Pierluigi Paganini
July 19, 2026
Malware Newsletter
CrashStealer: C++ macOS infostealer posing as crash reporter
Lucide Proxy: Turning Student Web Proxies into DDoS Bots
AsyncAPI npm organization compromised, 2M weekly downloads affected
OkoBot: new sophisticated malware framework targets cryptocurrency users
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
Claude for-Chrome Extension-Bypass
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
ClickLock Stealer turns a locked screen into a forensics case
Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware
Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor
New North Korean campaign uses fake coding interviews to steal developer credentials
NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era
Sequel to ChainVeil npm Malware Targets Vite Ecosystem
Symmetric Dual-Domain Prototype Adaptation for Few-Shot Image-Based Malware Classification
A Blockchain and Federated Learning Framework for Image-Based IoT Malware Detection and Prevention
A Measurement Study of AI-Environment Realism Gaps in Malware-Analysis Sandboxes
Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
