Malware Archives - Recon Bee

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

21Aug

By RBNo Comments

News

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

After a compromised maintainer account issued releases that included a typosquatted dependency whose build script downloaded and ran a remote payload during compilation, the Rust Project removed harmful versions of three popular Rust crates from crates.io. The impacted releases, arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, were all withdrawn in 86 to 107 minutes after being published from the same owner account on August 20, 2026. Building a project that fixed the malicious code in the injected dependency's build script was enough to execute the payload; nothing from the crates themselves needed to be invoked. After the Rust Security Response Team unyanked the maliciously-yanked versions during the response, developers are recommended to pin arrayref at 0.3.9 or ...

Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

27Jul

By RBNo Comments

News

Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

Instead than sending a single malicious file from a predetermined URL, a malvertising technique known as SourTrade forces victims' browsers to construct the final Windows executable on their own using a valid Bun runtime as its foundation. Confiant, which described the effort on July 23, 2026, claimed to have been in operation since late 2024 and to have targeted retail traders and cryptocurrency investors in 12 countries in 25 languages by posing as TradingView, Solana, and Luno. Its landing pages fingerprint users, displaying an empty site to suspected researchers and bots while providing a plausible replica of the spoof service to chosen targets. Installing trading and wallet software from the vendor's website rather than an advertisement is the standard defense against that. ...

Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware

1Jul

By RBNo Comments

News

Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware

Web addresses that don't exist are constantly being created by large language models. In order to obtain traffic that AI tools direct to them, attackers have begun purchasing those fictitious domains before anybody else can, then hosting phishing pages on them. The tactic known as "phantom squatting" is already occurring in the wild, according to new research from Palo Alto Networks' Unit 42. Trust is the reason it counts. The links that a model returns are increasingly regarded as authentic by developers and AI helpers. When a model creates a brand-new domain, all of that mistaken faith is transferred to the first person to register it; phishing emails and dangerous advertisements are not necessary. Unit 42 asked two AI models 685,339 questions regarding 913 well-known businesse...

DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware

6May

By RBNo Comments

News

DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware

According to research by Kaspersky, a recently discovered supply chain assault that targets DAEMON Tools software has infected its installers to serve a malicious payload. According to Kaspersky researchers Igor Kuznetsov, Georgy Kucherin, Leonid Bezvershenko, and Anton Kargin, these installers are disseminated via the official DAEMON Tools website and are signed with digital certificates that belong to the DAEMON Tools creators. Since April 8, 2026, the installers have been trojanized; the compromised versions range from 12.5.0.2421 to 12.5.0.2434. Kaspersky informed The Hacker News that just the Windows version of DAEMON Tools was affected, despite the fact that it is also available for Mac. As of this writing, the supply chain attack is ongoing. The software's creator, AVB Disc S...

n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails

16Apr

By RBNo Comments

News

n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails

Threat actors have been seen using n8n, a well-known artificial intelligence (AI) workflow automation tool, as a weapon to enable complex phishing campaigns and send automated emails that transmit malware payloads or fingerprint devices. According to an analysis released today by Cisco Talos researchers Sean Gallagher and Omid Mirzaei, these attackers circumvent conventional security filters by using trusted infrastructure, transforming productivity tools into delivery vehicles for permanent remote access. N8n is a platform for workflow automation that enables users to connect different web apps, APIs, and AI model services in order to conduct recurring rule-based processes, create agentic systems, and sync data. To use a managed cloud-hosted service and automate workflows withou...

DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

31Mar

By RBNo Comments

News

DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

A new operation has used the ClickFix social engineering technique to spread DeepLoad, a malware loader that was previously unreported. In a report shared with The Hacker News, ReliaQuest researchers Thassanai McCabe and Andrew Currie stated that while credential theft begins instantly and captures passwords and sessions even if the primary loader is blocked, it probably uses AI-assisted obfuscation and process injection to avoid static scanning. The attack chain begins with a ClickFix bait that deceives users into executing PowerShell commands by pasting the command into the Windows Run dialog under the guise of fixing a nonexistent problem. This then downloads and launches an obfuscated PowerShell loader using "mshta.exe," a valid Windows tool. For its part, it has been discove...

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

3Feb

By RBNo Comments

News

APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

Attacks using a recently revealed Microsoft Office security vulnerability have been linked to the Russia-affiliated state-sponsored threat actor APT28 (also known as UAC-0001) as part of a campaign called Operation Neusploit. Three days after Microsoft made the bug public, on January 29, 2026, Zscaler ThreatLabz reported that it saw the hacker organization using the vulnerability as a weapon in assaults against people in Romania, Slovakia, and Ukraine. CVE-2026-21509 (CVSS score: 7.8) is a Microsoft Office security feature bypass vulnerability that could enable an unauthorized attacker to deliver a specially designed Office file and cause it to activate. According to security experts Sudeep Singh and Roy Tay, social engineering lures were created in both English and localized lan...

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

2Feb

By RBNo Comments

News

Notepad++ Official Update Mechanism Hijacked to Deliver Malware to Select Users

The maintainer of Notepad++ has reported that state-sponsored attackers hijacked the utility's update mechanism to divert update traffic to malicious servers instead. The attack involves [an] infrastructure-level compromise that allowed malicious actors to intercept and divert update traffic destined for notepad-plus-plus.org, developer Don Ho stated. The compromise occurred at the hosting provider level rather than through weaknesses in Notepad++ code itself. Ho continued, "The precise mechanism through which this was realized is currently being investigated." The development comes a little over a month after Notepad++ released version 8.8.9 to solve an issue that resulted in traffic from WinGUp, the Notepad++ updater, being "occasionally" routed to malicious domains, resulting ...

Google disrupts IPIDEA residential proxy networks fueled by malware

30Jan

By RBNo Comments

News

Google disrupts IPIDEA residential proxy networks fueled by malware

Earlier this week, Google Threat Intelligence Group (GTIG) and industry partners destroyed IPIDEA, one of the biggest residential proxy networks utilized by threat actors. IPIDEA service-related domains, compromised device management, and proxy traffic routing were all taken down. Additionally, knowledge has been supplied on the IPIDEA software development kits (SDK) that distributed the proxying tool. With 6.7 million customers worldwide, IPIDEA is marketed by its proprietors as a VPN service that encrypts your internet traffic and conceals your true IP address. After hacking network devices, residential proxy networks redirect traffic using IP addresses belonging to home users or small businesses. Typically, the infection happens through trojanized programs read more about Goog...

New malware service guarantees phishing extensions on Chrome web store

27Jan

By RBNo Comments

News

New malware service guarantees phishing extensions on Chrome web store

"Stanley" is a new malware-as-a-service (MaaS) that offers to publish malicious Chrome extensions to the Chrome Web Store after passing Google's review process. The project Stanley was dubbed by researchers at end-to-end data security firm Varonis after the seller's alias, who offers simple phishing assaults by intercepting navigation and covering a webpage with an iframe containing the attacker's preferred content. Malicious Chrome extensions that can cover a webpage with a full-screen iframe carrying phishing content of the attacker's choosing are the focus of the new MaaS solution. Stanley also promotes support for personalized adjustments and silent auto-installation on Chrome, Edge, and Brave browsers. The most costly of the MaaS's subscription tiers is the Luxe Plan, which ...