Friday, November 6, 2026

Malware

North Korean Hackers Use Post-Quantum Encryption to Conceal Malware in New Cyberespionage Campaign

North Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware communications and payloads behind a multi-stage infection...

Hackers Plant Malware on Onamae.com Cloud Servers, 26,739 Systems Potentially Affected

Hackers gained unauthorized access to Onamae.com Desktop Cloud. They installed malicious programs in customer server environments, prompting the Japanese provider to suspend services across...

LiteLLM Supply Chain Compromise Exposes AI Developer Credentials to Malware Attacks

LiteLLM version 1.107.0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images. On October 21, 2026,...

Rust 1.100 Will Let Developers Block Fresh Cargo Packages to Reduce Malware Supply Chain Risks

Rust 1.100, scheduled for November 12, 2026, will introduce stable support for Cargo dependency cooldowns, allowing developers to reject newly published package versions until...

INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds

Ransomware affiliates associated with INC and The Gentlemen exposed an intrusion ecosystem after leaving operational servers publicly accessible. The investigation began in late September...

New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs

A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts...

New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads

ROMULUS, a shared ClickFix delivery platform operating across six identified servers, with confirmed routes distributing a trojanized Stardock package and LegionLoader. The discovery connects...

Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure

A server linked to a malware campaign attributed to a Midnight Blizzard-associated cluster was still delivering malicious files on October 5, 2026. The server returned...