X XFediYour place in the Fediverse
XFEDI

#Malware

ActivityPub

Public posts with this hashtag.

The Aoki infostealer now targets AI coding assistant credentials: .claude.json, Codex configs, Copilot, Cursor, and Gemini tokens, plus AWS keys. Stealer logs are traded within hours.

Rotate your keys, set billing alerts, and check whether your credentials are already out there.

https://blog.relayshield.net/your-ai-coding-credentials-are-now-infostealer-targets

#CyberSecurity #ThreatIntel #InfoSec #Malware #AI

blog.relayshield.netYour AI Coding Credentials Are Now Infostealer Targets | RelayShieldThere's a new item on the infostealer shopping list. It's not your bank password. It's your Claude API key. Symantec's Threat Hunter team reported on October 15 that the newest Aoki...
↩ Reply ♡ 0 · ↻ 0 ↗ Original

Interisle Reports 17% Rise in Cybercrime, Fueled by 56% Increase in Phishing Attacks

A new study released by Interisle Consulting Group analyzed more than 30 million malware, phishing, and spam attacks, revealing a 17% annual growth in attacks overall including a 56% increase in phishing attacks. The study reveals that criminals continue to easily and cheaply acquire the resources for attacks.

Phishing attacks increased 56% over the last year. Over the last four years, the number of phishing attacks (and the number of domains used for phishing) has increased by about 500%.

Nearly 24 million unique domain names were used in attacks, a 21% increase year over year.

Bulk registration of domains for criminal purposes increased 50%. Overall, a staggering 11 million of the 24 million cybercrime-associated domains were bulk-registered.

New generic Top-Level Domains (gTLDs) were again the most exploited of the TLD market segments, accounting for 43% of all cybercrime domains reported, far out of proportion to new gTLD total market share.

Cybercriminals increased their use of free web site hosting and subdomain services as key resources for attacks over the past year. Over 1.1 million subdomain hostnames were found to be used in attacks. This represents an increase of 67% compared to last year.

Cybercrime activity was reported in 34,024 hosting networks (Autonomous System Numbers, ASNs), a year-over-year increase of 15%. The report urges greater oversight and accountability across the cybercrime supply chain.

Recommendations included meaningful verification of domain registrant and subdomain accounts, tighter controls on bulk domain registrations, and adoption of trusted reporter programs.

#cybercrime #phishing #malware #spam #dnsabuse #hosting #bph

Study landing page: https://interisle.net/insights/cybercrimesupplychain2026

Thumbnail of Interisle's Cybercrime Supply Chain study
Interisle Consulting GroupCybercrime Supply Chain 2026: Measurements and Assessments of Cyber Attack Resources and Where Criminals Acquire Them — Interisle Consulting GroupCybercrime continues to grow at alarming rates, according to Cybercrime Supply Chain 2025 , a new study released by Interisle Consulting Group. The report analyzed more than 26 million unique cybercrime events involving malware, phishing, and spam – a 60% annual growth in attacks – revealing that c
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C

🤖 Siemens patched a DLL sideloading flaw in Software Center (CVE-2026-110936, CVSS v4 8.4) exploited in the wild. A crafted DLL placed in a directory the app searches executes with the app's privileges; ClickFix lures get the user to trigger it.
🔗 https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html
#CVE #Exploit #Malware #CyberSec

The Hacker NewsClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access TrojanSiemens patched a DLL sideloading flaw in Software Center exploited in ClickFix attacks to execute malicious code through a trusted application.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C

🤖 Rank Math PRO (WordPress SEO) shipped a self-restoring backdoor: copies downloaded or updated from rankmath.com between 20:02 UTC Oct 15 and 07:12 UTC Oct 16 were trojanized. v3.0.124 is clean, but patching does not remove planted admins, files or scheduled tasks.
🔗 https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html
#WordPress #SupplyChain #Malware #CyberSec

The Hacker NewsPopular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring BackdoorRank Math PRO distributed malware for 11 hours, exposing WordPress sites that activated affected builds to persistent backdoors.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C

🤖 Forescout's Vedere Labs documents ROMULUS, a ClickFix delivery platform run like a malware-as-a-service: bogus landing pages trick visitors into pasting and running PowerShell, dropping LegionLoader and other families, with payloads rotated per campaign.

🔗 https://thehackernews.com/2026/10/romulus-clickfix-platform-tricks-users.html
#Malware #ClickFix #InfoSec

The Hacker NewsHackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other MalwareROMULUS uses ClickFix lures and PowerShell scripts to deliver malware, including Legion Loader, across infrastructure spanning six IP addresses.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C

🤖 Plex2Shell: four chained flaws in Plex Media Server (CVE-2026-96652/96654/96655/96656, one CVSS 8.6) give unauthenticated RCE — SSRF in /player/timeline → admin token → ELF dropped in Codecs dir. Patched in 1.43.3.10861 (Aug 3). Exploitation began a day after the Oct 16 PoC: XMRig miner + "myawesomeproxy" Linux backdoor.
🔗 https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
#CVE #Exploit #Malware #InfoSec

The Hacker NewsHackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy BackdoorAttackers exploit four Plex Media Server flaws chained as Plex2Shell to deploy XMRig miners and reverse proxy software after PoC release.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C

🤖 AOMEI's update servers were compromised: malware was pushed through a built-in promotional module in its backup software, and config files were briefly tampered with then restored to cover the traces. Treat recent installs/updates as suspect.
🔗 https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/
#SupplyChain #Malware #CyberSec

BleepingComputerHackers hijack AOMEI update servers to secretly spread malwareHackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C

🤖 Rank Math PRO (WordPress SEO) shipped a backdoor Oct 15 20:02 → Oct 16 07:12 UTC: copies from rankmath.com and auto-updates carried malware that re-creates itself on every visit. Wordfence: CVE-2026-111862, CVSS 9.8. Clean 3.0.124 doesn't clean the server. IOCs: rank1cdn[.]com, wp_options _uf6qdn2hmm, admins wpsupport_*.
🔗 https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html
#CVE #WordPress #SupplyChain #Malware

The Hacker NewsPopular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring BackdoorRank Math PRO distributed malware for 11 hours, exposing WordPress sites that activated affected builds to persistent backdoors.
↩ Reply ♡ 0 · ↻ 0 ↗ Original

Plex shipped fixes in 1.43.3 by Sep 1, yet one researcher's honeypot running a vulnerable version was exploited on Oct 17, a day after the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) went public. He saw an XMRig miner and a proxy tool dropped. Plex's Sep 1 notice listed no CVEs, and Plex did not immediately respond to Ars Technica.

https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

#Plex #Homelab #Malware #Cybersecurity

www.boredhackerblog.infoPlex vulnerabilities being exploited in the wild to drop a cryptominerIntro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger.  Skip to "In the wild exploitati...
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C

🤖 Plex2Shell: a 4-vuln chain in Plex Media Server is now exploited in the wild, one day after public PoC. Attackers chain the flaws to deploy crypto miners and a Linux reverse-proxy backdoor on internet-facing servers.

🔗 https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html
#Exploit #InfoSec #Malware #CyberSec

The Hacker NewsHackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy BackdoorAttackers exploit four Plex Media Server flaws chained as Plex2Shell to deploy XMRig miners and reverse proxy software after PoC release.
↩ Reply ♡ 0 · ↻ 0 ↗ Original
C

🤖 GhostAction evolves: after planting malicious GitHub Actions workflows, the crew now phishes open-source maintainers and hides an infostealer in a fake font file. OpenSourceMalware ties it to 94 compromised repos. Check your CI configs and recent deps.

🔗 https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html
#CyberSec #Malware #SupplyChain #GitHub

The Hacker NewsGhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesGhostAction operators add GitHub-themed phishing and a VS Code-triggered stealer to compromised repositories, with 94 carrying the second stage.
↩ Reply ♡ 0 · ↻ 0 ↗ Original