malware Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 Microsoft has detailed a new Windows-based malware campaign, dubbed Windows Clipper, that leverages USB LNK files and a Tor-based command-and-control infrastructure to steal cryptocurrency data. The clipper silently moni… The Hacker News · Jun 18, 2026 High clipboardtorusb
threat-intel Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments A threat actor is employing deceptive tactics to promote a cryptocurrency clipboard hijacker, leveraging fake reviews, AI-generated content, and manipulated reputation systems across multiple online platforms. The campai… The Hacker News · Jun 17, 2026 High USfake reviewsreputation managementai
supply-chain 144 Mastra npm Packages Compromised via Hijacked Contributor Account A software supply chain attack, dubbed ‘easy-day-js,’ compromised 144 npm packages within the Mastra namespace by hijacking a contributor account. The attack leveraged a malicious dependency, ‘easy-day-js,’ to deploy a c… The Hacker News · Jun 17, 2026 High supply chainnpmjavascript
malware New Rokarolla Android malware targets 217 banking, crypto apps A new Android banking trojan, Rokarolla, is targeting 217 banking and cryptocurrency applications through deceptive app distribution and sophisticated data theft techniques. The malware leverages Accessibility permission… BleepingComputer · Jun 16, 2026 High androidbanking trojandata theft
threat-intel ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures ClickFix campaigns are expanding their malware delivery tactics with new loaders, including BabaDeda Loader, Lorem Ipsum Loader, and Storage Crypter, targeting education and financial organizations. These attacks utilize… The Hacker News · Jun 16, 2026 High RUBYsocial engineeringloaderpayload
malware New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds A new Android banking trojan, Rokarolla, has been identified by Zimperium, targeting over 200 banking and cryptocurrency apps. The malware utilizes techniques like fake login pages and Accessibility abuse to steal sensit… The Hacker News · Jun 16, 2026 High androidbanking trojanpin theft
threat-intel North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels North Korean threat actors, operating under the UNK_DeadDrop campaign, are employing a sophisticated phishing technique targeting developers across numerous sectors, including finance and cryptocurrency, using malicious… The Hacker News · Jun 15, 2026 High USGBAUdevelopergithubvscode
ransomware Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs Europol, in collaboration with international law enforcement, successfully disrupted AudiA6, a cryptocurrency laundering service used extensively by ransomware gangs and cybercriminals. The operation, resulting in the ar… The Hacker News · Jun 12, 2026 High UKRUGEcryptocurrencyransomwaremoney laundering
ransomware Authorities dismantle 'AudiA6' ransomware crypto-laundering service Law enforcement agencies have successfully dismantled the ‘AudiA6’ cryptocurrency service, which was used to launder over $380 million generated from ransomware attacks and other cybercriminal activities. The operation,… BleepingComputer · Jun 11, 2026 High POUKGEcryptocurrencyransomwaremoney laundering
threat-intel Chinese, N. Korean Threat Groups Build on Asia-Pacific Success This article reports on the ongoing cybercrime activities of North Korean and Chinese threat groups targeting financial firms and cryptocurrency assets within the Asia-Pacific region. Despite increased international coll… Dark Reading · Jun 11, 2026 High CHNOSOcybercrimecryptocurrencynorth korea
threat-intel ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories This bulletin highlights several ongoing cyber threats, including a high-severity SSRF vulnerability in Cisco Unified Communications Manager, a large-scale spyware operation targeting Russian officials by foreign intelli… The Hacker News · Jun 4, 2026 High CVE-2026-20230CVE-2022-0492CVE-2019-5736RUIRUSssrfspywarekeylogger
malware Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS A sophisticated operation is impersonating popular open-source and freeware tools like Ghidra and dnSpy to lure users to malicious websites via a Traffic Distribution System (TDS). This TDS then delivers malware, includi… The Hacker News · Jun 4, 2026 High TRPLBRtdsmalware-as-a-serviceclick interception
threat-intel DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets The U.S. Department of Justice, in collaboration with numerous international law enforcement agencies and private sector companies, disrupted a network of cybercrime groups operating out of Southeast Asia that were defra… The Hacker News · Jun 4, 2026 High USTHAUcryptocurrencyfraudscam
threat-intel US charges Google security engineer with Polymarket insider trading A Google security engineer, Michele Spagnuolo, has been charged with insider trading after exploiting confidential ‘Year in Search’ data to profit from bets on the Polymarket prediction market. He used his access to Goog… BleepingComputer · May 29, 2026 High USITSWinsider-tradingconfidential-datacryptocurrency
threat-intel This month in security with Tony Anscombe – May 2026 edition In May 2026, Poland experienced cyberattacks targeting industrial control systems at water treatment facilities, mirroring attacks against the Polish energy sector. Simultaneously, a previously unknown group conducted a… WeLiveSecurity · May 29, 2026 Medium PLicscyberattacksai
threat-intel JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS Malware A previously undocumented threat actor, dubbed JINX-0164, is targeting cryptocurrency firms through sophisticated social engineering tactics and bespoke macOS malware to steal digital assets. The campaign involves luring… The Hacker News · May 28, 2026 High KPmacossocial engineeringcryptocurrency
vulnerability Ghost CMS Vulnerability Exploited to Hack Over 700 Websites A previously disclosed SQL injection vulnerability (CVE-2026-26980) in the Ghost CMS has been actively exploited by multiple threat actors, leading to the compromise of over 700 websites. The attackers leveraged this vul… SecurityWeek · May 25, 2026 High CVE-2026-26980USGBsql injectionghost cmsvulnerability
malware Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms The Lazarus Group, a North Korean threat actor, has deployed a new memory-only remote access trojan (RAT) called RemotePE to target financial and cryptocurrency firms. This multi-stage attack chain utilizes several loade… The Hacker News · May 25, 2026 High KPremote access trojannorth koreasocial engineering
supply-chain TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO A sophisticated supply chain attack, dubbed TrapDoor, is spreading credential-stealing malware across npm, PyPI, and Crates.io, targeting developers in the crypto, DeFi, Solana, and AI communities. The attack utilizes a… The Hacker News · May 25, 2026 High USsupply-chaincredential-stealingdeveloper-workflow
ransomware Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet This article details the evolving landscape of cryptocurrency drainer operations, specifically focusing on the rise of "Drainer-as-a-Service" (DaaS) platforms like "Lucifer." These operations, rather than relying on dire… BleepingComputer · May 21, 2026 High USdrainerdaascryptocurrency
