MATCHBOIL Malware Uses Sandbox Evasion and Strong Obfuscation to Deploy MATCHWOK Backdoor
ESET researchers have traced the evolution of MATCHBOIL, a custom C# downloader used by the Russia-aligned UAC-0099 cyberespionage group.
The malware downloads, installs, and...
Malicious Tensorlake npm Package Steals AWS Keys, SSH Credentials and Crypto Wallet Data
A threat actor published a compromised version of the Tensorlake npm package on October 8, 2026, embedding malware designed to steal developer secrets and...
16 Firefox Extensions Caught Stealing Crypto Wallet Recovery Phrases and Private Keys
Threat Research has uncovered a coordinated campaign involving 16 malicious Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys.
The extensions...
Hotel Phishing Campaign Uses Ethereum and TON Blockchains to Rotate Malware C2 Servers
The emails deliver EtherRAT or TONResolver, two malware families that use public blockchains to locate their command and control servers.
Instead of keeping a fixed...
Supply Chain Malware Uses Blockchain Transactions to Dynamically Rotate Command-and-Control Servers
Threat actors are using blockchain transactions to change command-and-control (C2) servers without updating malware already installed on compromised systems.
Unit 42 research published October...