Malware

Dramatic server room scene illustrating the SSHStalker Linux botnet infecting thousands of vulnerable servers via SSH exploits.

Researchers discover SSHStalker botnet infecting Linux servers

February 11, 2026 Iniulat ng AI Larawang ginawa ng AI

Flare researchers have identified a new Linux botnet called SSHStalker that has compromised around 7,000 systems using outdated exploits and SSH scanning. The botnet employs IRC for command-and-control while maintaining dormant persistence without immediate malicious activities like DDoS or cryptomining. It targets legacy Linux kernels, highlighting risks in neglected infrastructure.

Android malware returns disguised as TikTok or streaming apps

A banking trojan has resurfaced on Android devices, posing as popular apps including TikTok and various streaming services.

Scammers expand Claude malware campaign to target Mac users via ads and fake support sites

May 12, 2026 Iniulat ng AI

Building on earlier reports of fraudulent Claude sites, scammers have begun hijacking Claude AI chats and Google advertisements to distribute malware aimed at Mac users. Fake support pages for the Claude service are now circulating online as part of the scheme.

Teknolohiya

14,000 Asus routers infected by takedown-resistant KadNap malware

Crypto

Malicious npm packages harvest crypto keys and secrets

Teknolohiya

Massiv android malware targets portuguese users with fake iptv app

Researchers uncover new SysUpdate malware variant targeting Linux

Researchers at LevelBlue have identified a new variant of the SysUpdate malware aimed at Linux systems during a digital forensics and incident response engagement. The malware disguises itself as a legitimate system service and employs advanced encryption for command-and-control communications. By reverse-engineering it, the team created tools to decrypt its traffic more quickly.

New SysUpdate malware variant targets Linux systems

February 18, 2026 Iniulat ng AI

A new variant of the SysUpdate malware has been discovered targeting Linux systems, featuring advanced encryption for command-and-control communications. Security researchers at LevelBlue identified the threat during a digital forensics engagement and developed a tool to decrypt its traffic. The malware disguises itself as a legitimate system service to evade detection.

Attackers hijack Linux Snap Store apps to steal crypto phrases

Cybercriminals have compromised trusted Linux applications on the Snap Store by seizing expired domains, allowing them to push malware that steals cryptocurrency recovery phrases. Security experts from SlowMist and Ubuntu contributor Alan Pope highlighted the attack, which targets established publisher accounts to distribute malicious updates impersonating popular wallets. Canonical has removed the affected snaps, but calls for stronger safeguards persist.

AI-assisted VoidLink malware framework targets Linux cloud servers

January 21, 2026 Iniulat ng AI

Researchers at Check Point have revealed that VoidLink, a sophisticated Linux malware targeting cloud servers, was largely built by a single developer using AI tools. The framework, which includes over 30 modular plugins for long-term system access, reached 88,000 lines of code in under a week despite plans suggesting a 20-30 week timeline. This development highlights AI's potential to accelerate advanced malware creation.

May 11, 2026 06:22