Fake Arch AUR packages impersonate yay and paru, run as root
An AUR account uploaded typosquatted yay/paru packages whose install scripts fetched and ran a remote shell as root; the AUR team banned the account on October 13.
Stories tagged: #malware
Hirudo Android trojan swaps real banking apps for patched copies
ThreatFabric details Hirudo, an Android banker that uninstalls the real banking app and reinstalls a patched copy with a hooking engine to steal PINs, SMS, and screen data.
Fake Claude installers ride Google ads through Bing redirects
Push Security details 'Adception,' a malvertising chain abusing Google ad clicks and Bing click-tracking redirects to send macOS users to fake Claude installers running a ClickFix command.
Alleged Ploutus ATM malware developer appears in US court
The DOJ says Anibal Canelon Aguirre, alleged developer of Ploutus ATM jackpotting malware, appeared in Nebraska federal court after his arrest off the FBI's Ten Most Wanted list.
CloudSyncD: fake Zoom installer backdoors macOS, steals passwords
Jamf Threat Labs found CloudSyncD, a new macOS backdoor delivered by a fake Zoom installer that social-engineers past Gatekeeper and hides the user's password in a fake config file.
WordPress 'SC' malware self-heals via eight footholds, blockchain C2
Sucuri details 'SC,' a WordPress backdoor that rebuilds itself from eight files plus a DB drop-in and shared memory, and reads C2 instructions from Ethereum smart contracts.
Malicious custom GPT 'Plus 5.6' funnels users into ClickFix RAT
Huntress found a weaponized ChatGPT Custom GPT that pushes victims through a Google Sites ClickFix page to a PowerShell-delivered RAT. At least 40 incidents investigated.
macOS.Gaslight: DPRK Rust implant attacks LLM-based malware triage
SentinelLABS named macOS.Gaslight on June 23 — a Rust backdoor whose 3.5 KB prompt-injection payload is built to make an AI triage agent abort the analysis.
Symantec ties new Mistic backdoor to ransomware broker KongTuke
Symantec links a stealth in-memory backdoor used since April 2026 to KongTuke (Woodgnat), the initial-access broker that has fed Interlock, Rhysida, Akira, 8Base and Black Basta.