Hotel Phishing Campaign Uses Ethereum and TON Blockchains to Rotate Malware C2 Servers
The emails deliver EtherRAT or TONResolver, two malware families that use public blockchains to locate their command and control servers.
Instead of keeping a fixed...
Supply Chain Malware Uses Blockchain Transactions to Dynamically Rotate Command-and-Control Servers
Threat actors are using blockchain transactions to change command-and-control (C2) servers without updating malware already installed on compromised systems.
Unit 42 research published October...
PoeLLM Malware Targets Exposed AI Servers and Uses GitHub Poem to Hide C2
Black Lotus Labs has uncovered PoeLLM, a malware campaign targeting exposed artificial intelligence services and other internet-facing applications.
Active since at least April 2026,...
MALFEX npm Campaign Uses 8 Malicious Packages to Deploy RATs and Credential Stealers
Security researchers have detailed MALFEX, an npm supply-chain campaign that uses eight malicious packages to deliver remote access malware and credential stealers to Windows...
UAC-0277 Hackers Compromise 100+ Websites to Spread LUNEXSTEALER via ClickFix Attacks
Ukraine’s Computer Emergency Response Team, discovered more than 100 compromised websites in September 2026 distributing LUNEXSTEALER through fake Cloudflare verification pages.
The agency tracks...