Latest cybersecurity reporting from selected sources.

Researchers at Jamf Threat Labs detail CrashStealer, which steals passwords, cryptocurrency wallets and more

Tax-season phishing floods deliver RMM malware, credential theft, BEC and tax-form scams

The Vidar 2.0 infostealers is deployed through fake free game cheats on GitHub and Reddit

BitSight research has revealed how threat actors exploit calendar subscriptions to deliver phishing links, malware and social engineering attacks through hijacked domains

Researchers at BlackFrog have uncovered Matrix Push C2, a malicious command-and-control system that abuses web browser push notifications to deliver malware

North Korean hackers have been observed exploiting cyber threat intelligence platforms in a campaign targeting job seekers with malware-laced lures

Backdoor malware Auto-Color targets Linux systems, exploiting SAP NetWeaver flaw CVE-2025-31324

A new malware campaign uses GitHub to deliver payloads via Amadey botnet, bypassing email distribution

Cisco Talos reported that a Chinese group has deployed web shells and malware in local government networks post-exploitation

Posing as potential employers, Slow Pisces hackers conceal malware in coding challenges sent to cryptocurrency developers on LinkedIn

CISA recommends immediate action to address malware variant RESURGE exploiting Ivanti vulnerability CVE-2025-0282

Phishing attack exploits social engineering techniques alongside Microsoft Teams and remote access software to deploy BackConnect malware

Trend Micro uncovers BadIIS malware exploiting IIS servers for SEO fraud and malicious redirects

Crazy Evil, a group of crypto scammers, exploit NFTs and cryptocurrencies with malware targeting influencers and tech professionals

Murdoc_Botnet used Mirai malware to exploit IoT vulnerabilities, targeting devices globally

Lazarus Group exploited Google Chrome zero-day, infecting systems with Manuscrypt malware

The Chinese cyber espionage group was observed jailbreaking a Cisco switch appliance using a zero-day exploit

CPR said exploit builders in .NET and Python have been employed to deploy this malware

The actor utilizes custom Linux malware to pursue financial gain, according to Check Point Research

Discovered by Cado Security, the campaign deploys two containers to vulnerable Docker instances