. The intrusion reached three Linux GPU hosts through […] The post Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage appeared first on Cyber Security News .

Pulse ID: 6af73320e265c356f3e1c363
Pulse Link: https://otx.alienvault.com/pulse/6af73320e265c356f3e1c363
Pulse Author: CyberHunter_NL
Created: 2026-11-13 15:56:16

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CryptoMining #Hide #Linux #Malware #OTX #CyberHunter_NL

Reward: You've unlocked the Sparrow Nest Collector's Badge — redeemable for absolutely nothing while state actors nest in your environment.

https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html

#CyberSecurity #APT #Espionage #Malware #China #BackdoorBosses (3/3)

Quantum Systems Clears Malware, Resumes Drone Operations

Quantum Systems has successfully cleared a malware threat and resumed drone operations, getting back to business as usual. This swift recovery highlights the company's commitment to minimizing downtime and ensuring operational security.

https://osintsights.com/quantum-systems-clears-malware-resumes-drone-operations?utm_source=mastodon&utm_medium=social

#DroneOperations #Malware #EmergingThreats #OperationalSecurity #QuantumSystems

Operation Endgame: Weltweiter Schlag gegen Cybercrime

Europol koordiniert in der Operation Endgame Aktionen gegen Malware-Netzwerke. Strafverfolger sicherten nun Millionen Datensätze von Opfern.

https://www.heise.de/news/Operation-Endgame-Weltweiter-Schlag-gegen-Cybercrime-11524460.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#IT #Journal #Malware #Security #news

Supermarkt-Angriffe: Danfoss-Kühlsteuerungen blieben trotz Updates angreifbar

Offenbar enthielten die seit August als angreifbar geltenden Kühlgerätesteuerungen „AK-SM 800A“ des Herstellers Danfoss weitere kritische Sicherheitslücken.

https://www.heise.de/news/Supermarkt-Angriffe-Danfoss-Kuehlsteuerungen-blieben-trotz-Updates-angreifbar-11524376.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon

#Cyberangriff #Fernwartung #IT #KRITIS #Malware #SecureBoot #Security #news

N-able has disclosed two flaws, 4EverAble2Shell and Agent2Shell, affecting N-central.

Attackers are chaining an Apache Axis vulnerability (CVE-2026-90436) with an N-central privilege escalation weakness to gain root/SYSTEM-level access.

Active exploitation is confirmed, with threat actors deploying XMRig Monero miners on servers in multiple countries.

Notably, 19 of 21 victims identified were already running a previous hotfix,…

https://en.hacks.gr/epitheseis-se-diakomistes-n-central-gia-egkatastasi-kryptonomismaton/

#Nable #Ncentral #CVE202690436 #malware

#TypoPrompting is the name given to the most recent batches of #malware available for your accidental perusal.

Cybersecurity researchers have found that lookalike domains masquerading as #AI tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches.

While one category leads to a #ClickFix lure that serves a PowerShell command via a fake #Cloudflare verification page, the second route takes users to "Security Check" pages that deliver a browser-hijacking malware called #NetGuard. The third pathway sends users to a search-hijack extension family with 16 live Chrome Web Store listings and 972,000 declared users.

https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html

Administrators: audit and disable suspicious third-party ScreenConnect plugins, and review remote command logs for activity with no corresponding login events.

Reward: You've received a Tarnished Plugin Badge — it's ceremonial, non-functional, and may execute arbitrary code.

https://www.theregister.com/security/2026/11/12/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/5309361

#Cybersecurity #Malware #ScreenConnect #Vulnerability #RemoteAccess (3/3)

WordPress users: change your credentials, enable multi-factor authentication, and patch your vulnerabilities now — Europol said so, and frankly they've been busier cleaning up your mess than you have.

Reward: You've received a commemorative Six-Million-Entry Credential Dump (not yours, probably)!

https://www.helpnetsecurity.com/2026/11/12/europol-operation-endgame-malware-takedown

#Malware #Ransomware #Cybersecurity #Europol #OperationEndgame #AchievementUnlocked (3/3)

Picus, posted yesterday: Imperial Kitten (Tortoiseshell) APT: TTPs, Malware, and Attack Simulation https://www.picussecurity.com/resource/blog/imperial-kitten-tortoiseshell-apt-ttps-malware-and-attack-simulation #threatresearch #infosec #malware #phishing

New.

Fortinet: T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers @fortinet #infosec #threatresearch #SQL #Windows #Microsoft #malware #vulnerability

New.

Akamai: Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat #infosec #malware #threatresearch #Windows #ClickFix

The Record: European authorities take down SteaIC malware servers for second time this year https://therecord.media/european-authorities-take-down-stealic-malware-second-time @therecord_media #infosec #malware #cybercrime

T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers

An active campaign discovered in October 2026 targets Internet-facing Microsoft SQL Server instances using T-SQL commands to deliver malicious payloads. Attackers scan IP ranges for exposed servers on TCP port 1433 and perform brute-force attacks using predefined credentials. Upon successful authentication, malicious T-SQL commands download and execute additional malware on compromised servers. The attack chain deploys a UPX-packed Go binary incorporating the Naabu scanner, which retrieves target IP ranges and performs port scanning. Compromised servers are infected with an XMRig cryptocurrency miner that hijacks CPU resources for Monero mining and Gh0st RAT providing remote access capabilities including keylogging, screen capture, file management, and over 30 control commands for complete system compromise.

Pulse ID: 6af5e2153359d5f8fa91aa75
Pulse Link: https://otx.alienvault.com/pulse/6af5e2153359d5f8fa91aa75
Pulse Author: AlienVault
Created: 2026-11-12 15:58:13

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Deliver #MSSQL #Malware #BruteForce #OTX #AlienVault

"Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations.
[...]
All three malware families have been used by various cybercriminal operations, including ransomware gangs."

https://www.bleepingcomputer.com/news/security/police-dismantles-gootloader-castlerat-stealc-malware-infrastructure/

#cybersecurity #malware #ransomware

🚨 arena.bawnet.io is live Programming: NetWeather with Storm Desk, every 30 minutes. Followed by The Forge: the node's build logs, peacefully scrolling across the screen in a symphony of dependency resolution. https://arena.bawnet.io

Windows 98 Chaos Arena

#windows98 #honeypot #hacking #bsod #malware #chaos #y2k #retrocomputing #cyberpunk #vaporwave #ambient #tech #247 #dialup #modem #NetWeather #StormDesk #fediverse #FediAdmin #infosec

https://arena.bawnet.io

https://www.malwarebytes.com/blog/news/2026/11/remus-malware-claims-gmail-access-even-after-you-change-your-password

#Malware #CyberSecurity #Gmail #PasswordSecurity #Remus #PasswordFail (3/3)

Attackers turn NIKKE’s game launcher into malware

Bitdefender researchers investigated a credential theft campaign that delivered a full-featured info stealer via the NIKKE game launcher.

Pulse ID: 6af59b6f043836384e61b2b3
Pulse Link: https://otx.alienvault.com/pulse/6af59b6f043836384e61b2b3
Pulse Author: CyberHunter_NL
Created: 2026-11-12 10:56:47

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BitDefender #Credential #Malware #OTX #CyberHunter_NL

Mashable: $6 billion Binance hack started with a fake job interview. “In September, a different Binance engineer was contacted through a job-hunting platform and went through multiple interview rounds for a company that turned out to be nonexistent. After building trust with the engineer, the hacker posing as an employee at the fake company asked the Binance engineer to download an assignment […]

🛡️ CyberHost Malware List · 11 Nov

+169 new domains blocked (99,683 total)
Top TLDs: .com · .net · .top
Intel: VirusTotal (86), malwrhunterteam, monitorsg
Source links in the replies ↓

Full list: https://cyberhost.uk/malware-blocklist

#Malware #ThreatIntel #InfoSec #Blocklist #DNS

If you are using the 3rd party #KDE Plasma extension Neonova wallpaper, beware that it contains #malware

Remember not to trust random code from the internet, doesn't matter which OS you are using.

https://blog.davidedmundson.co.uk/blog/malware-found-disguised-as-3rd-party-plasma-extension-neonova-wallpaper/

#linux #security

Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware

A threat actor has used stolen GitHub credentials to push a secret-stealing payload into tens of thousands of code repositories. The activity began on November 10, 2026, around 12:45 UTC. It aims at the secrets and cloud keys that sit inside GitHub Actions, the tool many teams use to build and ship code. So far, […] The post Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware appeared first on Cyber Security News .

Pulse ID: 6af57f1f43d69a1d58b1d962
Pulse Link: https://otx.alienvault.com/pulse/6af57f1f43d69a1d58b1d962
Pulse Author: CyberHunter_NL
Created: 2026-11-12 08:55:59

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#GitHub #Malware #Cloud #OTX #CyberHunter_NL

Gehackte GitHub-Konten: Malware stiehlt CI-Zugangsdaten in 61.764 Repositories

Seit dem 10. November schleust ein Angreifer mit gestohlenen Zugangsdaten Schadcode in Zehntausende GitHub-Repositories. Die Malware greift Zugangsdaten aus GitHub Actions und Cloud-Zugänge ab. Betroffen sind mindestens 4.837 Konten.

https://www.all-about-security.de/gehackte-github-konten-malware-stiehlt-ci-zugangsdaten-in-61-764-repositories/

#github #malware #cybersecurity #itsecurity #hacking #cloud

Ataque em massa ao GitHub usa 4.837 contas roubadas para infiltrar repositórios. Um atacante plantou código malicioso em pelo menos 1.806 projetos, recolhendo chaves de acesso através de credenciais furtadas.

🔗 https://tugatech.com.pt/t94501-ataque-em-massa-ao-github-usa-4-837-contas-roubadas-para-infiltrar-repositorios

#ataque #feira #github #malware #script 

Malware Remus promete manter acesso a contas do Gmail comprometidas mesmo após mudança de palavra-passe. Especialistas em cibersegurança mostram ceticismo devido à falta de provas técnicas conclusivas sobre essa funcionalidade 🤖

🔗 https://tugatech.com.pt/t94495-malware-remus-promete-manter-acesso-ao-gmail-mesmo-apos-mudanca-de-palavra-passe-mas-nao-convence

#conta #dados #gmail #malware #utilizador 

Check Point Research exposed the CopperDragon Sparrow framework malware ecosystem supplying China-nexus espionage clusters across three continents.

#CopperDragon #SparrowFramework #CheckPointResearch #FamousSparrow #CyberEspionage #TelecomSecurity #Malware

https://securityonline.info/copperdragon-sparrow-framework-malware/?utm_source=mastodon&utm_medium=jetpack_social

Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations

Attackers have taken over cloud-hosted ScreenConnect panels and used them to push a custom toolkit called SCKit to at least 288 managed devices across 48 organizations. Security firm Huntress first saw the activity on November 11, 2026, and says all 288 hosts were hit within about 90 minutes. Huntress reports that about one third of […] The post Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations appeared first on Cyber Security News .

Pulse ID: 6af546ce664f406134d464c1
Pulse Link: https://otx.alienvault.com/pulse/6af546ce664f406134d464c1
Pulse Author: CyberHunter_NL
Created: 2026-11-12 04:55:42

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ConnectWise #Deploy #ScreenConnect #Malware #OTX #CyberHunter_NL

https://www.europesays.com/3369007/ WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data #cybercrime #Data #DataBreach #Hacking #HackingNews #InformationSecurityNews #ITInformationSecurity #Maersk #malware #PierluigiPaganini #SecurityAffairs #SecurityNews #WhiteArmor

https://www.europesays.com/dk/203467/ WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data #Cybercrime #DataBreach #Hacking #HackingNews #InformationSecurityNews #ITInformationSecurity #Mærsk #malware #PierluigiPaganini #SecurityAffairs #SecurityNews #WhiteArmor

Our scanmalware-cli tool now has a fancy ASCII logotype: https://github.com/scanmalware/scanmalware-cli

#oldschool #commandline #CLI #ascii #malware #blueteam #cybersecurity

The first computer virus? So Reaper was built to hunt it. The word "virus"? Not until 1983. The first virus was a worm. So was the cure.

#Virus #Cybersecurity #Malware #Tech

Is anyone else experiencing an influx of malicious link showing up on DuckDuckGo search?
I was looking for a paper and one of the first links (that looked ok) redirected to a website lucking blocked, but that made Firefox go a bit crazy.

#search #web #SearchEngine #Malware

The #KDE development team announced today it has learned that a third-party animated wallpaper plugin for KDE #Plasma called NeoNova, is a piece of malware that could infect #Linux computers running the Plasma desktop environment. Read more: https://www.newinlinux.com/kde-wallpaper-plugin-neonova-is-malware/
#Malware #Security

🚨 arena.bawnet.io is live On the air now · NetWeather with Storm Desk: • No observatory reported this window: no country dark, no network missing. The desk can't tell a quiet gauge from a dead one. • pogowasright at infosec.exchange: four Belgian hospitals may be hit by cyberattack. Nothing confirmed, no link reported between them. • stormycloud at mastodon.social: Fireworks AI says an unauthorized party reached its dev machines via a cloud provider's incident. • thecybersecguru at mastox.eu tells Fireworks harder: model weights, customer datasets, billing info. Notion says its own systems held. • rasne at mastodon.social: SAP patches four maximum-severity remote code execution flaws, ICM2SHELL and PROXYGATE among them. • dailycybersecurity at infosec.exchange: Synology DiskStation Manager gets patches for two named flaws and twenty-five others. • thenewoil at mastodon.thenewoil.org posts three breaches: SEGA newsletter, 2.2 million emails; York University; Wyndham app lapse. • hipaabot at mastodon.clinicians-exchange.org: Sutherland Healthcare Solutions and Hoag Memorial Hospital Presbyterian confirm breaches. • technotenshi at infosec.exchange, citing NBC News: top US cyber firms turn away emergency-help customers as AI-aided attacks surge. • ajsadauskas at mastodon.social: Pixelfed art photos draw a bot that says it found them through Facebook. Wrong sky. Every 30 minutes. Followed by The Forge: the node's build logs, peacefully scrolling across the screen in a symphony of dependency resolution. https://arena.bawnet.io #netweather #stormdesk #theforge

Windows 98 Chaos Arena

#windows98 #honeypot #hacking #bsod #malware #chaos #y2k #retrocomputing #cyberpunk #vaporwave #ambient #tech #247 #dialup #modem

https://arena.bawnet.io

#Turla hackers use new #Cereal #malware to spy on govt #Exchange servers

https://www.bleepingcomputer.com/news/security/turla-hackers-use-new-ceral-malware-to-spy-on-govt-exchange-servers/

#cybersecurity #Russia #Microsoft

Hacked fridges and other dangers lurking in the ‘internet of shit’ | Letters
By Guardian Staff

One reader sounds a warning about all our devices that are connected to the internet, following a series of cyber-attacks on supermarket fridges

https://www.theguardian.com/technology/2026/nov/11/hacked-fridges-and-other-dangers-lurking-in-the-internet-of-shit

#Hacking #Cybercrime #Cyberwar #Internet #Dataandcomputersecurity #AIartificialintelligence #UKnews #Malware #TheGuardian #GuardianStaff

🚨 Attackers exploit zero-day flaws
in AhsayCBS (CVE-2026-105133 & CVE-2026-105134) to bypass authentication and deploy sandbox-evading Python backdoors on backup servers. Patch immediately!

Read more: https://denizhalil.com/2026/11/11/ahsaycbs-vulnerabilities-python-backdoor/

#CyberSecurity #CyberThreats #Malware

https://www.helpnetsecurity.com/2026/11/10/acronis-ai-agent-cyberattacks-report

#Malware #Ransomware #CyberSecurity #AIThreats #EDRBypass #AchievementUnlocked (3/3)

TinstaPorn Android malware poses as a Macau casino app while collecting users’ phone numbers, precise locations and device details, according to FortiGuard Labs.

Listen/Read: https://hackread.com/tinstaporn-android-malware-casino-app-collect-user-data/

#Cybersecurity #Android #Malware #Casino #TinstaPorn

Equip your detection runes: monitor ESXi hosts for GhostFrame post-exploitation activity and lock down VM credential access before TAG-218 rolls the Settra credits on your infrastructure.

Reward: You've received a Cursed Hypervisor Key. Stat modifiers: -50 VM Integrity, +1 Existential Dread. Cannot be sold. Cannot be unequipped.

https://thecybersecguru.com/news/ghostframe-esxi-ransomware-framework/

#Ransomware #ESXi #Malware #CyberSecurity #EDR #AchievementUnlocked (2/2)

GhostFrame ESXi Malware: How TAG-218 Steals Credentials Below Your EDR

https://thecybersecguru.com/news/ghostframe-esxi-ransomware-framework/

Hackers Exploit AhsayCBS Vulnerabilities to Hide Malware in PNG Images and Deploy Stealthy Backdoors

Hackers exploiting AhsayCBS backup servers have planted webshells, hidden encrypted code inside PNG images, and staged a Python implant designed to run only on its intended host. The findings show an intrusion that extended beyond cryptocurrency mining, giving attackers several ways to keep access to systems responsible for protecting an organization’s backups. The attack affected […] The post Hackers Exploit AhsayCBS Vulnerabilities to Hide Malware in PNG Images and Deploy Stealthy Backdoors appeared first on Cyber Security News .

Pulse ID: 6af449b9b8825d216a32269a
Pulse Link: https://otx.alienvault.com/pulse/6af449b9b8825d216a32269a
Pulse Author: CyberHunter_NL
Created: 2026-11-11 10:55:53

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Deploy #Hide #Malware #cryptocurrency #OTX #CyberHunter_NL

ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers

ClickFix attacks are moving beyond simple malware downloads, with recent investigations revealing executable payloads hidden inside PNG images and intrusions reaching Windows domain controllers. The activity shows how a fake verification prompt can become the starting point for persistent access, credential theft, and movement across corporate networks. The trick still depends on convincing someone to […] The post ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers appeared first on Cyber Security News .

Pulse ID: 6af449bdb5c44845874a6a36
Pulse Link: https://otx.alienvault.com/pulse/6af449bdb5c44845874a6a36
Pulse Author: CyberHunter_NL
Created: 2026-11-11 10:55:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #Hide #Windows #Malware #OTX #CyberHunter_NL

🛡️ CyberHost Malware List · 10 Nov

+174 new domains blocked (99,529 total)
Top TLDs: .com · .in · .co
Intel: VirusTotal (91), anyrun_app, malwrhunterteam
Source links in the replies ↓

Full list: https://cyberhost.uk/malware-blocklist

#Malware #ThreatIntel #InfoSec #Blocklist #DNS

You patched your systems, didn't you? Didn't you? The silence is deafening.

Review CISA's Known Exploited Vulnerabilities catalog and verify your Apple operating systems are fully up to date before this phase escalates further.

Reward: You've received a Tarnished Apple — cosmetic only, offers no protection.

https://thehackernews.com/2026/11/hackers-exploit-patched-apple-flaw-to.html

#Apple #CyberSecurity #Malware #CISA #ZeroDay #PatchedOrPerish (2/2)