AI Gateway Connected to Amazon Bedrock Hijacked for Cryptomining

Darktrace says a LiteLLM AI gateway linked to Amazon Bedrock was compromised for cryptomining after signs of exposed SSH activity.

·

Amazon, Amazon Bedrock, Artificial Intelligence, Bedrock AI, Crypto, Cryptomining, Cyber Attack, cybersecurity, Darktrace, Malware, Security, SSH, vulnerability

¶¶¶¶¶

npm and PyPI Malware Campaign Exfiltrates CI/CD Secrets Through Fake Payment SDKs

A coordinated supply-chain campaign that pushed 17 malicious packages across npm and PyPI, masquerading as SDKs for well-known payment services including PaySafe, Skrill and Neteller. The campaign’s packages 17 npm modules published with four rapid ver…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

SNOW Malware Ecosystem Uses Teams Phishing, WebSocket Tunnels, and Browser Extensions

Threat actors are increasingly chaining classic phishing with collaboration platforms and covert tunneling to create highly believable intrusion paths. A recent multi-stage campaign attributed to UNC6692 exposes how adversaries combine email bombardmen…

·

cyber security, Cyber Security News, Malware, Phishing

¶¶¶¶¶

Umbrij Malware Lets ToddyCat Hackers Hijack Gmail Accounts Through Google API Abuse

A targeted campaign in which the ToddyCat (aka APT-style) group leverages a previously observed loader family, Umbrij, to hijack Gmail accounts by abusing Google APIs. Chaining that capability to broad remote access achieved through a malicious MSI ins…

·

cyber security, Cyber Security News, Gmail, Malware

¶¶¶¶¶

Armored Likho Hits Government, Energy Sectors With BusySnake Stealer

Kaspersky details how the newly named Armored Likho APT uses BusySnake Stealer, AI-generated loaders, and phishing to target government and energy organizations.

·

AI, Armored Likho, Brazil, BusySnake Stealer, Cyber Attack, Cyber-Attacks, cybersecurity, Kazakhstan, Malware, Phishing, Russia, SCAM, Security

¶¶¶¶¶

LONGLEASH Malware Adds Reverse Shell, Proxying, and Intermediate C2 Capabilities

A significant upgrade to malware maintained by the UAT-7810 actor: LONGLEASH, a successor to the previously reported SHORTLEASH implant, now sporting reverse-shell, multi-protocol proxying, and intermediate command-and-control (C2) forwarding capabilit…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

Cavern Manticore Malware Uses Low-Detection .NET Modules for Reconnaissance and Lateral Movement

A newly identified Iran-linked threat group, tracked as Cavern Manticore, is deploying a sophisticated modular command-and-control (C2) framework built on a shared .NET foundation to conduct stealthy reconnaissance and lateral movement against Israeli …

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

ClickFix Scams Abuse Google, Cloudflare Checks to Deliver 7 Malware Families

Malwarebytes links fake Google and Cloudflare verification pages to shared ClickFix infrastructure delivering StealC, NetSupport and other malware.

·

ClickFix, Cloudflare, Cyber Attack, cybersecurity, Google, Malware, Scams and Fraud, Security

¶¶¶¶¶

SilverFox Campaign Turns ValleyRAT Into Multi-Stage Malware With Rootkit Capabilities

The SilverFox advanced persistent threat (APT) group has escalated its offensive toolkit by transforming ValleyRAT from a conventional remote access trojan into an eight-stage malware chain culminating in a kernel-mode rootkit. This evolution marks a s…

·

cyber security, Cyber Security News, Malware

¶¶¶¶¶

Gaslight Stealer Embeds Fake System Messages to Mislead AI Malware Analysts

A new macOS stealer, tracked as Gaslight and attributed to North Korean operators, demonstrates a worrying evolution in malware design: deliberate prompt-injection to mislead AI-driven security tools. Gaslight arrives as a standalone Mach-O executable …

·

cyber security, Cyber Security News, macOS, Malware

¶¶¶¶¶

1010.cx

1010.cx

Category: Malware