Attackers are increasingly abusing Microsoft’s decades-old MSHTA utility to stealthily deliver stealers, loaders, and persistent malware through phishing, fake software downloads, and LOLBIN-based attack chains.

The post Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks appeared first on SecurityWeek.

At least one threat actor has adopted the recently released malware source code in attacks against NPM developers.

The post First Shai-Hulud Worm Clones Emerge appeared first on SecurityWeek.

Dubbed GopherWhisper, the group relies on multiple Go-based backdoors alongside custom loaders and injectors.

The post China-Linked APT GopherWhisper Abuses Legitimate Services in Government Attacks appeared first on SecurityWeek.

It targeted high-precision calculation software to tamper with results and packed a self-propagation mechanism.

The post Pre-Stuxnet Sabotage Malware ‘Fast16’ Linked to US-Iran Cyber Tensions appeared first on SecurityWeek.

The malware provides remote access and control of infected devices and maintains post-patching persistence.

The post US Federal Agency’s Cisco Firewall Infected With ‘Firestarter’ Backdoor appeared first on SecurityWeek.

Storm-2561 is distributing fake VPN clients through SEO poisoning, deploying trojans, and stealing login information.

The post Threat Actor Targeting VPN Users in New Credential Theft Campaign appeared first on SecurityWeek.

Hundreds of GitHub accounts were accessed using credentials stolen in the VS Code GlassWorm campaign.

The post ForceMemo: Python Repositories Compromised in GlassWorm Aftermath appeared first on SecurityWeek.

Other noteworthy stories that might have slipped under the radar: Telus Digital data breach, vulnerabilities in Linux AppArmor allow root privileges, US defense contractor behind Coruna exploits.

The post In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown appeared first on SecurityWeek.

Security researchers have seen the vulnerabilities being exploited to deliver shells, conduct reconnaissance, and download malware.

The post Ivanti Exploitation Surges as Zero-Day Attacks Traced Back to July 2025 appeared first on SecurityWeek.

The malware has been preinstalled on many devices but it has also been distributed through Google Play and other app stores.

The post New Keenadu Android Malware Found on Thousands of Devices appeared first on SecurityWeek.

GTIG and Mandiant said the zero-day tracked as CVE-2026-22769 has been exploited by UNC6201 since at least 2024.

The post Dell RecoverPoint Zero-Day Exploited by Chinese Cyberespionage Group appeared first on SecurityWeek.

Attackers are using DNS requests to deliver a RAT named ModeloRAT to targeted users.

The post Microsoft Warns of ClickFix Attack Abusing DNS Lookups appeared first on SecurityWeek.

With more than 37 million combined downloads, the extensions expose users to tracking and personal information theft.

The post Over 300 Malicious Chrome Extensions Caught Leaking or Stealing User Data appeared first on SecurityWeek.

Used since at least 2019, DKnife has been targeting the desktop, mobile, and IoT devices of Chinese users.

The post ‘DKnife’ Implant Used by Chinese Threat Actor for Adversary-in-the-Middle Attacks appeared first on SecurityWeek.

The malware is known for dropping ransomware and other payloads, and for abusing infected machines to proxy traffic.

The post SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown appeared first on SecurityWeek.

Palo Alto Networks has not attributed the APT activity to any specific country, but evidence points to China.

The post Cyberspy Group Hacked Governments and Critical Infrastructure in 37 Countries appeared first on SecurityWeek.

Albeit mainly considered a theoretical risk, the flaw has been exploited to disable protections and deliver malware.

The post Critical React Native Vulnerability Exploited in the Wild appeared first on SecurityWeek.

The attacks targeting Europe were analyzed by Ukraine’s CERT-UA and the cybersecurity company Zscaler.

The post Russia’s APT28 Rapidly Weaponizes Newly Patched Office Vulnerability  appeared first on SecurityWeek.

A hacker published malicious versions of four established VS Code extensions to distribute a GlassWorm malware loader.

The post Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack appeared first on SecurityWeek.

Security leaders share how artificial intelligence is changing malware, ransomware, and identity-led intrusions, and how defenses must evolve.

The post Cyber Insights 2026: Malware and Cyberattacks in the Age of AI appeared first on SecurityWeek.