Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 116
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Threat Intel | One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution
CARBONATO Is the First Botnet Where the Command-and-Control Engine Is an AI Agent — and It Has Been Running Since October 2024
CARBONATO is a Docker-based botnet that utilizes an autonomous AI agent as its command-and-control (C2) engine rather than a static server. Discovered by ThreatDown researchers in August 2026, this is the first documented instance where the C2 infrastructure
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aime
New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions.
ReflectivePluginLoader
Skip to contentHacking, PenTest, and Cybersecurity Tools for Your Security Arsenal! Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to fi
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/main
PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify th
Hackers Weaponize Public iCloud Calendars To Deploy MacSync Malware
Cybersecurity researchers at Kaspersky have uncovered a sneaky new variant of the MacSync malware, revealing a unique tactic where attackers exploit public Apple iCloud calendar events to secretly dump malicious payloads onto macOS devices. Originally appear
This Mac malware is somehow using iCloud calendar invites to try and steal your data
Kaspersky uncovers MacSync, a Mac infostealer delivered via iCloud calendar events and fake appsLoader fetches instructions from calendar entries, then deploys malware exfiltrating c
That shipping rebate offer may come with a monthly charge
Thanks to Malwarebytes research engineer Stefan Dasic for his help with this article. A name like ShipmentsFree suggests a way to save on shipping. The service does offer shipping rebates, but its B
RemControl Banking Trojan Gives Attackers Remote Control of Android Devices
A newly-discovered Android banking trojan abuses Accessibility Services to gain remote control over victims devices and collect credentials including PIN codes, mobile banking codes and card expiry d
SectopRAT Returns, Hiding Inside a Legitimate Application
The latest activity from the remote access Trojan (RAT) shows why organizations should monitor the behavior of applications rather than blindly trusting them, experts say.