Pierluigi Paganini
May 17, 2026
Malware Newsletter
JDownloader site hacked to replace installers with Python RAT malware
New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment
Operation HumanitarianBait Uses Fake Aid Documents to Deploy Python Spyware
Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack
This is what some the world’s largest banks of malware look like stacked as hard drives
Popular node-ipc npm Package Infected with Credential Stealer
FamousSparrow APT Targets Azerbaijani Oil and Gas Industry
FrostyNeighbor: Fresh mischief and digital shenanigans
Gamaredon’s infection chain: Spoofed emails, GammaDrop and GammaLoad
What BO Team is hiding: the ZeronetKit backdoor from the inside and connections to Head Mare
Kazuar: Anatomy of a nation-state botnet
Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts
Memory Forensics Techniques for Automated Detection and Analysis of Go Malware
Diagnosing and Mitigating Domain Shift in Permission-Based Android Malware Detection
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
