Security firm Report URI says its threat intelligence tools have identified 15,579 compromised websites, collectively receiving an estimated 135 million visits a month. The infections include credit card skimmers, ClickFix malware traps, device-exploitation code and malicious redirects, introduced either through direct site compromises like WordPress flaws or via infected third-party scripts loaded by the sites.
scotthelme.co.uk
· 2026-11-06
Dr.Web researchers identified a GitHub-based campaign, running for roughly two years, that distributes trojanized security tools such as a fake Fscan output-formatting script to compromise Windows machines. The attackers have infected more than 2,000 systems, embedding malicious code in Visual Studio, Python and Go files that triggers a PowerShell-based infection chain delivering an Electron loader called Microsoft.exe, which disables security protections and injects further malware into legitimate processes.
bleepingcomputer.com
· 2026-11-06
The UK government released a batch of cybersecurity policy papers on Nov. 3, including an annual assessment from the National Cyber Security Centre stating it is 'highly likely' AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. The NCSC also said nation-states including China and Russia will likely routinely use AI-driven cyber tools to pursue geopolitical goals in the UK. The announcements followed last week's Autumn Budget 2026, which allocated nearly £200 billion toward AI-driven government cybersecurity projects.
darkreading.com
· 2026-11-06
OpsShield says attackers used stolen credentials to breach its CDN and push a malicious script through cPGuard's auto-update channel between 02:06 UTC on November 2 and roughly 12 hours later, affecting versions 5.88.12 through 5.88.19. The script harvested Linux password hashes, root database configs, root shell history, and SSH keys, uploading them to OpsShield's own licensing server, where the attacker pulled an average of 32 files per compromised customer.
bleepingcomputer.com
· 2026-11-03
Binance released a postmortem detailing how a months-long attack led to the largest crypto theft on record. It began in June when an engineer downloaded a malware-laced installer via a Google ad, continued in September when another engineer was lured through a fake hiring process into installing malware disguised as an interview assignment, and culminated on October 29th when attackers used Binance's internal AI tool to seize control of employee wallets.
theverge.com
· 2026-11-03
Google and industry partners took down the XCPE malware botnet, which infected over 1.3 million Android TV streaming boxes made by China-based Videostrong Technology. Google says Videostrong deliberately built a persistent backdoor into its devices and sold access to criminal groups, who used the devices for ad fraud, residential proxy networks, and further malware installation. Google also shut down command-and-control servers tied to more than a dozen related malware families affecting over 10 million additional devices, including set-top boxes, karaoke machines, and telehealth hardware.
bleepingcomputer.com
· 2026-11-02
Researchers at the CAIRN project identified a Windows infostealer called VOLTA-AUTODOXER that harvests credentials, crypto wallets, session tokens and personal data, then sends a structured profile of the victim to a large language model via OpenRouter. The model is prompted to act as a forensic intelligence analyst and rank how valuable the victim's compromised assets and identity are for further exploitation. The malware self-deletes after operation and has no attacker-controlled infrastructure, relying instead on cloud AI services to do its analysis.
blog.talosintelligence.com
· 2026-10-31
Cisco Talos researchers identified a new infostealer strain, internally dubbed Volta-Autodoxer, that after harvesting credentials, cookies and financial data compiles the stolen information and sends it to commercial LLMs. The AI is prompted to act as an intelligence analyst, producing a structured, citation-backed profile of the victim to help attackers prioritize high-value targets. Talos says it detected the malware via its new CAIRN framework but has not confirmed it is being used in active attacks.
wired.com
· 2026-10-31
Wired reported that hundreds of online poker players were allegedly targeted by malware called MeshAgent, installed via third-party multi-tabling tools, letting a hacker see victims' hole cards. The campaign reportedly ran long-term and may have netted millions of dollars across multiple major platforms, though Wired withheld the suspect's identity because no charges have been filed.
engadget.com
· 2026-10-29
Cisco Talos researchers identified a new threat group, UAT-11473, exploiting a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers and Managers, patched in February 2026, to install a custom malware framework called KeyDrift. The attacks targeted space and satellite services, defense and aerospace firms, and policy research organizations, aiming to steal encryption keys and control-plane traffic. KeyDrift comprises two components, PolyFlame and LittleFilch, which Talos says are under active development with new evasion techniques.
bleepingcomputer.com
· 2026-10-29
NordVPN's Threat Intelligence team identified malicious GitHub repositories disguised as the KyttyPS5 and AnyPS5 PlayStation 5 emulators. The fake projects install malware that adds exclusion rules to Microsoft Defender before deploying a program researchers suspect steals passwords and other personal data, and a cleanup script then erases its own traces.
techspot.com
· 2026-10-29
NordVPN's Threat Intelligence team found malicious GitHub repositories impersonating the popular PS5 emulation tools AnyPS5 and Kyttyps5, tricking users into downloading a zip file with a Windows executable that steals passwords. The malware checks for signs of a sandbox or virtual machine before activating, adds exclusion rules to Microsoft Defender to avoid detection, and runs a cleanup script two minutes after infection to erase its traces.
tomshardware.com
· 2026-10-29
GoKawiil