Malware

Dramatic server room scene illustrating the SSHStalker Linux botnet infecting thousands of vulnerable servers via SSH exploits.

Researchers discover SSHStalker botnet infecting Linux servers

February 11, 2026 Reported by AI Image generated by AI

Flare researchers have identified a new Linux botnet called SSHStalker that has compromised around 7,000 systems using outdated exploits and SSH scanning. The botnet employs IRC for command-and-control while maintaining dormant persistence without immediate malicious activities like DDoS or cryptomining. It targets legacy Linux kernels, highlighting risks in neglected infrastructure.

Fake OpenAI repository tops Hugging Face downloads

Attackers have created a fake OpenAI repository on Hugging Face that has reached the top spot but installs infostealer malware.

Hackers create fake Claude site to spread malware

May 08, 2026 Reported by AI

Cybersecurity researchers have identified a fraudulent website mimicking the popular AI tool Claude that delivers backdoor malware to visitors. The discovery highlights how cybercriminals are capitalizing on growing interest in artificial intelligence platforms.

Technology

Massiv android malware targets portuguese users with fake iptv app

Linux

Researchers uncover new SysUpdate malware variant targeting Linux

Linux

New SysUpdate malware variant targets Linux systems

OpenClaw AI agents targeted by infostealer malware for first time

Infostealer malware has targeted OpenClaw AI agents for the first time, according to a TechRadar report. The incident highlights vulnerabilities in locally deployed AI systems that store sensitive information. The article was published on February 17, 2026.

North Korean hackers use AI video to spread malware

February 11, 2026 Reported by AI

A North Korean hacking group known as UNC1069 has employed AI-generated videos to deliver malware targeting both macOS and Windows systems. This tactic highlights evolving methods in cyber threats. The development was reported by TechRadar on February 11, 2026.

Check Point discovers advanced VoidLink Linux malware for clouds

Security researchers at Check Point have uncovered VoidLink, a sophisticated new Linux malware framework designed to target cloud infrastructures. Written in Zig and linked to Chinese developers, it features over 30 plugins for stealthy reconnaissance, credential theft, and lateral movement. No real-world infections have been observed yet, but its capabilities signal a growing threat to enterprise cloud environments.

China-linked UAT-7290 targets telecoms with Linux malware

January 08, 2026 Reported by AI

Cisco Talos has reported a China-linked threat actor known as UAT-7290 that has been spying on telecommunications companies since 2022. The group uses Linux malware, exploits on edge devices, and ORB infrastructure to maintain access to targeted networks.

May 05, 2026 12:10