malware - Tech News from Simmons Systems

Tech News from Simmons Systems

malware

A collection of 70 posts

Malvertising Campaign Turns Browsers Into Malware Assembly Lines

A massive malvertising campaign leverages fake Solana, Luno, and TradingView websites to deliver malware through a clever technique that turns the victim's browser into an assembly pipeline. Active since late 2024, the operation targets retail traders and crypto investors across 25 languages in 12 countries, primarily in the

Dolphin X Trojan Uses AI to Rank Victims by Value for Cybercriminals

A new remote access trojan called Dolphin X claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims to target first. The malware appears on a cybercrime forum under the vendor alias "Kontraktnik" and promotes itself as an all-in-one tool.

Suspected Chinese APT Exploits ViPNet Software in Attacks on Russian Government

A sophisticated hacking campaign known as HelloNet targets Russian government agencies and critical infrastructure by abusing ViPNet, a widely used private networking software suite. According to researchers at Kaspersky, the campaign actively compromises organizations across the government, energy, transport, education, and logistics sectors. The attackers exploit ViPNet's trusted

Microsoft Sounds Alarm on Rising ACR Stealer Malware Campaigns

Microsoft reports a significant increase in attacks leveraging ACR Stealer, a malware-as-a-service operation that targets enterprise customers to harvest browser-stored passwords, authentication tokens, and sensitive documents. Between late April and mid-June, threat actors deploy the info-stealing payload using the ClickFix social-engineering technique, WebDAV servers, and the Microsoft HTML Application Host

7-Zip Patch Fixes Critical Code Execution Vulnerability in XZ Archives

A critical remote code execution vulnerability in 7-Zip allows attackers to execute malicious code by tricking users into opening specially crafted compressed files. Researcher Landon Peng disclosed the flaw, which stems from how the popular archive utility processes XZ-compressed data. Specially crafted XZ files trigger a heap-based buffer overflow that

Hackers Compromise Jscrambler npm Package with Infostealer Malware

Hackers compromise the Jscrambler npm package, injecting information-stealing malware into versions 8.14, 8.16, 8.17, and 8.20. The malicious package executes during the preinstall hook and receives approximately 1,479 downloads within a two-hour window before Jscrambler deprecates it and releases a safe version. The company confirms

Australian Cyber Agency Warns of Global CMS Exploitation Campaign

The Australian Cyber Security Centre (ACSC) issues a warning about an ongoing global exploitation campaign that targets vulnerable content management systems and plugins. The agency reports that numerous small- to medium-sized Australian businesses already suffer compromises from the attacks. Threat actors actively scan websites for known flaws and deploy webshells,

China-Linked Hackers Target University Researchers Through Roundcube Flaws

A China-linked threat cluster known as UNK_MassTraction targets Roundcube webmail servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware. The campaign, observed since May, focuses on physics and engineering departments, professors, administrators, and organizations involved in astrophysics, particle physics, or national security-related research. The

Google and FBI Disrupt Massive NetNut Proxy Botnet Infecting 2 Million Devices

A coordinated operation led by Google and the FBI disrupts NetNut, a massive residential proxy network that controls at least two million infected devices worldwide. The botnet, also known as Popa, targets Android devices, smart TVs, and streaming boxes, turning them into exit nodes that route malicious traffic through legitimate

Supply Chain Attacks and Credential Theft Dominate Late June 2026 Threat Landscape

A new threat intelligence report from MalwarePatrol covers the second half of June 2026, revealing that software supply chain attacks remain a dominant concern for security teams. Compromises hit npm packages, developer tools, IDE plugins, SDKs, and CI/CD workflows, signaling that attacker interest in developer ecosystems shows no signs

Global Operation Disrupts Major Cybercrime Tools Amadey and StealC

International authorities and major technology companies are disrupting a cybercrime "assembly line" that allows criminals to collect millions of login credentials and steal over $47 million through ransom payments and fraud. The coordinated effort, known as Operation Endgame, simultaneously targets two widely used malicious platforms that play critical

AI and Machine Learning Become Essential Weapons Against Rising Cyberattacks

As cyberattacks grow faster and more complex, organizations increasingly rely on artificial intelligence and machine learning to detect threats and lure hackers into simulated environments.