Latest cybersecurity reporting from selected sources.

In addition to executing entirely in memory, the malware's infection chain incorporates other anti-analysis techniques designed to evade detection.

A compromised developer's repository serves as a worm-like infection vector to spread remote access Trojans (RATs) and other malware.

The cybercriminals infected older wireless Internet routers with Anyproxy and 5socks malware in order to reconfigure them — all without the users' knowledge.

Researchers found the threat actor attempting to use the now-patched flaw to load and execute a malicious dynamic link library on infected systems.

Both Android devices and iPhones are 3.5 times more likely to be infected with malware once "broken" and 250 times more likely to be totally compromised, recent research shows.

The malware, operated by China-backed cyberattackers, has been significantly fortified with new evasive and post-infection capabilities.

GoDaddy flagged a ClickFix campaign that infected 6,000 sites in a one-day period, with attackers using stolen admin credentials to distribute malware.

Once a user's device is infected as part of an ongoing Flax Typhoon APT campaign, the malware connects it to a botnet called Raptor Train, initiating malicious activity.

Attackers have compromised an 8-year-old version of the cloud platform to distribute various malware that can take over infected systems.

A new, improved variant on the group's malware combines fileless infection, BYOVD, and more to cause havoc in virtual environments.

Threat actors using the malware have infected systems within government, healthcare, and other critical infrastructure organizations since at least 2019.

Thousands of devices have become infected with "BadBazaar," malware previously used to spy on Uyghur and Turkic ethnic minorities in China.

"Operation Duck Hunt" is not likely to eliminate the initial access botnet forever, but the proactive removal of the malware from victim machines by law enforcement is one of the largest and most significant efforts of its kind.

An attack involves a multi-stage infection chain with custom malware hosted on Amazon EC2 that ultimately steals critical system and browser data; so far, targets have been located in Latin America.

Lemon Group's Guerrilla malware model an example of how threat actors are monetizing compromised Android devices, researchers say.

Malware that can steal data, track location, and perform click fraud was inadvertently built into apps via an infected third-party library, highlighting supply chain risk.

RapperBot's initial infection tactic is one example of the different methods attackers are using to distribute malware.

At least 1,200 Redis servers worldwide have been infected with "HeadCrab" cryptominers since 2021.

Using command-and-control servers from the decade-old Andromeda malware, the group is installing reconnaissance tools and a backdoor on previously infected systems to target Ukrainian victims.

An analysis of the malware and its infection strategies finds nearly 21,000 minor and 139 major variations on the malware — complexity that helps it dodge analysis.