malware
11 live · 37 on record · last incident 1 day ago
Live11
- liveArcticRAT ArcticRAT Cybercrime Gang Profiles Victim Finances With AI
Breaches & attacks · Exploited · since 13 Nov 2026
The ArcticRAT Android malware campaign expanded to include full device control and AI-driven analysis of stolen financial information. The attackers leverage these capabilities to profile victim assets for targeted theft.
AI - liveWARDEN Stealer distributed via fake Grand Theft Auto VI download links
Breaches & attacks · Exploited · since 13 Nov 2026
Threat actors are using a Google Colab notebook to promote a fake Grand Theft Auto VI download that installs WARDEN Stealer. The malware targets saved passwords, browser cookies, gaming credentials, and cryptocurrency wallets.
Do:Do not download unauthorized game executables from untrusted sources or promotional links.
- liveScreenConnect Active ScreenConnect attacks breach MSPs and impact dozens of organizations
Breaches & attacks · Exploited · since 11 Nov 2026 · updated 13 Nov 2026 · CVE-2026-84869
Threat actors are actively exploiting ConnectWise ScreenConnect to deploy unauthorized remote-access software across managed service provider customer environments. ConnectWise is currently investigating the ongoing campaign.
Do:Apply the patch for CVE‑2026‑84869 to all ScreenConnect installations.
- liveMicrosoft Exchange Turla Cereal malware turns Exchange servers into spy hubs
Breaches & attacks · Exploited · since 10 Nov 2026
The Russia-aligned threat group Turla deployed a modular .NET toolset named Cereal on Microsoft Exchange servers at government organizations in Kazakhstan and Romania. The malware hijacks mail flow traffic to stealthily exfiltrate emails without requiring an external command-and-control server.
- livebee-js Hackers Compromise Ethersphere's bee-js and Swarm Desktop with Malware
Supply chain · Real loss · No fix needed · since 9 Nov 2026
Attackers compromised Ethersphere's release automation to publish malicious versions of bee-js and Swarm Desktop. The packages steal wallet keys, stored passwords, and install a backdoor.
Do:Downgrade or remove affected versions of bee-js and Swarm Desktop immediately and check for compromised wallet keys.
- liveGitHub repositories Fake security tools on GitHub push backdoors and infostealers
Supply chain · Exploited · No fix needed · since 6 Nov 2026
Threat actors are hosting malicious security projects on GitHub to target cybersecurity professionals. The fake repositories deliver infostealers and backdoors to unsuspecting users.
Do:Avoid downloading unverified security tools from untrusted GitHub accounts.
- liveControl Web Panel Hackers backdoor Linux servers using trojanized CWP web server
Supply chain · Exploited · No fix needed · since 5 Nov 2026 · updated 6 Nov 2026
Threat actors are distributing a new Linux backdoor named CWPdoor via a trojanized version of the Control Web Panel web server. The malicious binary enables attackers to execute commands silently without generating logs.
Do:Check servers for unauthorized modifications to the cwpsrv binary and remove any instances of CWPdoor.
- liveGrand Theft Auto VI Scammers use GTA VI hype to distribute malware and crypto scams
Breaches & attacks · Exploited · since 5 Nov 2026
Fraudsters are hosting fake Grand Theft Auto VI download sites that deliver malware and cryptocurrency scams to unsuspecting users. Netcraft identified multiple domains impersonating leaker CyberLeek and promising early access.
Do:Warn users to avoid downloading from untrusted GTA VI sites
- liveRussia-Linked Spies Target Ukrainian War Crimes Investigations
Breaches & attacks · Real loss · since 3 Nov 2026
Russia-linked cyber spies targeted Ukrainian organizations near the front lines using simple malware. The attackers stole sensitive documents, login credentials, and investigative data.
- liveVOLTA infostealer VOLTA Infostealer Employs LLMs for Victim Profiling and Prioritization
Research · since 31 Oct 2026 · updated 2 Nov 2026
Researchers analyzed the VOLTA infostealer, which steals sensitive credentials and cryptocurrency wallets while integrating large language models to profile victims. The malware automatically ranks high-value assets to maximize attacker efficiency.
AI - liveWindows NetamLoader Malware Targets Government Windows Systems in Asia
Breaches & attacks · Exploited · since 30 Oct 2026 · updated 1 Nov 2026
Threat actors are targeting government Windows systems in Asia using a previously unknown malware called NetamLoader. The malware abuses legitimate Microsoft software components to execute malicious code and evade security tools.
Earlier26
- closedChatGPT Yoba malware spreads via fake desktop versions of ChatGPT and Claude
Breaches & attacks · Exploited · since 29 Oct 2026
- closedCisco Catalyst SD‑WAN Cisco SD‑WAN Flaw Exploited to Deploy KeyDrift Malware
Breaches & attacks · Exploited · since 28 Oct 2026 · CVE-2026-20127
- closedMalicious apps prey on Russians' anxiety about fuel prices and drone strikes
Breaches & attacks · Exploited · since 27 Oct 2026
- closedAokigahara Stealer Aokigahara Stealer Malware Targets Developer Keyrings and AI Assistants
Breaches & attacks · Exploited · since 27 Oct 2026
AI - closedMicrosoft Teams Microsoft Teams IT Support Scams Deploy Malware and Ransomware
Breaches & attacks · Exploited · since 26 Oct 2026 · updated 27 Oct 2026
- closedOnline store platforms Malware Campaign Infects 953 Online Stores
Breaches & attacks · Exploited · since 26 Oct 2026
- closedLiteLLM LiteLLM release pipeline compromised to distribute info-stealer malware
Supply chain · Exploited · since 22 Oct 2026
AI - closedLiteLLM LiteLLM Package Compromised in Supply Chain Incident via Release Pipeline
Supply chain · Exploited · since 21 Oct 2026
AI - closedLiteLLM LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer
Supply chain · Exploited · since 21 Oct 2026 · updated 27 Oct 2026
AI - closedClickFix ClickFix malware campaign leverages fake AI tools and chatbot platforms as lures
Breaches & attacks · Exploited · since 21 Oct 2026
AI - closedClaude Fake Web3 Accelerator Uses Malicious npm Packages to Distribute Malware
Breaches & attacks · Exploited · since 19 Oct 2026
AI - closedLinux infrastructure AI-powered espionage campaign targets government Linux infrastructure
Breaches & attacks · Exploited · since 15 Oct 2026
AI - closedFake AI applications spread malware and steal enterprise sessions
Breaches & attacks · Exploited · since 15 Oct 2026
AI - closedLiteLLM LiteLLM Releases Contain Credential Harvesting Malware
Supply chain · Exploited · since 25 Mar 2026
AI - closedOpenClaw Malicious OpenClaw Skills Distribute AMOS Stealer via ClawHub
Supply chain · Exploited · since 1 Feb 2026
AI - closedSkynet malware Malware Prototype with Embedded Prompt Injection Discovered
Research · since 25 Jun 2025
AI - closedDeepfake ID generator Kimsuky Group Uses AI-Generated Military ID Deepfakes in Phishing
Breaches & attacks · Exploited · since 17 Jul 2025
AI - closedLAMEHUG LAMEHUG Malware Integrates LLM for Real-Time Command Generation
Breaches & attacks · Exploited · since 10 Jul 2025
AI - closedZoom North Korea-Linked Actors Use AI Executive Deepfakes in Zoom Phishing
Breaches & attacks · Exploited · since 22 Jun 2025
AI - closedZoom Deepfake Video Call Impersonation Leads to Account Theft and Malware
Breaches & attacks · Real loss · since 19 Jun 2025
AI - closedAI-Enabled Clickbait Campaign Targets Adolescents with Malware
Breaches & attacks · Exploited · since 30 May 2025
AI - closedNoodlophile Stealer Noodlophile Stealer Distributed via Fake AI Video Platforms
Breaches & attacks · Exploited · since 8 May 2025
AI - closedMeeten Campaign Deploys AI Branding to Distribute Realst Malware
Breaches & attacks · Exploited · since 6 Dec 2024
AI - closedFIN7 Linked to Malware Distribution via Fake AI Nudify Websites
Breaches & attacks · Exploited · since 2 Oct 2024
AI - closedNullBulge Malware NullBulge AI-Powered Malware Compromises Disney Employee and Internal Data
Breaches & attacks · Real loss · since 11 Jul 2024
AI - closedGPT-3.5 Underground Market for LLMs Powers Malware and Phishing Scams
Breaches & attacks · Exploited · since 1 Dec 2023
AI