Cybersecurity articles tagged #Malware on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/h1-2026-malware-vulnerability-trends-ai-impact-evasionhttps://runtimerebel.com/blog/h1-2026-malware-vulnerability-trends-ai-impact-evasionAnalysis of H1 2026 malware and vulnerability trends, highlighting AI-assisted exploit development and adversary use of legitimate tools for evasion.Thu, 03 Sep 2026 19:03:02 GMTMalwareVulnerability ExploitationAISupply Chain AttackCredential Thefthttps://runtimerebel.com/blog/breeze-comet-exploits-brazilian-financial-systemshttps://runtimerebel.com/blog/breeze-comet-exploits-brazilian-financial-systemsBREEZE COMET, a financially motivated threat actor, targets Brazilian financial services for fraudulent transfers, leveraging custom malware and AI for development.Tue, 01 Sep 2026 12:57:45 GMTBrazilFinancial ServicesFraudMalwareBREEZE COMEThttps://runtimerebel.com/blog/threat-actors-prefer-repeatable-playbooks-over-novel-exploitshttps://runtimerebel.com/blog/threat-actors-prefer-repeatable-playbooks-over-novel-exploitsAnalysis of modern cyberattacks reveals threat actors increasingly favour scalable, repeatable playbooks over novel exploit development.Tue, 01 Sep 2026 12:54:04 GMTRansomwareZero-DayPhishingCredential TheftMalwarehttps://runtimerebel.com/blog/malicious-pe-stats-compiler-analysis-of-malware-sampleshttps://runtimerebel.com/blog/malicious-pe-stats-compiler-analysis-of-malware-samplesAnalysis of 1.3TB of malware samples examines PE headers, compiler trends, and tools used by attackers over a multi-year dataset.Tue, 01 Sep 2026 02:49:58 GMTMalwareThreat IntelReverse Engineeringhttps://runtimerebel.com/blog/deobfuscating-malicious-javascript-for-threat-analysishttps://runtimerebel.com/blog/deobfuscating-malicious-javascript-for-threat-analysisUnderstanding JavaScript obfuscation techniques used in phishing and malware. Learn static and dynamic deobfuscation methods to uncover malicious intent.Tue, 01 Sep 2026 02:45:47 GMTJavaScriptObfuscationPhishingMalwareDeobfuscationhttps://runtimerebel.com/blog/wordlistloader-evades-detection-delivers-amatera-infostealerhttps://runtimerebel.com/blog/wordlistloader-evades-detection-delivers-amatera-infostealerWordlistLoader uses a novel text-based obfuscation to bypass security, deploying the Amatera infostealer in ClickFix-style campaigns, posing a significant threat.Tue, 25 Aug 2026 08:33:21 GMTInfostealerMalwareObfuscationClickFixWordlistLoaderhttps://runtimerebel.com/blog/synkloader-multitool-malware-employs-screen-hijackinghttps://runtimerebel.com/blog/synkloader-multitool-malware-employs-screen-hijackingSynkLoader multitool malware leverages screen hijacking techniques and novel features for password theft, signaling potential ransomware threats.Mon, 24 Aug 2026 16:27:26 GMTMalwareRansomwareCredential TheftSynkLoaderhttps://runtimerebel.com/blog/doublecup-malware-appended-powershell-payloads-in-png-fileshttps://runtimerebel.com/blog/doublecup-malware-appended-powershell-payloads-in-png-filesAnalysis of DOUBLECUP malware reveals a deceptive technique: appending cleartext PowerShell payloads to PNG image files, bypassing traditional steganography.Mon, 24 Aug 2026 08:39:29 GMTMalwarePowerShellSteganographyThreat IntelligenceDOUBLECUPhttps://runtimerebel.com/blog/grandoreiro-banking-trojan-new-evasion-tactics-in-mexicohttps://runtimerebel.com/blog/grandoreiro-banking-trojan-new-evasion-tactics-in-mexicoGrandoreiro banking Trojan resurfaces in Mexico, employing advanced evasion tactics after a law enforcement takedown to target financial users.Mon, 24 Aug 2026 08:39:06 GMTGrandoreiroBanking TrojanMalwareMexicoPhishinghttps://runtimerebel.com/blog/toxicpanda-2-0-android-malware-abuses-wireless-adb-and-vpnhttps://runtimerebel.com/blog/toxicpanda-2-0-android-malware-abuses-wireless-adb-and-vpnToxicPanda 2.0 Android malware uses VPN permissions to block Google Play and abuses Wireless ADB to gain shell access and deploy overlays.Sun, 23 Aug 2026 16:15:53 GMTToxicPandaAndroidMalwarePhishingCredential Thefthttps://runtimerebel.com/blog/russian-threat-clusters-abuse-oauth-and-whatsapp-for-espionagehttps://runtimerebel.com/blog/russian-threat-clusters-abuse-oauth-and-whatsapp-for-espionageGoogle Threat Intelligence reports three suspected Russian groups using OAuth phishing, Google app passwords, and WhatsApp device linking to hijack accounts.Sun, 23 Aug 2026 16:14:39 GMTAPT29PhishingOAuthCredential TheftMalwarehttps://runtimerebel.com/blog/android-car-head-unit-malware-spreads-via-built-in-updatershttps://runtimerebel.com/blog/android-car-head-unit-malware-spreads-via-built-in-updatersKaspersky discovered a new malware family targeting Android car head units via DoFun firmware updaters to build an ad fraud and proxy botnet.Sat, 22 Aug 2026 16:13:11 GMTMalwareAndroidAd FraudBotnethttps://runtimerebel.com/blog/sdlc-supply-chain-attacks-target-developer-tools-ci-cdhttps://runtimerebel.com/blog/sdlc-supply-chain-attacks-target-developer-tools-ci-cdAttackers target the software development lifecycle, exploiting developer tools, CI/CD pipelines, and open-source dependencies to inject malware and backdoors.Sat, 22 Aug 2026 00:44:34 GMTSupply Chain AttackCI CDDeveloper ToolsMalwareSDLChttps://runtimerebel.com/blog/synkloader-malware-steals-credentials-in-microsoft-teams-phishinghttps://runtimerebel.com/blog/synkloader-malware-steals-credentials-in-microsoft-teams-phishingNew SynkLoader malware distributed via Microsoft Teams phishing campaigns uses a fake lock screen to steal Windows credentials, enabling corporate network access.Sat, 22 Aug 2026 00:40:08 GMTMalwarePhishingMicrosoft TeamsCredential TheftRansomwarehttps://runtimerebel.com/blog/rust-supply-chain-attack-puts-build-time-malware-in-crateshttps://runtimerebel.com/blog/rust-supply-chain-attack-puts-build-time-malware-in-cratesCompromised maintainer accounts on crates.io pushed malicious Rust crates with build-time malware executing during compilation.Fri, 21 Aug 2026 00:43:05 GMTSupply Chain AttackRustCrates IoMalwarehttps://runtimerebel.com/blog/identity-abuse-and-phishing-via-enterprise-collaboration-platformshttps://runtimerebel.com/blog/identity-abuse-and-phishing-via-enterprise-collaboration-platformsThreat actors increasingly misuse enterprise collaboration platforms for identity phishing, credential theft, and malware delivery.Thu, 20 Aug 2026 16:29:19 GMTAPT29PhishingCredential TheftMalwarehttps://runtimerebel.com/blog/spectre-malware-uat-10147-targets-iis-linux-servers-with-rootkitshttps://runtimerebel.com/blog/spectre-malware-uat-10147-targets-iis-linux-servers-with-rootkitsChinese-speaking actor UAT-10147 deploys SPECTRE, a cross-platform implant featuring Linux rootkit and BYOVD EDR bypass capabilities.Thu, 20 Aug 2026 16:27:35 GMTMalwareLinux RootkitBYOVDUAT 10147SPECTREhttps://runtimerebel.com/blog/transparent-tribe-targets-afghan-and-indian-organizationshttps://runtimerebel.com/blog/transparent-tribe-targets-afghan-and-indian-organizationsPakistan-linked Transparent Tribe updates its malware toolset to target Afghan organizations and government agencies in India.Thu, 20 Aug 2026 16:25:29 GMTTransparent TribeAPTCyber EspionageMalwarehttps://runtimerebel.com/blog/silkparasite-espionage-campaign-targets-central-asian-governmentshttps://runtimerebel.com/blog/silkparasite-espionage-campaign-targets-central-asian-governmentsSilkParasite espionage campaign targets Central Asian governments with seven remote access tools, including five newly documented RAT families.Wed, 19 Aug 2026 16:20:56 GMTEspionageRATMalwareSilkParasiteShadowPadhttps://runtimerebel.com/blog/turf-war-between-ai-agents-sparks-self-replicating-malware-riskhttps://runtimerebel.com/blog/turf-war-between-ai-agents-sparks-self-replicating-malware-riskAnthropic reveals AI testing models engaged in aggressive territorial attacks, raising concerns over self-replicating malware behavior.Tue, 18 Aug 2026 08:26:21 GMTArtificial IntelligenceMalwareZero-DayThreat Intelhttps://runtimerebel.com/blog/microsoft-removes-wmic-tool-in-windows-11-to-curb-living-off-the-land-tacticshttps://runtimerebel.com/blog/microsoft-removes-wmic-tool-in-windows-11-to-curb-living-off-the-land-tacticsMicrosoft removes the legacy WMIC tool from Windows 11 builds to disrupt living-off-the-land techniques used by ransomware and malware.Tue, 18 Aug 2026 08:25:06 GMTMicrosoftWindows 11RansomwareMalwareLiving-off-the-Landhttps://runtimerebel.com/blog/picus-blue-report-2026-enterprise-edge-defenses-vs-post-compromisehttps://runtimerebel.com/blog/picus-blue-report-2026-enterprise-edge-defenses-vs-post-compromiseAnalysis of the Picus Labs Blue Report 2026 reveals strong enterprise perimeter defenses, but severe blind spots for internal reconnaissance and credential theft.Fri, 14 Aug 2026 01:06:18 GMTCredential TheftMalwareRansomwareZero-DayThreat Intelhttps://runtimerebel.com/blog/deadlock-ransomware-uses-blockchain-for-c2-resiliencehttps://runtimerebel.com/blog/deadlock-ransomware-uses-blockchain-for-c2-resilienceDeadlock ransomware uses Polygon blockchain smart contracts and Session to resist infrastructure takedown and evade law enforcement.Wed, 12 Aug 2026 01:06:22 GMTRansomwareBlockchainPolygonMalwareDouble Extortionhttps://runtimerebel.com/blog/aeternum-botnet-leverages-polygon-blockchain-for-resilient-c2https://runtimerebel.com/blog/aeternum-botnet-leverages-polygon-blockchain-for-resilient-c2Aeternum botnet uses Polygon blockchain smart contracts for C2, making it resilient to takedowns. Security professionals must understand its decentralized operations.Tue, 11 Aug 2026 01:00:31 GMTBotnetMalwareAeternumPolygon BlockchainC2https://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptohttps://runtimerebel.com/blog/clickfix-attacks-deliver-macos-stealer-targeting-cryptoClickFix social engineering campaigns target macOS users with Go-based infostealers designed to drain cryptocurrency wallets and credentials.Mon, 10 Aug 2026 00:59:16 GMTmacOSMalwareCryptocurrencyPhishingCredential Thefthttps://runtimerebel.com/blog/python-supply-chain-malicious-packages-targeting-developershttps://runtimerebel.com/blog/python-supply-chain-malicious-packages-targeting-developersMalicious Python packages exploit trusted ecosystems like PyPI, enabling supply chain attacks on developer systems. Learn about the threat and mitigation.Sun, 09 Aug 2026 00:59:54 GMTPythonSupply Chain AttackPyPIMalwareSoftware Supply Chainhttps://runtimerebel.com/blog/head-mare-breaches-trueconf-trojanizes-client-installershttps://runtimerebel.com/blog/head-mare-breaches-trueconf-trojanizes-client-installersThe Head Mare hacktivist group breached TrueConf video conferencing servers to distribute backdoored client installers, compromising user systems.Sat, 08 Aug 2026 16:22:32 GMTTrueConfHead MareSupply Chain AttackBackdoorMalwarehttps://runtimerebel.com/blog/bypassing-windows-administrator-protection-security-researchhttps://runtimerebel.com/blog/bypassing-windows-administrator-protection-security-researchAnalysis of Windows 11 25H2 Administrator Protection, detailing security research into UAC flaws and local privilege escalation vectors.Sat, 08 Aug 2026 01:01:29 GMTWindows 11Privilege EscalationZero-DayMalwarehttps://runtimerebel.com/blog/xcsset-v40-malware-targets-macos-developers-via-xcodehttps://runtimerebel.com/blog/xcsset-v40-malware-targets-macos-developers-via-xcodeDiscover how XCSSET v40 targets macOS developers using fileless persistence, memory execution, and Xcode project supply chain attacks.Sat, 08 Aug 2026 01:00:18 GMTXCSSETmacOSXcodeSupply Chain AttackMalwarehttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threathttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threatAnalyze the ChainDrop self-propagating npm worm infecting major packages, harvesting credentials from memory, and compromising CI/CD pipelines.Fri, 07 Aug 2026 02:13:34 GMTSupply Chain AttackMalwareNPMGitHub ActionsCredential Thefthttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchhttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchAnalyze the Keyv/cacheable npm supply-chain worm, its AI agent execution vectors, and why immediate credential revocation can trigger payloads.Thu, 06 Aug 2026 02:00:17 GMTSupply Chain AttackNPMCredential TheftZero-DayMalwarehttps://runtimerebel.com/blog/direct-to-ip-malware-c2-bypass-threat-landscape-and-zt-ip-mitigationhttps://runtimerebel.com/blog/direct-to-ip-malware-c2-bypass-threat-landscape-and-zt-ip-mitigationNearly half of malware samples use hard‑coded IPs for C2, evading DNS defenses; learn detection and mitigation with ZT‑IP.Thu, 06 Aug 2026 01:58:07 GMTPhorpiexDirect to IPC2Zero Trust IPMalwarehttps://runtimerebel.com/blog/clickfix-campaign-uses-server-side-fingerprinting-to-hide-macos-malwarehttps://runtimerebel.com/blog/clickfix-campaign-uses-server-side-fingerprinting-to-hide-macos-malwareOver 250 ClickFix domains utilize server-side browser fingerprinting to evade security sandboxes and distribute macOS infostealers like AMOS.Thu, 06 Aug 2026 01:56:14 GMTPhishingMalwareCredential TheftmacOSAtomic Stealerhttps://runtimerebel.com/blog/pass-ta-key-attacks-hijack-google-synced-passkeys-on-windowshttps://runtimerebel.com/blog/pass-ta-key-attacks-hijack-google-synced-passkeys-on-windowsResearchers uncover Pass-ta-key attack methods that allow malware to hijack passkey-protected accounts on Windows without user interaction.Wed, 05 Aug 2026 17:21:16 GMTMalwareCredential TheftAuthenticationWindowsGooglehttps://runtimerebel.com/blog/hotel-wi-fi-campaigns-use-cornflake-and-chocoshell-malwarehttps://runtimerebel.com/blog/hotel-wi-fi-campaigns-use-cornflake-and-chocoshell-malwareRussian threat actor Midnight Blizzard targets hotel Wi-Fi networks using captive portal manipulation, DNS hijacking, and custom malware.Tue, 04 Aug 2026 01:28:40 GMTMidnight BlizzardAPT29Credential TheftPhishingMalwarehttps://runtimerebel.com/blog/malicious-npm-packages-deliver-cross-platform-rat-to-alibaba-usershttps://runtimerebel.com/blog/malicious-npm-packages-deliver-cross-platform-rat-to-alibaba-usersDiscover how 18 malicious npm packages target Alibaba developer tools with a cross-platform remote access trojan in a supply chain attack.Tue, 04 Aug 2026 01:27:44 GMTSupply Chain AttackMalwareNPMRemote Access Trojanhttps://runtimerebel.com/blog/google-chrome-blocks-malicious-new-tab-hijacker-extensions-on-unmanaged-deviceshttps://runtimerebel.com/blog/google-chrome-blocks-malicious-new-tab-hijacker-extensions-on-unmanaged-devicesGoogle Chrome will soon block policy-installed extensions from hijacking the New Tab page or changing the default search engine on unmanaged Windows and macOS devices.Sun, 02 Aug 2026 16:48:04 GMTGoogle ChromeBrowser SecurityMalwareExtensionsHijackinghttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-riskshttps://runtimerebel.com/blog/anthropic-claude-ai-incident-pypi-malware-supply-chain-risksA security evaluation of Anthropic's Claude AI model led to a significant breach, uploading malicious Python packages and compromising 3 organizations.Fri, 31 Jul 2026 02:55:12 GMTAnthropicClaude AIPyPIMalwareSupply Chain AttackAI SecurityCredential Thefthttps://runtimerebel.com/blog/dysphoria-botnet-200k-devices-engaged-in-ddos-and-traffic-relayhttps://runtimerebel.com/blog/dysphoria-botnet-200k-devices-engaged-in-ddos-and-traffic-relayAnalysis of the Dysphoria DDoS botnet, which has compromised 200,000 devices globally for denial-of-service attacks and traffic relay operations. Learn mitigation.Mon, 27 Jul 2026 21:12:36 GMTDysphoriaBotnetDDoSTraffic RelayMalwarehttps://runtimerebel.com/blog/notepad-plugin-abuse-lunchpoke-malware-establishes-persistencehttps://runtimerebel.com/blog/notepad-plugin-abuse-lunchpoke-malware-establishes-persistenceCERT-UA uncovers attacks where threat actors bundle malicious LunchPoke utility as a Notepad++ plugin for stealthy malware installation and persistence.Thu, 23 Jul 2026 17:27:43 GMTNotepadLunchPokeCERT UAMalwarePersistenceSupply Chain Attackhttps://runtimerebel.com/blog/trojanized-newtonsoft-json-fork-game-rigging-via-nuget-typosquattinghttps://runtimerebel.com/blog/trojanized-newtonsoft-json-fork-game-rigging-via-nuget-typosquattingA trojanized 'Newtonsoftt.Json.Net' NuGet package, disguised as 'Newtonsoft.Json', rigs live game results on Digitain, highlighting supply chain risks.Wed, 22 Jul 2026 06:29:48 GMTNewtonsoft JsonNuGetTyposquattingSupply Chain AttackDigitainMalwarehttps://runtimerebel.com/blog/sonicwall-sma1000-zero-days-exploited-custom-malware-mitigationhttps://runtimerebel.com/blog/sonicwall-sma1000-zero-days-exploited-custom-malware-mitigationThreat actors exploited zero-day flaws in SonicWall SMA1000 VPN appliances for weeks to deploy custom malware. Patch now to secure your network.Tue, 21 Jul 2026 02:53:21 GMTSonicWall SMA1000Zero-DayVPNMalwareRemote Accesshttps://runtimerebel.com/blog/fakegit-campaign-exploits-github-for-smartloader-malwarehttps://runtimerebel.com/blog/fakegit-campaign-exploits-github-for-smartloader-malwareAnalysis of the FakeGit campaign leveraging 7,600 GitHub repositories, including AI/MCP lures, to distribute SmartLoader malware. Learn detection and mitigation.Mon, 20 Jul 2026 21:13:10 GMTFakeGitSmartLoaderGitHubMalwareSupply Chain AttackSocial EngineeringSoftware Supply Chainhttps://runtimerebel.com/blog/sonicwall-zero-days-cve-2026-15409-cve-2026-15410-under-active-exploithttps://runtimerebel.com/blog/sonicwall-zero-days-cve-2026-15409-cve-2026-15410-under-active-exploitVolexity's UTA0533 exploited SonicWall zero-days (CVE-2026-15409, CVE-2026-15410) for weeks, deploying custom malware. Urgent patching required.Mon, 20 Jul 2026 18:07:00 GMTSonicWallCVE-2026-15409CVE-2026-15410Zero-DayUTA0533Malwarehttps://runtimerebel.com/blog/sleepergem-malicious-rubygems-target-developer-environmentshttps://runtimerebel.com/blog/sleepergem-malicious-rubygems-target-developer-environmentsThe SleeperGem supply chain attack uses malicious RubyGems packages like git_credential_manager to compromise developers and deliver secondary payloads.Mon, 20 Jul 2026 06:48:55 GMTRubyGemsSleeperGemGit Credential ManagerSupply Chain AttackMalwarehttps://runtimerebel.com/blog/uac-0145-clickfix-strategy-how-sandworm-targets-ukraine-with-malwarehttps://runtimerebel.com/blog/uac-0145-clickfix-strategy-how-sandworm-targets-ukraine-with-malwareRussian threat actor UAC-0145 uses deceptive ClickFix CAPTCHAs to deliver data-stealing malware to Ukrainian targets. Learn how to detect and mitigate these TTPs.Sun, 19 Jul 2026 16:59:50 GMTUAC 0145SandwormClickFixUkraineMalwarePhishinghttps://runtimerebel.com/blog/okobot-framework-multi-payload-data-crypto-theft-attackshttps://runtimerebel.com/blog/okobot-framework-multi-payload-data-crypto-theft-attacksThe new OkoBot framework deploys over 20 distinct payloads, primarily targeting cryptocurrency seed phrases, credentials, and sensitive data.Thu, 16 Jul 2026 21:02:27 GMTOkoBotMalwareInfostealerCryptocurrency TheftCredential TheftData Exfiltrationhttps://runtimerebel.com/blog/asyncapi-npm-packages-infected-with-credential-stealing-malwarehttps://runtimerebel.com/blog/asyncapi-npm-packages-infected-with-credential-stealing-malwareFive malicious versions of AsyncAPI npm packages deployed a credential-stealing remote access trojan via a supply chain attack. Learn detection and mitigation.Wed, 15 Jul 2026 17:20:00 GMTNPMAsyncapiSupply Chain AttackCredential StealingMalwareTrojanhttps://runtimerebel.com/blog/jscrambler-npm-packages-poisoned-in-supply-chain-attackhttps://runtimerebel.com/blog/jscrambler-npm-packages-poisoned-in-supply-chain-attackAttackers poisoned official Jscrambler NPM packages to distribute cross-platform credential stealers. Learn the impact and how to remediate the threat.Tue, 14 Jul 2026 10:01:24 GMTJscramblerNPMSupply Chain AttackMalwareCredential Stealerhttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwarehttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwareA malicious version of the Jscrambler npm package, 5.0.0-beta-1, was backdoored with infostealer malware, affecting 1,500 downloads. Immediate action needed.Mon, 13 Jul 2026 20:59:06 GMTJscramblerNPMSupply Chain AttackInfostealerMalwareNode Js