Malware

Dramatic server room scene illustrating the SSHStalker Linux botnet infecting thousands of vulnerable servers via SSH exploits.

Researchers discover SSHStalker botnet infecting Linux servers

February 11, 2026 An Ruwaito ta hanyar AI Hoton da AI ya samar

Flare researchers have identified a new Linux botnet called SSHStalker that has compromised around 7,000 systems using outdated exploits and SSH scanning. The botnet employs IRC for command-and-control while maintaining dormant persistence without immediate malicious activities like DDoS or cryptomining. It targets legacy Linux kernels, highlighting risks in neglected infrastructure.

Hackers create fake Claude site to spread malware

Cybersecurity researchers have identified a fraudulent website mimicking the popular AI tool Claude that delivers backdoor malware to visitors. The discovery highlights how cybercriminals are capitalizing on growing interest in artificial intelligence platforms.

Daemon Tools app hit by monthlong supply-chain attack

May 05, 2026 An Ruwaito ta hanyar AI

Daemon Tools, a popular disk image mounting app, was compromised in a supply-chain attack starting April 8, delivering malware through official updates. Security firm Kaspersky reported infections on thousands of machines across over 100 countries. Users are urged to scan their systems immediately.

Linux

Researchers uncover new SysUpdate malware variant targeting Linux

Linux

New SysUpdate malware variant targets Linux systems

Fasaha

OpenClaw AI agents targeted by infostealer malware for first time

North Korean hackers use AI video to spread malware

A North Korean hacking group known as UNC1069 has employed AI-generated videos to deliver malware targeting both macOS and Windows systems. This tactic highlights evolving methods in cyber threats. The development was reported by TechRadar on February 11, 2026.

Researchers uncover ShadowHS Linux exploitation framework

January 30, 2026 An Ruwaito ta hanyar AI

Cyble Research and Intelligence Labs has revealed ShadowHS, a sophisticated fileless framework for post-exploitation on Linux systems. The tool enables stealthy, in-memory operations and long-term access for attackers. It features a weaponized version of hackshell and advanced evasion techniques.

China-linked UAT-7290 targets telecoms with Linux malware

Cisco Talos has reported a China-linked threat actor known as UAT-7290 that has been spying on telecommunications companies since 2022. The group uses Linux malware, exploits on edge devices, and ORB infrastructure to maintain access to targeted networks.

React2Shell exploits continue with large-scale Linux backdoor deployments and cloud credential theft

December 16, 2025 An Ruwaito ta hanyar AI

Ongoing exploitation of the React2Shell vulnerability (CVE-2025-55182)—previously detailed in coverage of China-nexus and cybercriminal campaigns—now includes widespread Linux backdoor installations, arbitrary command execution, and large-scale theft of cloud credentials.

March 13, 2026 21:43