FakeGit campaign returns with 17,610 GitHub repos pushing SmartLoader and StealC
Apiiro says the FakeGit operation re-aimed thousands of GitHub repositories, many posing as AI tools and MCP servers, to deliver SmartLoader and the StealC infostealer.
Malware
The latest cybersecurity news in Malware.
Tensorlake npm SDK hijacked to spread Shai-Hulud worm with token-revocation wiper
Version 0.5.144 of the tensorlake npm package shipped a credential-stealing worm that can wipe a developer's home directory if the stolen GitHub token is revoked.
PoeLLM botnet hides C2 in a poem, infects 3,400+ exposed AI servers
Lumen's Black Lotus Labs says the PoeLLM malware has compromised more than 3,400 servers, including LiteLLM and Ollama hosts, to mine cryptocurrency and spread further.
Long-running MALFEX npm campaign spreads RAT and stealer, reaches 40,000 downloads
Checkmarx says a single actor has used npm packages since August 2023 to deliver Overlord RAT and a Node.js stealer; three packages were still live on October 1.
ClickFix campaign hijacks 100+ Ukrainian websites to spread Lunex stealer
CERT-UA says a ClickFix campaign tracked as UAC-0277 compromised more than 100 Ukrainian websites to push Lunex, a stealer sold as malware-as-a-service.
Fake ChatGPT and Gemini sites hijack ad accounts with live browser-in-the-browser phishing
Island researchers found fake AI product sites that lure advertising staff into a fake Google sign-in window, where a human operator harvests passwords and MFA codes in real time.
ClickFix now hides its payload in the browser cache to slip past download defenses
Microsoft Threat Intelligence says fake CAPTCHA pages now pre-load a script into the browser cache disguised as a PNG, sidestepping both download monitoring and the Windows Run dialog's character limit.
Milk Dragon phishing kit steals card data keystroke by keystroke from fake discount shops
Group-IB says the Milk Dragon kit has produced 258 phishing pages hitting victims in 66 countries, using fake 3D Secure screens to capture one-time passcodes in real time.
Cling botnet hides commands in STUN traffic while exploiting dozens of router flaws
FortiGuard Labs and Nozomi Networks describe a Linux botnet that disguises its command channel as replies from a Google STUN server and spreads through router and DVR flaws.
New AVERAT Linux implant hides command traffic inside SMTP on telecom edge devices
Rapid7 documented a new modular Linux implant called AVERAT alongside fresh BPFDoor variants, both abusing TCP port 25 to blend command-and-control traffic into ordinary mail flows.
GlassWorm loaders found hiding in popular VS Code colour themes
Socket says four theme extensions on the VS Code Marketplace and Open VSX are tied to the GlassWorm campaign, two of them confirmed malicious and using a Solana blockchain dead drop for command and control.
Fake Zoom installer drops CloudSyncD backdoor on macOS with root privileges
Jamf Threat Labs says a new macOS backdoor, CloudSyncD, poses as a Zoom installer, tricks users into entering their password and uses it with sudo to run a persistent implant as root.