Warning -- PXA Stealer, a new Python-based #malware, is targeting European & Asian gov and education sectors, stealing sensitive data like credentials & financial info.

Learn more: https://thehackernews.com/2024/11/vietnamese-hacker-group-deploys-new-pxa.html

🚨 New stealth #malware "BabbleLoader" is bypassing AI detection with a slew of evasive tricks, making it one of the most sophisticated threats in the wild.

Learn how BabbleLoader works and how to defend against it: https://thehackernews.com/2024/11/new-stealthy-babbleloader-malware.html

🚨 Facebook Ads Manager under attack!

A revamped python-based NodeStealer #malware now targets Facebook business accounts, harvesting credit card data from browsers. It utilizes techniques like Windows Restart Manager to unlock database files, junk code injection, and dynamic execution of Python scripts.

🔗 Find out how: https://thehackernews.com/2024/11/nodestealer-malware-targets-facebook-ad.html

Cybercriminals are using Godot Engine, a popular open-source game engine, to spread #malware undetected across Windows, macOS, and Linux devices.

Over 17,000 systems have been infected since June 2024.

Find details here — https://thehackernews.com/2024/11/cybercriminals-exploit-popular-game.html

Manufacturing & healthcare sectors are being targeted by SmokeLoader #malware—modular, evasive, and deadly.

With plugins that steal data, mine crypto, and launch DDoS, no system is safe.

Full story here: https://thehackernews.com/2024/12/smokeloader-malware-resurfaces.html

Russia-linked APT group Turla has been hijacking the infrastructure of a Pakistani hacking group to spy on Afghan and Indian government targets by deploying custom #malware, TwoDash and Statuezy.

Learn more: https://thehackernews.com/2024/12/russia-linked-turla-exploits-pakistani.html

🔒 ZLoader #malware is back—with a stealthy upgrade. The latest version employs DNS tunneling for encrypted communication, raising the stakes for detection efforts.

This isn’t just an update; ZLoader now includes an interactive shell capable of executing over a dozen commands, a game-changer for #ransomware attacks.

Dive into the details. https://thehackernews.com/2024/12/zloader-malware-returns-with-dns.html

🚨 A trusted Windows feature, UI Automation, can be exploited by #malware to bypass EDR detection, execute stealthy commands, and steal data undetected.

🔗 Explore how this attack works: https://thehackernews.com/2024/12/new-malware-technique-could-exploit.html

A Russian state-sponsored group, Secret Blizzard, is leveraging other hackers’ #malware to deploy its tools in Ukraine, raising the stakes in cyber warfare.

Read the full story: https://thehackernews.com/2024/12/secret-blizzard-deploys-kazuar-backdoor.html

The FBI warns ATM “jackpotting” caused over $20M in losses in 2025.

Since 2020, 1,900 incidents have been reported, including 700 last year. Attackers use #malware like Ploutus to bypass bank authorization via the XFS layer & trigger rapid cash-outs.

🔗 Read → https://thehackernews.com/2026/02/fbi-reports-1900-atm-jackpotting.html

🤖 IBM X-Force found AI-generated #malware Slopoly used by Hive0163.

The PowerShell backdoor persists for days, beacons every 30s, and runs commands from a remote C2. AI didn’t make it advanced — it made malware faster to build.

🔗 Read here → https://thehackernews.com/2026/03/hive0163-uses-ai-assisted-slopoly.html

⚡ Google adding a 24-hour delay for installing #Android apps from unverified developers.

Users must enable developer mode, reboot, and confirm again after a day. This is meant to stop #malware and scams that trick users into disabling Play Protect or giving access.

🔗 Details here → https://thehackernews.com/2026/03/google-adds-24-hour-wait-for-unverified.html

🛑 North Korea-linked hackers spread #malware across five open-source ecosystems.

1,700+ packages on npm, PyPI, Go, Rust, and PHP posed as dev tools but loaded infostealer and RAT malware, hidden inside normal functions, not install.

🔗 Read → https://thehackernews.com/2026/04/n-korean-hackers-spread-1700-malicious.html

⚠️ A previously unknown threat actor has been quietly targeting #Ukraine since at least August 2025.

GREYVIBE uses spear-phishing, fake CAPTCHA pages, and fraudulent websites to deliver custom #malware to military, government, civilian, and business targets.

Researchers also found evidence of AI-assisted malware development and links to the cybercrime ecosystem.

Full report: https://thehackernews.com/2026/05/new-russian-linked-greyvibe-targets.html

🛑 Your World Cup 2026 ticket could be gone before the first whistle.

4,300+ Fake ⚽ #FIFA sites are already live.

> Some steal logins
> Some sell fake tickets
> Some hide banking #malware inside streaming apps

Scammers are using ads, search results, Telegram, WhatsApp, and cloned sites.

If you plan to follow the #FIFAFever, read this first: https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html

⚠️ Old routers are being pulled into attacker infrastructure.

AryStinger #malware has infected 4,300+ legacy routers and uses them to scan targets, tunnel traffic, and run commands remotely.

It is less about DDoS and more about reconnaissance and proxy access.

Read the full story: https://thehackernews.com/2026/06/arystinger-malware-infects-4300-legacy.html

⚡ Canada’s spy service got a court order to remotely clean #malware-infected devices.

CSIS used its threat reduction powers to neutralize two foreign-run botnets operating through Canadian servers, SOHO routers, cameras, TVs, and other IoT gear.

The ruling stayed secret for more than 2 years.

Read 🠖 https://thehackernews.com/2026/06/canadas-spy-agency-used-first-of-its.html

🚨 Shai-Hulud-linked #malware has moved beyond npm.

Researchers found 23 malicious npm packages and a related Go module tied to Verana Blockchain.

The campaign also abuses #GitHub Actions to steal CI/CD secrets and spread through trusted developer workflows.

Read details 🠖 https://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.html

🛑 Fake GitHub PoC repos are being used to infect vulnerability researchers with ChocoPoC RAT.

The PoC may look clean. The #malware hides in Python dependencies like frint and skytext, then steals saved passwords, cookies, browser data, and files.

How the trap works: https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html

🚨 A Silver Fox-linked #malware distributor is selectively deploying a new backdoor called MODBEACON.

It uses encrypted gRPC streaming for command-and-control and loads additional plugins directly in memory.

Read the full story: https://thehackernews.com/2026/07/new-modbeacon-rat-uses-grpc-streaming.html