Filtered by tag: malware × Clear
Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools
Matched: health
A malicious Ruby gem called strutil-core (v1.0.1) stole credentials from 51 sources and planted backdoors in AI coding tools like Claude and Cursor. Live on RubyGems for roughly five hours in November 2026, it ran a payload during installation that harvested cloud keys, tokens, and crypto wallets, then sent data to attacker-controlled servers. It also added persistence hooks into AI tool config files and could delete a victim's home folder if a stolen GitHub token was revoked.
Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
Matched: health
Attackers hijacked 10 npm packages across 12 releases, injecting malware that uses the Ethereum blockchain as a dead drop to locate command servers. Tracked as sonatype-2026-010515 with a severity score of 8.7, the PolinRider malware reads server IP addresses from blockchain transactions, fetches XOR-encoded JavaScript, and runs it persistently even after the host app closes. Unlike typical npm malware, it triggers on import rather than install hooks, bypassing common defenses. Teams should audit lockfiles, check process and network logs for detached Node processes or port-443 HTTP requests to /0x/cls or /0x/ls, and rotate any exposed secrets.
Hackers Deploy ArmorSteal Malware Through Fake Software Downloads to Steal Credentials and Mine Crypto
Matched: health
Hackers are spreading Python-based malware called ArmorSteal through fake download pages impersonating tools like Chocolatey and Microsoft Activation Scripts. Victims are tricked into running PowerShell commands that install the real software while silently dropping malware into a disguised Windows folder. The kit steals passwords, crypto wallets, Discord tokens, and browser data, while also mining Monero. It evades detection by shutting down when monitoring tools are open and checking if it's running in a cloud sandbox.
New Dark Project Ransomware Group Offers Hackers 80% Commission to Expand Cyberattacks
Matched: health
Dark Project, a ransomware group first observed in June 2026, is recruiting affiliates by offering 80% commission on successful attacks. The group combines data theft, file encryption, and public leak threats to pressure victims. Researchers at Gurucul documented 38 organizations listed across eight countries, mostly in the US, spanning manufacturing, healthcare, and construction. The group operates a Tor-hosted platform managing negotiations and victim communications, with partners recruited via Tox messaging.
Google Dismantles 1.3 Million Device XCPE Botnet, Bans Android TV Maker Over Preinstalled Malware
Matched: health
Google and partners dismantled the XCPE botnet, which infected 1.3 million set-top boxes via preinstalled malware linked to Android TV maker Videostrong Technology. Google accused the company of deliberately building a backdoor sold to criminal affiliates for ad fraud, proxy abuse, and further malware distribution. Videostrong has been banned from producing certified Android devices. Related takedowns are expected to cut access to 10 million additional compromised devices across multiple affiliate malware families.
Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies
Matched: health
Google and industry partners dismantled the XCPE botnet, which infected over 1.3 million Android TV set-top boxes with malware that secretly sold users' internet connections as residential proxies and conducted ad fraud. Chinese manufacturer Videostrong Technology was found responsible for embedding the backdoor. Google severed ties with the company and took down its infrastructure. The takedown is expected to cut off access to 10 million additional compromised devices, including healthcare gadgets and karaoke machines.
Hackers Hijack 42 GitHub Repositories to Plant Malware Traps for Claude, Gemini, and Cursor Users
Matched: health
Hackers compromised 42 GitHub repositories belonging to 11 legitimate owners, planting malware that activates when developers open projects in Claude, Gemini, Cursor, or VS Code. Hidden in oversized files (.github/init.js, 12-13MB), the code exploits startup hooks in AI coding tools. JFrog researchers linked the campaign to a broader npm worm, with payloads designed to steal credentials and self-propagate. No confirmed victims were reported.
StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs
Matched: health
The creator of StealC malware has rebranded with a new Windows remote access trojan called Stadia, advertised in October 2026. It combines password theft with hidden desktop control, targeting browsers, crypto wallets, messaging apps, and VPNs. Code analysis confirmed shared components with StealC 3.5. Monthly subscriptions range from $300 to $900, with former StealC customers offered a free Pro trial following June's Operation Endgame infrastructure seizure.
The AI Adoption Blind Spot: How Fake AI Tools Put Enterprises at Risk
Matched: health
Cybercriminals are exploiting enterprise AI adoption by distributing malicious apps disguised as ChatGPT, Claude, and Microsoft Copilot. ANY.RUN researchers identified 1,258 sandbox analyses linked to fake AI campaigns between April and October 2026, with the US ranking second in submissions. Attackers target developers, marketers, and general employees across industries, stealing credentials and deploying malware across Windows and macOS devices.
LiteLLM Compromised – Hackers Injected an Infostealer and RAT in the Latest 1.107.0 PyPI Release
Matched: health
LiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, with all seven wheel files containing a credential stealer and remote access trojan that also spread to Docker images. The malware uses Python startup hooks to run automatically without LiteLLM being directly invoked, targeting SSH keys, cloud credentials, browser passwords, and AI tool tokens. Data is sent to an attacker-controlled domain mimicking LiteLLM infrastructure. PyPI removed the release, but stolen credentials remain at risk. Version 1.106.2 is considered safe.