Pierluigi Paganini
June 28, 2026
Malware Newsletter
A VBScript campaign distributed through WhatsApp deploying RMM software
Lost in relocation: analysis of a new loader distributing CASTLESTEALER
From PostCSS Masquerading to Windows RAT
Prinz Eugen ransomware: a deep dive into a new Go-based encryptor
From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet
Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker
ESET takes part in Operation Endgame to disrupt Amadey and Stealc
StealC you later: Proofpoint and IBM X-Force support Operation Endgame disruptions
Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
Burnyard: Future of Malware Analysis
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
