Malware Threat Intelligence

Malware encompasses trojans, worms, infostealers, and other malicious software used to gain unauthorized access, exfiltrate data, or establish persistent footholds in target environments. defend.network monitors new malware families, variant evolution, and distribution campaigns reported by security researchers and threat intelligence vendors.

WordPress, GitLab RCEs exploited; TeamViewer flaw reverses control

WordPress Core RCE flaw drew 63k attack attempts in 24 hours; GitLab maximum-severity vulnerability now exploited in the wild; TeamViewer flaw allows controlled machines to attack controllers.

WordPress, Plex, and Microsoft: Supply-chain backdoor and active cryptominer exploits

Rank Math PRO WordPress plugin compromised in supply-chain attack; Plex Media Server exploit chain actively weaponized for cryptominers and backdoors; Microsoft patches 1,400+ vulnerabilities.

GitHub Actions malware spreads to 340+ repos; ShinyHunters arrests escalate; Android firmware exploits widen

Attackers compromised high-profile open-source maintainer accounts to inject credential-stealing GitHub Actions workflows into 340+ repositories. FBI arrests of ShinyHunters members continue following FBI breach. Android firmware malware hits 150+ countries.

France tax breach, Star Blizzard backdoor campaign, Spectre-v2 BTR CPU flaw disclosed

French tax authority breached via stolen staff passwords; 100+ orgs targeted by Russian Star Blizzard with fake event invitations; Spectre-v2 BTR variant leaks Linux memory despite existing defenses.

Oracle PeopleSoft, Microsoft patches, Elementor RCE under active exploitation

Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) under mass exploitation via WAF bypass; ShinyHunters deploying web shells globally. Microsoft released 974 security patches. Lunex stealer abuses AMD drivers to disable EDR and harvest credentials.

Microsoft, WSO2, Adobe vulnerabilities under active exploitation; Roundcube actively abused

CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including WSO2 path traversal (CVE-2026-5430) and Adobe Commerce auth bypass (CVE-2026-71362). Roundcube Webmail flaw CVE-2026-48842 now actively exploited in code-injection attacks. Docker supply-chain attack via Carbonato botnet; GitLab email exposure enables code injection.

Check Point RCE, MikroTik SSH chain, malicious npm/Terraform packages in active exploitation

Check Point VPN gateway (CVE-2026-85102) actively exploited, MikroTik routers compromised via SSH chain, malicious Go malware in HashiCorp Terraform, npm

Microsoft’s record patch batch; fake LastPass installer deploys kernel EDR killer

Microsoft released 974 security patches; fake LastPass installers deliver Microsoft-signed kernel driver disabling antivirus; Google fined €403M for GDPR location data violations.

Azure AI, Cisco ISE, WordPress flaws under active exploitation; 23M Gyazo breach

Microsoft patches CVSS 10.0 Azure AI Foundry privilege escalation; Cisco ISE authentication bypass added to CISA KEV; WordPress core flaw forces theme installs; 23.6M Gyazo user records stolen via server vulnerability.

Issabel RCE under active exploitation; Microsoft patches 974 CVEs; browser AI assistants hijacked

Issabel Framework vulnerability CVE-2026-89026 (CVSS 9.8) actively exploited for unauthenticated OS command execution. Microsoft issued record 974-CVE patch batch including critical flaws. Browser extension attack hijacks AI assistants across Chrome, Edge, and Claude.

Cisco SEG SQL injection joins KEV; Acronis Linux flaw exploited; banking malware targets browsers

Cisco Secure Email Gateway SQL injection added to CISA KEV; Acronis cPanel plugin flaw exploited; Brazilian banking malware KREMLIN targets Chrome and Edge for session theft.

Check Point VPN & Tencent flaws in active exploitation; RubyGems RCE confirmed

Critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability deployed for GrayRabbit malware; OpenAI agents linked to May RubyGems RCE campaign gaining server access.

Microsoft patches record 974 CVEs; AI agents steal thousands of credentials; F5 devices breached

Microsoft released 974 security patches including two actively exploited zero-days. AI-driven credential harvesting compromised thousands of accounts in six hours. F5 BIG-IP devices are being breached to deploy Linux rootkits.

Chrome/Edge backdoors, Magento zero-day, Microsoft 365 phishing at scale

PEEP toolkit turns Chrome and Edge into post-compromise backdoors; Magento StyleSmuggler zero-day actively exploited to deploy Linux backdoors; BigBear phishing framework bypassed MFA at 258 organizations and stole 5,000+ Microsoft 365 credentials.

Critical RCEs in Switchvox, WordPress plugins; Windows Defender disablement campaign

malware campaign disables Windows Defender. Four AI coding agent vulnerabilities remain unpatched.

Kaspersky, Microsoft, Anthropic hit by infostealers; ransomware escalates AI tools

Infostealer malware targets Anthropic and Microsoft users; Aurora ransomware gang deploys Cursor AI; North Korean threat actors expand beyond IT into healthcare and sales.

TerminalFix backdoor, WordPress plugin RCEs, PaperCut chain exploit

TerminalFix ClickFix variant hijacks Windows Terminal to deploy reverse-tunnel backdoor; WordPress plugins (WPMU DEV, Avada, TranslatePress, Pods, GiveWP) patched for critical auth bypass and RCE; PaperCut NG/MF actively exploited via chained flaws.

Keycloak authentication bypass, Microsoft active exploit, WordlistLoader/SynkLoader malware

Red Hat patches critical Keycloak account-takeover flaw; Microsoft releases 398 patches including one under active exploitation; WordlistLoader and SynkLoader malware families accelerate ransomware-adjacent payload delivery via ClickFix.

Trojanized npm packages, AWS credential leak, Microsoft Defender driver abuse

14 trojanized npm packages deliver RedC2 4.0 Linux backdoor; 9,300 active AWS keys exposed; Microsoft Defender boot driver weaponized for security software deletion.

Microsoft Copilot, MLflow, and Windows Task Host under attack; ransomware exploitation confirmed

Microsoft Copilot Personal one-click data exfiltration flaws disclosed. MLflow and FUXA critical vulnerabilities exploited for cloud credential theft. Windows Task Host now actively exploited by ransomware gangs.

SharePoint, Windows zero-day exploited; Lazarus backdoor in defense sector

SharePoint CVE-2026-55040 (CVSS 9.1) under active exploitation; Lazarus deploys Windows zero-day backdoor targeting defense/aerospace in France, Germany, Brazil, India; 737 malicious Chrome VPN extensions intercept traffic.

Microsoft patches 398 flaws; SharePoint exploited; Lazarus deploys Windows backdoor

Microsoft patched 398 vulnerabilities with one under active exploitation. SharePoint auth bypass (CVE-2026-55040) being exploited post-PoC. Lazarus deployed Windows zero-day backdoor targeting defense/aerospace in 4 countries.

SharePoint, SAP, macOS flaws under active exploitation; 737 malicious Chrome extensions

SharePoint CVE-2026-55040 (CVSS 9.1) actively exploited post-PoC release. SAP Commerce Cloud RCE targeted within 72 hours of patch. macOS Screen Sharing bypass deployed for Monero mining. 737 malicious Chrome VPN extensions intercept user traffic.

SharePoint auth bypass exploited; 737 Chrome VPN extensions abused; Microsoft patches 398 flaws

737 malicious Chrome VPN extensions intercepting browser traffic targeting Russian speakers. Microsoft released 398 patches including one zero-day in active exploitation.

Dysphoria botnet reaches 200k devices; Arista VeloCloud, n8n zero-days exploited

Dysphoria IoT botnet now commands ~200k devices with blockchain C2; Arista VeloCloud Orchestrator actively exploited; n8n workflow platform patched sandbox-escape RCE.

Browser-assembled malware, GitLab RCE exploit public, PTC manufacturing under attack

SourTrade malvertising fragments Windows executables for in-browser assembly; GitLab RCE PoC published; Cl0p affiliates exploit unauthenticated PTC manufacturing flaws for data extortion.

Fastjson RCE under attack, no patch; GitLab exploit public; PTC manufacturing targeted

Fastjson 1.x (Java JSON library) actively exploited with no vendor patch; GitLab RCE exploit published; Cl0p affiliates targeting internet-exposed PTC Windchill/FlexPLM for data extortion.

WordPress, SonicWall zero-days in active exploitation; FakeGit malware campaign hits 7,600 GitHub repos

FakeGit campaign weaponizes 7,600 GitHub repositories to distribute SmartLoader malware. WordPress sites actively exploited via CVE-2026-60137/63030 chain within 72 hours of disclosure. SonicWall SMA1000 zero-days (CVE-2026-15409/15410) used in targeted attacks; Estée Lauder breach linked to Oracle E-Business flaw.

WordPress, 7-Zip RCE exploited; NadMesh steals AWS keys; ACR Stealer surge

WordPress wp2shell RCE under active exploitation with public PoC. NadMesh botnet harvests 3,811 AWS keys from exposed AI services. 7-Zip patches critical archive RCE. Microsoft alerts on ACR Stealer surge.

Scattered Spider sentenced; Microsoft patches record 570 flaws; macOS ClickLock stealer active

Two Scattered Spider members sentenced to 5.5 years for 2024 Transport for London attack. Microsoft releases record 570-CVE patch set. ClickLock macOS malware terminates apps until password stolen.

ModHeader, CrashStealer, Joomla RCE active exploits; npm supply-chain risk

Google and Microsoft remove ModHeader extension (1.6M installs) after discovering hidden tracking. CrashStealer macOS malware evades Gatekeeper using signed code. CISA warns of active Joomla extension exploitation.

npm supply-chain attacks escalate; Zimbra RCE, Android malware evolves

jscrambler npm package compromised with native infostealer; Zimbra stored XSS enables code execution; RedHook Android malware abuses wireless debugging for shell access.

npm supply-chain attacks: jscrambler infostealer, Injective wallet theft, Zimbra RCE

jscrambler npm 8.14.0 compromised with Rust infostealer, Zimbra XSS flaw enables code execution

GitHub API enumeration campaign exposed; GigaWiper Windows backdoor combines disk wipe, spyware

Datadog Security Labs warns of automated campaigns systematically enumerating corporate GitHub organizations via API abuse. Microsoft disassembles destructive GigaWiper backdoor combining disk wipe, ransomware, and spyware. npm 12 disables install scripts by default to reduce supply-chain risk.

North Korea PolinRider expands to 108 packages; Avalon ransomware framework emerges

North Korean actors publish 108 malicious packages across npm, Packagist, Go, Chrome; Avalon modular framework combines credential theft with CrownX ransomware. U.S. government paid $1M extortion to Kairos group.

North Korea targets npm, Linux kernel RCE, AI-driven ransomware surge

North Korean actors published 108 malicious packages across npm and other ecosystems; Linux kernel RCE affects Android; first documented LLM-automated ransomware attack observed.

NetNut seized; Citrix Bleed 2 exploited; ToddyCat hijacks Gmail via OAuth

Google and FBI disrupt 2M-device NetNut proxy network; Anubis ransomware actively exploits Citrix Bleed 2 (CVE-2025-5777); ToddyCat malware abuses Google APIs to hijack Gmail accounts; Microsoft 365 OAuth bypass attacks steal tokens in seconds.

Arch Linux supply-chain worm, Velvet Ant backdoor, Gemini phishing-as-a-service

Over 400 Arch Linux AUR packages compromised with credential stealer and eBPF rootkit; China-linked Velvet Ant backdoored Linux authentication for decade; Google sues Chinese phishing-as-a-service using Gemini AI.

TCLBANKER trojan; Canvas breach hits education; Ivanti zero-day

Critical threats including TCLBANKER banking trojan, Canvas platform breach disrupting nationwide education, and active Ivanti zero-day exploitation require immediate response across financial, education, and government sectors.

Developer platform supply-chain attacks; Windows RPC zero-day

Critical supply chain attacks on developer platforms, Russian state-sponsored token theft via router exploits, and unpatched Windows RPC privilege escalation demand immediate defensive action.

FIRESTARTER federal Cisco persistence; Chinese APT GopherWhisper

Critical threats include FIRESTARTER backdoor persistence on federal Cisco devices, Russian military token theft via router exploitation, Chinese APT GopherWhisper attacks, and four actively exploited CISA KEV vulnerabilities with May 2026 federal patching deadline.

FIRESTARTER on federal Cisco gear; 4 critical CVEs added to CISA KEV

FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches; Russian state actors harvesting Office tokens via router exploits; four critical CVEs added to CISA KEV with May 2026 deadline; APT campaigns targeting U.S. defense sector; AI-powered phishing escalates to personalized 1-to-1 attacks.

FIRESTARTER persists on federal Cisco; APT spear-phishes NASA

FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches. Russian military intelligence harvesting Office tokens via router exploits. Chinese APT targeting NASA and defense sector with spear-phishing. AI-powered phishing and FakeWallet credential theft escalating.

Docker & npm supply-chain hits; Lotus Wiper on Venezuelan energy

Critical supply chain attacks via malicious Docker images and npm worms, state-sponsored credential theft campaigns targeting Microsoft Office, and destructive Lotus Wiper malware deployed against Venezuelan energy infrastructure require immediate response across all organizations.

Chrome & TrueConf zero-days exploited; widespread malware campaigns

Critical zero-day vulnerabilities in Chrome and TrueConf under active exploitation, combined with widespread malware campaigns targeting mobile and enterprise infrastructure.

Telnyx PyPI compromise; iOS exploit active; APT hits telecom

Critical supply-chain compromise of Telnyx PyPI package, active iOS exploitation, state-sponsored wiper attacks on medical device firm, and advanced APT malware targeting telecom infrastructure demand immediate response.

Trivy & VS Code supply-chain breach; Iran wipers hit Kubernetes

Critical supply chain attacks on Trivy scanner and VS Code, destructive Iran-linked wipers targeting Kubernetes, and phishing-as-a-service platforms resurging with 29K IRS victims. Initial access now occurs in 22 seconds.