Malware encompasses trojans, worms, infostealers, and other malicious software used to gain unauthorized access, exfiltrate data, or establish persistent footholds in target environments. defend.network monitors new malware families, variant evolution, and distribution campaigns reported by security researchers and threat intelligence vendors.
Attackers compromised high-profile open-source maintainer accounts to inject credential-stealing GitHub Actions workflows into 340+ repositories. FBI arrests of ShinyHunters members continue following FBI breach. Android firmware malware hits 150+ countries.
French tax authority breached via stolen staff passwords; 100+ orgs targeted by Russian Star Blizzard with fake event invitations; Spectre-v2 BTR variant leaks Linux memory despite existing defenses.
Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) under mass exploitation via WAF bypass; ShinyHunters deploying web shells globally. Microsoft released 974 security patches. Lunex stealer abuses AMD drivers to disable EDR and harvest credentials.
CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including WSO2 path traversal (CVE-2026-5430) and Adobe Commerce auth bypass (CVE-2026-71362). Roundcube Webmail flaw CVE-2026-48842 now actively exploited in code-injection attacks. Docker supply-chain attack via Carbonato botnet; GitLab email exposure enables code injection.
Check Point VPN gateway (CVE-2026-85102) actively exploited, MikroTik routers compromised via SSH chain, malicious Go malware in HashiCorp Terraform, npm
Microsoft released 974 security patches; fake LastPass installers deliver Microsoft-signed kernel driver disabling antivirus; Google fined €403M for GDPR location data violations.
Microsoft patches CVSS 10.0 Azure AI Foundry privilege escalation; Cisco ISE authentication bypass added to CISA KEV; WordPress core flaw forces theme installs; 23.6M Gyazo user records stolen via server vulnerability.
Issabel Framework vulnerability CVE-2026-89026 (CVSS 9.8) actively exploited for unauthenticated OS command execution. Microsoft issued record 974-CVE patch batch including critical flaws. Browser extension attack hijacks AI assistants across Chrome, Edge, and Claude.
Cisco Secure Email Gateway SQL injection added to CISA KEV; Acronis cPanel plugin flaw exploited; Brazilian banking malware KREMLIN targets Chrome and Edge for session theft.
Critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability deployed for GrayRabbit malware; OpenAI agents linked to May RubyGems RCE campaign gaining server access.
Microsoft released 974 security patches including two actively exploited zero-days. AI-driven credential harvesting compromised thousands of accounts in six hours. F5 BIG-IP devices are being breached to deploy Linux rootkits.
PEEP toolkit turns Chrome and Edge into post-compromise backdoors; Magento StyleSmuggler zero-day actively exploited to deploy Linux backdoors; BigBear phishing framework bypassed MFA at 258 organizations and stole 5,000+ Microsoft 365 credentials.
malware campaign disables Windows Defender. Four AI coding agent vulnerabilities remain unpatched.
Infostealer malware targets Anthropic and Microsoft users; Aurora ransomware gang deploys Cursor AI; North Korean threat actors expand beyond IT into healthcare and sales.
TerminalFix ClickFix variant hijacks Windows Terminal to deploy reverse-tunnel backdoor; WordPress plugins (WPMU DEV, Avada, TranslatePress, Pods, GiveWP) patched for critical auth bypass and RCE; PaperCut NG/MF actively exploited via chained flaws.
Red Hat patches critical Keycloak account-takeover flaw; Microsoft releases 398 patches including one under active exploitation; WordlistLoader and SynkLoader malware families accelerate ransomware-adjacent payload delivery via ClickFix.
14 trojanized npm packages deliver RedC2 4.0 Linux backdoor; 9,300 active AWS keys exposed; Microsoft Defender boot driver weaponized for security software deletion.
Microsoft Copilot Personal one-click data exfiltration flaws disclosed. MLflow and FUXA critical vulnerabilities exploited for cloud credential theft. Windows Task Host now actively exploited by ransomware gangs.
SharePoint CVE-2026-55040 (CVSS 9.1) under active exploitation; Lazarus deploys Windows zero-day backdoor targeting defense/aerospace in France, Germany, Brazil, India; 737 malicious Chrome VPN extensions intercept traffic.
Microsoft patched 398 vulnerabilities with one under active exploitation. SharePoint auth bypass (CVE-2026-55040) being exploited post-PoC. Lazarus deployed Windows zero-day backdoor targeting defense/aerospace in 4 countries.
SharePoint CVE-2026-55040 (CVSS 9.1) actively exploited post-PoC release. SAP Commerce Cloud RCE targeted within 72 hours of patch. macOS Screen Sharing bypass deployed for Monero mining. 737 malicious Chrome VPN extensions intercept user traffic.
737 malicious Chrome VPN extensions intercepting browser traffic targeting Russian speakers. Microsoft released 398 patches including one zero-day in active exploitation.
Dysphoria IoT botnet now commands ~200k devices with blockchain C2; Arista VeloCloud Orchestrator actively exploited; n8n workflow platform patched sandbox-escape RCE.
SourTrade malvertising fragments Windows executables for in-browser assembly; GitLab RCE PoC published; Cl0p affiliates exploit unauthenticated PTC manufacturing flaws for data extortion.
Fastjson 1.x (Java JSON library) actively exploited with no vendor patch; GitLab RCE exploit published; Cl0p affiliates targeting internet-exposed PTC Windchill/FlexPLM for data extortion.
FakeGit campaign weaponizes 7,600 GitHub repositories to distribute SmartLoader malware. WordPress sites actively exploited via CVE-2026-60137/63030 chain within 72 hours of disclosure. SonicWall SMA1000 zero-days (CVE-2026-15409/15410) used in targeted attacks; Estée Lauder breach linked to Oracle E-Business flaw.
WordPress wp2shell RCE under active exploitation with public PoC. NadMesh botnet harvests 3,811 AWS keys from exposed AI services. 7-Zip patches critical archive RCE. Microsoft alerts on ACR Stealer surge.
Two Scattered Spider members sentenced to 5.5 years for 2024 Transport for London attack. Microsoft releases record 570-CVE patch set. ClickLock macOS malware terminates apps until password stolen.
Google and Microsoft remove ModHeader extension (1.6M installs) after discovering hidden tracking. CrashStealer macOS malware evades Gatekeeper using signed code. CISA warns of active Joomla extension exploitation.
jscrambler npm package compromised with native infostealer; Zimbra stored XSS enables code execution; RedHook Android malware abuses wireless debugging for shell access.
jscrambler npm 8.14.0 compromised with Rust infostealer, Zimbra XSS flaw enables code execution
Datadog Security Labs warns of automated campaigns systematically enumerating corporate GitHub organizations via API abuse. Microsoft disassembles destructive GigaWiper backdoor combining disk wipe, ransomware, and spyware. npm 12 disables install scripts by default to reduce supply-chain risk.
North Korean actors publish 108 malicious packages across npm, Packagist, Go, Chrome; Avalon modular framework combines credential theft with CrownX ransomware. U.S. government paid $1M extortion to Kairos group.
North Korean actors published 108 malicious packages across npm and other ecosystems; Linux kernel RCE affects Android; first documented LLM-automated ransomware attack observed.
Google and FBI disrupt 2M-device NetNut proxy network; Anubis ransomware actively exploits Citrix Bleed 2 (CVE-2025-5777); ToddyCat malware abuses Google APIs to hijack Gmail accounts; Microsoft 365 OAuth bypass attacks steal tokens in seconds.
Over 400 Arch Linux AUR packages compromised with credential stealer and eBPF rootkit; China-linked Velvet Ant backdoored Linux authentication for decade; Google sues Chinese phishing-as-a-service using Gemini AI.
Critical threats including TCLBANKER banking trojan, Canvas platform breach disrupting nationwide education, and active Ivanti zero-day exploitation require immediate response across financial, education, and government sectors.
Critical supply chain attacks on developer platforms, Russian state-sponsored token theft via router exploits, and unpatched Windows RPC privilege escalation demand immediate defensive action.
Critical threats include FIRESTARTER backdoor persistence on federal Cisco devices, Russian military token theft via router exploitation, Chinese APT GopherWhisper attacks, and four actively exploited CISA KEV vulnerabilities with May 2026 federal patching deadline.
FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches; Russian state actors harvesting Office tokens via router exploits; four critical CVEs added to CISA KEV with May 2026 deadline; APT campaigns targeting U.S. defense sector; AI-powered phishing escalates to personalized 1-to-1 attacks.
FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches. Russian military intelligence harvesting Office tokens via router exploits. Chinese APT targeting NASA and defense sector with spear-phishing. AI-powered phishing and FakeWallet credential theft escalating.
Critical supply chain attacks via malicious Docker images and npm worms, state-sponsored credential theft campaigns targeting Microsoft Office, and destructive Lotus Wiper malware deployed against Venezuelan energy infrastructure require immediate response across all organizations.
Critical zero-day vulnerabilities in Chrome and TrueConf under active exploitation, combined with widespread malware campaigns targeting mobile and enterprise infrastructure.
Critical supply-chain compromise of Telnyx PyPI package, active iOS exploitation, state-sponsored wiper attacks on medical device firm, and advanced APT malware targeting telecom infrastructure demand immediate response.
Critical supply chain attacks on Trivy scanner and VS Code, destructive Iran-linked wipers targeting Kubernetes, and phishing-as-a-service platforms resurging with 29K IRS victims. Initial access now occurs in 22 seconds.
Subscribe free and never miss a threat briefing.