Netcrook
Malware & Botnets
CryptoBandits Turns a USB Habit Into a Crypto Theft Risk
A new Windows malware family is reported to spread through USB devices and use Tor, while altering wallet addresses to steal cryptocurrency.
Inside the Windows Trapdoor: A Shortcut, a Public Folder, and a Memory-Resident RAT
A lure built around a geopolitical theme masked a loader chain that leaned on user execution, writable paths, and trusted Windows components to keep the final payload off disk.
When a Windows Helper Becomes the Hideout
A legitimate Microsoft binary, a sideloaded DLL, and a memory-resident RAT show how attackers can turn normal loader behavior into a stealth delivery path.
Lookalike npm Packages Turn a CSS Search into a Supply-Chain Trap
A small cluster of PostCSS-themed npm packages shows how name confusion and install-time trust can turn routine dependency work into a Windows malware risk.
When the Firewall Starts Watching the Users
A Go-based tool tied to compromised FortiGate appliances turns the network edge into a credential risk, not just a traffic-control point.
SocGholish Knocked Back: Why This Takedown Hits the Crimeware Delivery Layer
An international operation targeted SocGholish, also known as FakeUpdates, and disrupted an infrastructure described as tied to Evil Corp - a reminder that the front door of cybercrime is often more important than the payload behind it.
When a Mac App Becomes a Moving Target: The FlutterShell Case
A macOS malware family linked to remote JavaScript delivery shows how attackers can shift meaningful logic off the binary and into infrastructure that can change at any time.
When Flutter and WebViews Become a Backdoor’s Quietest Route
A macOS malware family named FlutterShell shows how ordinary app frameworks can be repurposed for runtime command execution without looking like a classic implant.
Fake Popularity, Real Theft: The Clip-on Trap Hiding Behind GitHub Stars and VirusTotal Votes
A deceptive trust layer is being abused to make a crypto clipper look safer than it is, turning stars, reviews, and clipboard swaps into a quiet route to theft.
Sponsored Search, Silent Loader: How a Fake Ad Chain Turns Into Credential Theft
A newly described malware loader, OXLOADER, shows how a simple ad click can become a staged delivery path for CastleStealer and other credential-grabbing payloads.
Trusted Chat, Untrusted Payload: How WhatsApp Messages Became a Windows Delivery Route
Compromised WhatsApp accounts are being used to push malicious VBScript files, then legitimate RMM tools are abused to keep access alive on infected Windows machines.
Rokarolla and the Android Trap: When a Banking Trojan Wants the Whole Phone
The malware family linked to Android banking fraud is interesting not for one trick, but for the way it turns ordinary handset features into a potential control layer for attackers.
Old Router Flaws, New Quiet Threat: AryStinger Turns Edge Devices Into Reconnaissance Nodes
A malware family built for scanning, tunneling, and persistence shows how long-forgotten router bugs can still power a modern access network.
Forgotten Edge Devices, New Operator Tricks: AryStinger’s Quiet Relay Game
A newly analyzed botnet turns aging routers and NAS appliances into scanning and tunneling nodes, showing how small edge devices can become useful infrastructure for hiding attacker origin and widening reach.
Paper Trail, Hidden Payload: How a Stealthy Remcos Phish Slips Past the Obvious Defenses
Financial-themed attachments, a concealed payload, and fileless staging turn a routine phishing theme into a harder-to-spot Remcos delivery chain.
A Lookalike npm Name, Then a Windows Script Chain: The Supply-Chain Trap Behind a RAT Drop
A typosquatted package in the npm ecosystem shows how a single confusing name can hand attackers a path from dependency install to Windows-native execution.
The Phishing File That Hid a Loader, Then Unleashed a Second Wave
A business-themed archive attachment led to a packed .NET loader, a steganographic second stage, and a payload chain that included Remcos RAT and multiple infostealers.
Mastra’s npm Trail Turns a Package Update Into a Crypto-Extension Risk
A malicious dependency found in more than 140 Mastra packages shows how a software supply-chain incident can move from build tools to browser-facing cryptocurrency surfaces.
A Lookalike npm Package Turned a Trusted CSS Name Into a Windows Malware Pipe
A deceptive package name in the PostCSS orbit shows how open-source trust can be abused before any code ever reaches production.
GitHub as a Malware Conveyor Belt: What a 10,000-Repo Abuse Case Reveals
A large repository-abuse campaign puts a hard truth in focus: on code-sharing platforms, reputation can be weaponized as easily as code.