Malware preinstalled on cheap Android phones generates ad fraud
Malware has been discovered preinstalled on thousands of inexpensive Android phones, capable of generating fraudulent ad revenue and potentially turning infe...
Malware
Unknown
auto-detected
AI Intelligence Brief cached
Edit Profile
Entity Relationships
Related YARA Rules View all on YARA Rules page →
90-Day Activity
All Articles (441)
Last 90 Days
All Time
FakeGit campaign reactivates, distributing SmartLoader malware via GitHub
More than 17,000 fake repositories on GitHub are currently distributing the SmartLoader malware, a reactivation of the FakeGit campaign that began earlier th...
Sophisticated malware downloader MatchBoil targets Ukrainian organizations
A likely Russia-affiliated cyber-espionage group, identified as UAC-0099, is employing an increasingly sophisticated malware downloader named MatchBoil to ta...
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer, a C# information stealer first publicly identified in April 2026, has expanded its capabilities beyond credential theft. New samples analyzed ...
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Midnight Mimosa is the name given to a malware campaign primarily running preinstalled on low-cost Android devices. The post Pre-Baked Firmware Malware Hits ...
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
A campaign in July 2026 using a trojanized Terraform provider to deploy cross-platform malware against developer environments. The operation delivers FLATROO...
Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data
Warden Stealer as a rapidly growing malware-as-a-service operation targeting data stored by AI assistants and coding agents, including Claude, Codex, Grok, a...
MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2
MATCHBOIL’s evolution from a basic C# downloader into a more evasive implant supporting recurring command-and-control communication. Operated by UAC-0099, th...
What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts.
Low-cost Android phones ship with residential proxy malware
A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware,...
FakeGit malware campaign returns with 17,610 malicious GitHub repos
More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the S...
Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones
Low-cost Android phones can arrive already compromised, with malware embedded in their firmware before buyers switch them on.
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
A threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud sup...
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
Russia-aligned UAC-0099 has steadily upgraded its MATCHBOIL downloader since 2024
Thousands of cheap Android phones shipped with ad-fraud malware
"It’s on the phone before the owner switches it on for the first time, and it can’t be uninstalled," researchers at Bitdefender said about ad fraud malware f...
Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
Russian-aligned hackers have targeted Ukrainian transportation, manufacturing and energy companies with a constantly evolving malware strain designed to harv...
Hackers Target Hotels With Fake Guest Complaints to Deploy Blockchain-Based RAT Malware
Hackers are targeting hotels with fabricated guest complaints and negative reviews to distribute EtherRAT and TONResolver, two malware families that abuse pu...
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windo...
PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion
A cryptocurrency mining campaign dubbed PoeLLM has compromised more than 3,400 servers by targeting exposed AI infrastructure and other internet-facing appli...
Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
MALFEX, a persistent npm supply-chain campaign distributing Windows malware through eight malicious packages. Linked to an apparent single operator active si...