CloudSyncD Reused a Mac Password to Launch
CloudSyncD reused credentials via a counterfeit installer.
malware
How a Public iCloud Calendar Became a macOS Malware Loader
A MacSync downloader feeds a public iCloud calendar into zsh until it reaches commands hidden in the event description.
This PowerShell Backdoor Watches Every New Document You Create
Removing the first script is not enough. Four scheduled tasks, a Startup launcher and two mutually monitored payloads can reconstruct the backdoor.
Fake Job Interviews Put 30,000 Devices and 7,000 Wallets in North Korea’s Reach
The coding test was the payload. Officials say the developer-focused campaign accumulated more than $10.7 million in transfers.
This npm Malware Waited Until Runtime to Slip Past Install-Script Defences
Defences watched package installation. The payload stayed quiet until an application used a normal B-tree method.
This Malware Makes Chrome Trust an Extension You Never Approved
The browser can load the malicious extension as though you approved it. Elastic's KREMLIN investigation shows why a familiar banking document can become an endpoint and session-security problem.
AI Kept Rebuilding This Russia-Linked Malware Until Security Tools Missed It
Anthropic says a Russia-linked espionage operator used AI to monitor detections and keep rebuilding malware until it was no longer detected. The attack cycle, not a single hash, is now the defensive problem.
One Support Session Could Infect the Next PC
A modified ScreenConnect client can transfer and run malware when a new support session connects. The first infection still needs social engineering, but one trusted remote session can become the bridge to the next PC.
5,400 Small-Business Websites Became Blockchain-Backed Malware Traps
Thousands of ordinary small-business websites became malware delivery nodes. The next stage lived on a free blockchain testnet, and a newer variant hid its command channel inside WebRTC.
The AI Malware Wave Was Mostly a Sandbox Artifact. Only 12 of 405 Samples Reached Production.
Unit 42 found only 12 of 405 AI-enabled malware samples on production endpoints, exposing the gap between public repositories and operational activity.