Daily
The Press Corner
A short résumé of each security publication from the daily scan, with the topic and a link to the original. The scan runs every day at 01:15 UTC. If that run misses, the next hourly pass picks it up. Last scan Oct 23, 2026.
English. 1–15 of 40
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil
LiteLLM release pipeline hacked to distribute credential-stealing malware
Hackers hijacked the software release pipeline of LiteLLM, a popular open-source AI gateway, to distribute credential-stealing malware, marking the project’s second supply chain compromise this year despite security measures introduced after an earlier attack. The compromised version, 1.107.0, was distributed…
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Evooo1Bot exploits known flaws to infect Linux edge devices, then adds SOCKS5 proxying, SSH brute force, credential theft, and DDoS.
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 108
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter TAG-195 Upgrades MaaS Ecosystem with Modular Tools Inside a DPRK BlueNoroff ClickFix Kit SourTrade: Browser-Assembled Malware Delivered Through Malvertising…
FBI Seizes NetNut Proxy Platform, Popa Botnet – Krebs on Security
FBI Seizes NetNut Proxy Platform, Popa Botnet – Krebs on Security
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm – Krebs on Security
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm – Krebs on Security
Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations
Fast16 corrupted nuclear simulations via 101 hook rules, targeting LS-DYNA and AUTODYN to sabotage weapons research.
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 86
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Technical Deep Dive: The Monero Mining Campaign Operation Olalampo: Inside MuddyWater’s Latest Campaign VShell and SparkRAT Observed in Exploitation of BeyondTrust…
PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence
PromptSpy Android malware abuses Google Gemini to analyze screens, automate persistence, block removal, and enable VNC-based remote device control.
Kimwolf Botnet Lurking in Corporate, Govt. Networks – Krebs on Security
Kimwolf Botnet Lurking in Corporate, Govt. Networks – Krebs on Security
Who Operates the Badbox 2.0 Botnet? – Krebs on Security
Who Operates the Badbox 2.0 Botnet? – Krebs on Security
New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector
ESET links Russia-backed Sandworm to a failed December 2025 cyberattack using DynoWiper malware against Poland’s power and renewable energy systems.
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
VVS Stealer is a Python-based malware sold on Telegram that steals Discord tokens, browser data, and credentials using heavy code obfuscation.
React2Shell under attack: RondoDox Botnet spreads miners and malware
RondoDox botnet exploits the critical React2Shell flaw (CVE-2025-55182) to infect vulnerable Next.js servers with malware and cryptominers. CloudSEK researchers warn that the RondoDox botnet is exploiting the critical React2Shell flaw (CVE-2025-55182) to drop malware and cryptominers on vulnerable Next.js servers.
Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale
Android attackers use fake apps and droppers to spread the Wonderland SMS stealer, stealing OTPs, SMS data, and bank funds, mainly in Uzbekistan.