Warp Panda has been using the BrickStorm, Junction, and GuestConduit malware in attacks against US organizations.

The post US Organizations Warned of Chinese Malware Used for Long-Term Persistence appeared first on SecurityWeek.

The state-sponsored hackers relied on phishing emails to deliver a malicious payload to Reporters Without Borders (RSF).

The post Reporters Without Borders Targeted by Russian Hackers appeared first on SecurityWeek.

The extensions were seen profiling users, reading cookie data to create unique identifiers, and executing payloads with browser API access.

The post Chrome, Edge Extensions Caught Tracking Users, Creating Backdoors appeared first on SecurityWeek.

Albiriox is a banking trojan offered under a malware-as-a-service model for $720 per month.

The post New Albiriox Android Malware Developed by Russian Cybercriminals appeared first on SecurityWeek.

APT24 has been relying on various techniques to drop the BadAudio downloader and then deploy additional payloads.

The post Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks appeared first on SecurityWeek.

The Android malware is in development and appears to be mainly aimed at users in Europe.

The post New Sturnus Banking Trojan Targets WhatsApp, Telegram, Signal Messages appeared first on SecurityWeek.

Threat actors are abusing Ray’s lack of authentication to compromise exposed clusters and deploy LLM-generated payloads and cryptocurrency miners.

The post Two-Year-Old Ray AI Framework Flaw Exploited in Ongoing Campaign appeared first on SecurityWeek.

The state-sponsored APT has been targeting the victims’ family members to increase pressure on their targets.

The post Iranian Hackers Target Defense and Government Officials in Ongoing Campaign appeared first on SecurityWeek.

Federal agencies have reported as ‘patched’ ASA or FTD devices running software versions vulnerable to attacks.

The post CISA Updates Guidance on Patching Cisco Devices Targeted in China-Linked Attacks appeared first on SecurityWeek.

The spam campaign is likely orchestrated by an Indonesian threat actor, based on code comments and the packages’ random names.

The post Tens of Thousands of Malicious NPM Packages Distribute Self-Replicating Worm appeared first on SecurityWeek.

Threat actors exploited CVE-2025-21042 to deliver malware via specially crafted images to users in the Middle East. 

The post Landfall Android Spyware Targeted Samsung Phones via Zero-Day appeared first on SecurityWeek.

ClickFix prompts typically contain instructions for Windows users, but now they are tailored for macOS and they are getting increasingly convincing.

The post ClickFix Attacks Against macOS Users Evolving appeared first on SecurityWeek.

Google has released a report describing the novel ways in which malware has been using AI to adapt and evade detection.

The post Malware Now Uses AI During Execution to Mutate and Collect Data, Google Warns appeared first on SecurityWeek.

Threat actors engage in elaborate attack chains to infect trucking and logistics companies with remote access tools.

The post Transportation Companies Hacked to Steal Cargo appeared first on SecurityWeek.

A component of the newly discovered SesameOp backdoor uses the API to store and relay commands from the C&C server.

The post SesameOp Malware Abuses OpenAI API  appeared first on SecurityWeek.

Other noteworthy stories that might have slipped under the radar: several interesting Android malware families, UN cybercrime treaty, criminal complaint against Clearview AI in Europe.

The post In Other News: WhatsApp Passkey-Encrypted Backups, Russia Targets Meduza Malware, New Mastercard Solution appeared first on SecurityWeek.

Open VSX fully contained the GlassWorm attacks and says it was not a self-replicating worm in the traditional sense.

The post Open VSX Downplays Impact From GlassWorm Campaign appeared first on SecurityWeek.