Malware — Cybersecurity News

Most Popular News

Top stories by views
Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials
1,591 views
CVE category

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

RedSide Security April 04, 2026
Read: Hackers Exploit CVE-2025-55182 to Breach…
Passwd: A walkthrough of the Google Workspace Password Manager
472 views

Passwd: A walkthrough of the Google Workspace Password Manager

Dec 26, 2025
Top 10 High-Risk Vulnerabilities Of 2025 that Exploited in the Wild
463 views

Top 10 High-Risk Vulnerabilities Of 2025 that Exploited in the Wild

Jan 02, 2026
Google Patches Actively Exploited Chrome Zero-Day (CVE-2026-2441)
459 views

Google Patches Actively Exploited Chrome Zero-Day (CVE-2026-2441)

Feb 17, 2026
OpenAI Hardened ChatGPT Atlas Against Prompt Injection Attacks
443 views

OpenAI Hardened ChatGPT Atlas Against Prompt Injection Attacks

Dec 29, 2025
PCAPGraph: Threat Hunting at the Speed of Triage

PCAPGraph: Threat Hunting at the Speed of Triage

PCAPGraph is an open-source network investigation and threat hunting tool that transforms packet cap...

June 04, 2026
Open-Source Network Discovery & Topology Mapping

Open-Source Network Discovery & Topology Mapping

RedSide Security has open-sourced NETMAPPER, a network discovery and visualization tool designed to ...

June 03, 2026
RDPGraph: Turn Windows Event Logs into an Interactive RDP Attack Graph

RDPGraph: Turn Windows Event Logs into an Interactive RDP Attack Graph

When an incident unfolds and all you have left are Windows event logs, understanding attacker moveme...

June 03, 2026

Latest Posts

New "Spirals" Ransomware Encrypts Enterprise Network in Under 24 Hours

New "Spirals" Ransomware Encrypts Enterprise Network in Under 24 Hours

RedSide Security July 18, 2026 Cybercrime 106 views

A newly discovered ransomware family named Spirals encrypted an enterprise network in less than 24 hours after compromising an internet-facing IIS server. The Rust-based ransomware used web shells, Cloudflare tunnels, credential dumping, WMI, and PsExec to achieve rapid domain-wide deployment before encrypting systems and threatening data leaks.

SOC Cybersecurity Malware ThreatIntelligence RedSideSecurity ActiveDirectory ThreatHunting BlueTeam IncidentResponse WindowsSecurity InfoSec Ransomware Spirals IIS WebShell PsExec WMI CredentialDumping LSASS EnterpriseSecurity
Continue reading: New "Spirals" Ransomware Encrypts Enterprise Netwo…
AI-Generated "Vibe-Coded" PowerShell Malware Used for Active Directory Reconnaissance

AI-Generated "Vibe-Coded" PowerShell Malware Used for Active Directory Reconnaissance

RedSide Security July 13, 2026 Cybersecurity 87 views

Researchers uncovered an AI-generated PowerShell script used to enumerate Active Directory environments during a real-world intrusion. The "vibe-coded" malware demonstrates how attackers are increasingly using AI to create custom reconnaissance tools that evade traditional signature-based detection while retaining the same underlying attack behaviors.

SOC SIEM Cybersecurity AI Malware ThreatIntelligence RedSideSecurity ActiveDirectory PowerShell VibeCoding ArtificialIntelligence ThreatHunting DetectionEngineering BlueTeam RedTeam IncidentResponse WindowsSecurity Huntress EDR InfoSec
Continue reading: AI-Generated "Vibe-Coded" PowerShell Malware Used …
Jscrambler npm Package Compromised - Malicious Releases Deploy Cross-Platform Infostealer

Jscrambler npm Package Compromised - Malicious Releases Deploy Cross-Platform Infostealer

RedSide Security July 13, 2026 Vulnerability 68 views

Attackers compromised the Jscrambler npm package and published multiple malicious versions containing a cross-platform Rust infostealer. The malware targets cloud credentials, GitHub tokens, AI coding tools, cryptocurrency wallets, and CI/CD environments, highlighting the growing risk of software supply chain attacks against developers.

Cybersecurity AI OpenSource Malware AWS DevSecOps GitHub SupplyChainAttack NPM NodeJS JavaScript Infostealer CloudSecurity Azure GoogleCloud CI_CD ThreatIntelligence MCP SecurityNews RedSideSecurity
Continue reading: Jscrambler npm Package Compromised - Malicious Re…
Critical SimpleHelp Flaw Actively Exploited to Deploy TaskWeaver Loader and Djinn Stealer

Critical SimpleHelp Flaw Actively Exploited to Deploy TaskWeaver Loader and Djinn Stealer

RedSide Security June 30, 2026 Cybersecurity 70 views

Threat actors are actively exploiting CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp RMM software, to deploy the TaskWeaver loader and Djinn Stealer. The malware targets cloud credentials, developer tools, AI platforms, cryptocurrency wallets, and enterprise infrastructure across Windows, macOS, and Linux systems.

Cybersecurity Linux Security Threat Intelligence Authentication Bypass AI Security SimpleHelp CVE-2026-48558 RMM Security Remote Monitoring and Management TaskWeaver Djinn Stealer Malware Information Stealer CISA KEV OpenID Connect OIDC Azure AD Cloud Security AWS Microsoft Azure Google Cloud DevOps Security OpenAI Anthropic Claude Cryptocurrency Theft Windows Security macOS Security
Continue reading: Critical SimpleHelp Flaw Actively Exploited to Dep…