Malware

Dramatic server room scene illustrating the SSHStalker Linux botnet infecting thousands of vulnerable servers via SSH exploits.

Researchers discover SSHStalker botnet infecting Linux servers

11. februar 2026 Rapportert av AI Bilde generert av AI

Flare researchers have identified a new Linux botnet called SSHStalker that has compromised around 7,000 systems using outdated exploits and SSH scanning. The botnet employs IRC for command-and-control while maintaining dormant persistence without immediate malicious activities like DDoS or cryptomining. It targets legacy Linux kernels, highlighting risks in neglected infrastructure.

Hackers create fake Claude site to spread malware

Cybersecurity researchers have identified a fraudulent website mimicking the popular AI tool Claude that delivers backdoor malware to visitors. The discovery highlights how cybercriminals are capitalizing on growing interest in artificial intelligence platforms.

Daemon Tools app hit by monthlong supply-chain attack

5. mai 2026 Rapportert av AI

Daemon Tools, a popular disk image mounting app, was compromised in a supply-chain attack starting April 8, delivering malware through official updates. Security firm Kaspersky reported infections on thousands of machines across over 100 countries. Users are urged to scan their systems immediately.

Linux

Researchers uncover new SysUpdate malware variant targeting Linux

Linux

New SysUpdate malware variant targets Linux systems

Teknologi

OpenClaw AI agents targeted by infostealer malware for first time

North Korean hackers use AI video to spread malware

A North Korean hacking group known as UNC1069 has employed AI-generated videos to deliver malware targeting both macOS and Windows systems. This tactic highlights evolving methods in cyber threats. The development was reported by TechRadar on February 11, 2026.

Researchers uncover ShadowHS Linux exploitation framework

30. januar 2026 Rapportert av AI

Cyble Research and Intelligence Labs has revealed ShadowHS, a sophisticated fileless framework for post-exploitation on Linux systems. The tool enables stealthy, in-memory operations and long-term access for attackers. It features a weaponized version of hackshell and advanced evasion techniques.

China-linked UAT-7290 targets telecoms with Linux malware

Cisco Talos has reported a China-linked threat actor known as UAT-7290 that has been spying on telecommunications companies since 2022. The group uses Linux malware, exploits on edge devices, and ORB infrastructure to maintain access to targeted networks.

React2Shell exploits continue with large-scale Linux backdoor deployments and cloud credential theft

16. desember 2025 Rapportert av AI

Ongoing exploitation of the React2Shell vulnerability (CVE-2025-55182)—previously detailed in coverage of China-nexus and cybercriminal campaigns—now includes widespread Linux backdoor installations, arbitrary command execution, and large-scale theft of cloud credentials.

fredag, 13. mars 2026, 21:43