A new sophisticated mobile spyware platform, dubbed ZeroDayRAT, has emerged, targeting both Android and iOS devices for real-time surveillance and extensive data theft. The platform, first observed on February 2, 2026, is being openly sold via Telegram, offering cybercriminals a cross-platform tool to compromise smartphones. Researchers at iVerify identified ZeroDayRAT…

State-sponsored threat actors known as Lotus Blossom have successfully infiltrated the official hosting infrastructure of Notepad++, a widely used open-source code editor. This compromise, which occurred between June and December 2025, allowed the attackers to target government agencies, telecommunications firms, and critical infrastructure operators. The breach enabled Lotus Blossom to…

Google has issued urgent security updates for its popular Chrome browser to patch a critical, actively exploited zero-day vulnerability, CVE-2026-2441. This high-severity flaw, described as a use-after-free bug within the browser’s CSS engine, poses a significant risk, allowing remote attackers to execute arbitrary code within the browser’s sandbox. The discovery…

A new phishing campaign is actively distributing an updated variant of the XWorm Remote Access Trojan (RAT), a malware that grants cybercriminals extensive control over infected Microsoft Windows systems. First identified in 2022, XWorm remains a readily accessible tool for threat actors, frequently traded on Telegram-based marketplaces, contributing to its…

A new wave of cyberattacks, dubbed “ClickFix,” is actively targeting Windows users, employing sophisticated social engineering tactics to trick individuals into executing malicious code and installing the potent StealC information stealer malware. This alarming trend was identified by researchers at LevelBlue, who observed attackers compromising legitimate websites to host deceptive…

A burgeoning threat actor, designated UAT-9921, has been actively deploying a sophisticated new malware framework known as VoidLink in cyber espionage campaigns targeting critical technology and financial services sectors. Cisco Talos researchers revealed that this previously unidentified group has been leveraging the modular framework since at least September 2025, posing…

Over half a million users of VKontakte, Russia’s largest social network, have been affected by a sophisticated malware campaign that hijacks accounts through malicious Chrome extensions. The compromised extensions, masquerading as tools for VK customization, silently subscribed users to attacker-controlled groups, manipulated account settings, and maintained persistent unauthorized access by…

Cybercriminals are increasingly leveraging compromised game launchers and cracked software to distribute malware, with a new campaign identified by Securelist analysts highlighting the sophisticated techniques at play. This trend, amplified by the widespread desire for free access to premium content, now sees malware disguised within legitimate-looking game components, such as…

A new and sophisticated malware loader named OysterLoader has been identified, posing a significant threat to cybersecurity. This advanced threat, first detailed in June 2024 by Rapid7, utilizes multi-stage evasion techniques and advanced obfuscation methods to bypass security defenses and deliver malicious payloads. OysterLoader has been strongly linked to Rhysida…

Threat actors are actively exploiting a critical security vulnerability impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products, security researchers at watchTowr have reported. The flaw, identified as CVE-2026-1731, carries a critical CVSS score of 9.9 and could allow unauthenticated attackers to execute arbitrary operating system commands, leading…

Over 1,800 Windows servers globally have been compromised by a sophisticated malware campaign dubbed BADIIS, which targets Internet Information Services (IIS) environments. This large-scale operation transforms legitimate web infrastructure into a platform for SEO poisoning, manipulating search engine results to promote illicit gambling and cryptocurrency sites. The attack vectors are…

A sophisticated new self-propagating SSH worm has been identified by cybersecurity researchers, capable of completely compromising Linux systems within seconds using a combination of credential stuffing and multi-stage malware. This potent threat exploits weak authentication mechanisms, particularly on Internet of Things (IoT) devices like Raspberry Pi computers, highlighting persistent vulnerabilities…