malware

According to Crypto.news, the hacker organization BlueNoroff, linked to North Korea, uses fake Zoom and Microsoft Teams meetings to analyze cryptocurrency users before deploying malware.The hackers first take control of accounts belonging to trusted contacts in the cryptocurrency industry, then send seemingly normal meeting links via Calendly and other platforms, directing users to counterfeit Zoom/Teams domains. Once users enter the fake meeting page, it quietly scans the wallets in their browsers and decides whether to continue the attack based on the wallet's value. The fake meeting will prompt users to "update Zoom/Teams" or run commands, which actually download malware (supporting Windows and macOS). The malware will steal browser keys, system data, and Telegram sessions.

According to the security agency Slow Fog, the malicious TRAE IDE extension juannegro.solidity disguises itself as a Solidity plugin and acts as a cross-platform malware delivery mechanism. This extension automatically executes and establishes persistence after the IDE starts, and it also uses Ethereum smart contracts to store and retrieve dynamic C2 configurations, allowing attackers to update C2 endpoints and payloads without needing to re-release the extension.Although the extension has been removed from Open VSX, it was still available through the TRAE marketplace as of July 18. Users who have installed it should immediately delete it and check their systems for compromise.

According to Bits.media, Kaspersky security researchers have discovered new malware OkoBot, which steals cryptocurrency wallet recovery phrases and credentials through about 20 modules. Attackers use ClickFix social engineering techniques to trick users into executing malicious commands and spread the malware through GitHub repositories disguised as legitimate tools like SQL Server Management Studio.OkoBot's modules include: SeedHunter, which injects into hardware wallets like Trezor and Ledger, displaying a fake interface when recovering recovery phrases; MC Keylogger, which records keyboard and clipboard activity; and OkoSpyware, which tracks wallet passwords and records window videos.Once attackers obtain the recovery phrases, they can gain complete control over the victim's cryptocurrency assets, making it nearly impossible to recover the funds. Kaspersky stated that OkoBot has been active for over a year, with most victims located in Brazil, Vietnam, Canada, Mexico, and Turkey. Attackers have also implemented geographical blocking on IP addresses from Russia and CIS countries.

The U.S. federal prosecutors have charged a 21-year-old Florida man, Zyaire Wilkins, accusing him of implanting malware to steal cryptocurrency assets in at least 8 games with accomplices between May 2024 and February 2026, spreading it through gaming platforms, resulting in approximately 8,000 devices being infected and about 80 cryptocurrency wallets being stolen, with the amount involved exceeding $220,000.The indictment documents show that the games involved include BlockBlasters, Chemia, Dashverse, DashFPS, Lampy, Lunara, PirateFi, and Tokenova. Some of these games had previously been removed from Steam due to security risks. Investigators stated that the suspect promoted these games through platforms such as Discord, Telegram, X, and LinkedIn, luring users to download and install them, after which the malware stole sensitive information from victims and siphoned off cryptocurrency wallet assets.The FBI indicated that law enforcement identified the suspect through on-chain fund flow analysis and digital payment records. The investigation found that his associated cryptocurrency wallet had purchased over 150 gift cards on the cryptocurrency gift card platform Bitrefill, including Uber Eats gift cards, ultimately helping investigators confirm his phone number and address. The case has now been filed in the U.S. District Court for the Western District of Washington.

According to FinanceFeeds, security researchers have discovered an information-stealing malware targeting macOS devices that is attacking cryptocurrency users. This malware can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Currently affected wallets and applications include software wallets like Exodus, Atomic, Electrum, Wasabi, and Monero.The malware is capable of extracting sensitive information from macOS Keychain, Safari Cookies, Apple Notes, Telegram Desktop, and multiple cryptocurrency wallet-related databases, including login credentials, authenticated session files, wallet data, and browser extension information. Security analysis points out that the danger of this attack chain lies in its reliance not on a single wallet vulnerability, but on collecting various types of data from the device, linking device intrusion, account takeover, wallet cracking, and mnemonic phrase theft together. Among these, Telegram Desktop sessions have become a key target.Attackers can copy authenticated Telegram local session data and restore the login on another Mac device without needing to enter a phone number, verification code, or Telegram two-factor authentication password. This means that Telegram 2FA cannot provide complete protection in this attack scenario, as the attacker is not performing a new login but is exploiting an already trusted local session. For cryptocurrency users, the risks are further amplified. Since Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers gain access to user session permissions, they could impersonate the victim, read private chats, locate asset information, and even spread malicious links to contacts.

Microsoft's Threat Intelligence team has announced a Windows clipboard trojan threat that has been active since February 2026. This malware combines "worm-like propagation + clipboard hijacking + Tor anonymous communication" to target digital asset users for attacks.

The Microsoft Security Blog reported that the Microsoft security research team discovered a new type of cryptocurrency stealing Trojan named Crypto Clipper. This malware has been active since February 2026, primarily spreading through USB devices that infect Windows users with malicious .lnk shortcuts. Crypto Clipper has a built-in Tor client that connects to .onion hidden services via a local SOCKS5 proxy, enabling covert C2 communication. Its main functions include high-frequency monitoring of the clipboard, stealing mnemonic phrases and private keys, replacing cryptocurrency transfer addresses, capturing screenshots and uploading them, as well as receiving remote code execution commands.Microsoft stated that this malware has worm propagation capabilities, automatically hiding original documents on USB drives and generating malicious shortcuts with the same name, while also creating scheduled tasks for persistent control. Researchers detected it as Trojan:Win32/CryptoBandits.A and recommended that users disable autorun for removable devices, restrict script interpreter execution permissions, and closely monitor localhost:9050 Tor proxy traffic and abnormal clipboard access behaviors.

According to Slow Fog's disclosure, a new variant of Shai-Hulud Hades has been found attacking PyPI. The malicious package drops a .pth file that executes automatically when Python starts, and checks if Bun is installed locally; if not installed, it downloads the official Bun binary from GitHub Releases, and then executes a multi-layer obfuscated JavaScript payload to steal credentials from GitHub, npm, AWS, and cloud services.Slow Fog stated that this variant uses the same RSA public key and infrastructure as previous Shai-Hulud attacks, and has capabilities such as encrypted exfiltration, persistence, CI/CD injection, and GitHub Actions injection.

According to Cryptopolitan, a new type of macOS malware named Reaper is spreading through fake download pages of applications like WeChat and Miro, targeting the theft of cryptocurrency wallet data, browser passwords, and sensitive documents. This malware exploits the AppleScript URL to trigger the system's built-in script editor, hiding malicious code through ASCII art and spaces. After users click the run button, a fake Apple security update pop-up lures victims into entering their computer passwords.Reaper targets desktop cryptocurrency applications such as Ledger Live, Trezor Suite, and Exodus, modifying the internal code of wallets to intercept future transactions and redirect funds. It also steals saved credentials from Chrome, Firefox, and Edge, extracting files like .docx, .pdf, and .wallet from the desktop and documents folder. Reaper also installs a backdoor disguised as a Google software update directory for persistent attacks. Security experts advise users to verify download links, avoid entering passwords in unexpected pop-ups, and immediately close the page if a website requests to open the script editor.

According to SlowMist monitoring, a new type of Rust supply chain malware activity named IronWorm is attacking developer environments and the Web3 ecosystem through malicious npm packages. Potential attack behaviors include credential theft, wallet mnemonic and password theft, GitHub repository tampering, malicious package publishing, CI/CD secret leakage, Tor-based command control, and eBPF rootkit stealth.Security teams should audit the repository for backtracked commits, suspicious branches, unexpected build hooks, and commits from automated identities such as claude, dependabot, renovate, or github-actions. It is recommended to remove or deprecate affected package versions, publish clean versions, rotate all leaked keys and tokens, review GitHub Actions artifacts, and rebuild potentially compromised development or CI systems from clean images.

GitHub has updated the details of the investigation into the unauthorized access incident of its internal repositories: GitHub detected and contained an incident yesterday involving an employee's device being compromised, which involved a maliciously implanted VS Code extension. GitHub removed the malicious extension, isolated the affected terminals, and immediately initiated an incident response. Current assessments show that only GitHub's internal repositories experienced data exfiltration, and the approximately 3,800 repositories claimed by the attackers are roughly consistent with the investigation results. GitHub has prioritized rotating critical credentials, is analyzing logs, verifying credential rotations, and monitoring subsequent activities, with a complete report to be released after the investigation is concluded.Additionally, Slow Mist's Chief Information Security Officer 23pds commented on this incident, stating: "By analyzing leaks from cybercrime forums, hackers may have used Anthropic's Mythos security AI to precisely breach GitHub's defenses and steal information from about 4,000 core internal repositories: including the source code for Copilot, the algorithms for CodeQL, the Actions runtime, and the entire billing system. Further analysis of this code could lead to subsequent attacks, having a profound security impact on the integration of the open-source community."

The Chief Information Security Officer of Slow Fog, 23pds, disclosed on platform X that node-ipc has been compromised again. The released three malicious versions of node-ipc (9.1.6, 9.2.3, 12.1) carry the same credential-stealing payload, with the package being downloaded over 10 million times per week.

According to Decrypt, Microsoft's threat intelligence department disclosed that attackers implanted malicious code into the Mistral AI package distributed through the PyPI platform. This malicious code automatically runs when developers use it on Linux systems, downloading a malicious file named transformers.pyz and executing it in the background, with the filename deliberately mimicking the widely used Hugging Face Transformers library to confuse users.Microsoft pointed out that this malware primarily steals developer login credentials and access tokens, and it avoids Russian systems. Some of the code can randomly delete device files located in Israel or Iran. This attack is related to the "Shai-Hulud" supply chain attack campaign that started in September. Mistral responded that investigations show the attack originated from compromised developer devices, and the company's infrastructure was not breached.

According to the blockchain security organization SlowMist (@SlowMist_Team), a highly complex npm worm named "Mini Shai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab, as monitored by their threat monitoring system MistEye. Attackers hijack GitHub credentials to publish malicious packages disguised as legitimate updates, embedding a hidden script router_init.js that runs silently in CI/CD environments like GitHub Actions, specifically designed to steal CI/CD keys, cloud infrastructure keys, and cryptocurrency wallet information, using GitHub's own infrastructure for data exfiltration.SlowMist has synchronized relevant threat intelligence (IOC) with clients and recommends that projects using the affected packages immediately check their CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor for abnormal background activities in the development environment.

According to market news, Microsoft's security research team has discovered that attackers have been inducing users to run malicious terminal commands by publishing fake macOS troubleshooting guides since the end of 2025, thereby stealing cryptocurrency wallets, iCloud data, and passwords saved in browsers.These fake guides are published on platforms such as Medium, Craft, and Squarespace, targeting common user issues like freeing up disk space or fixing system errors, and tricking users into copying and pasting malicious commands into the terminal, which automatically downloads and runs malware. This social engineering technique, named ClickFix, bypasses macOS's Gatekeeper security mechanism because the victims are actively executing the commands.The malware families involved include AMOS, Macsync, and SHub Stealer, which can steal cryptocurrency wallet keys from Exodus, Ledger, and Trezor, as well as usernames and passwords saved in Chrome and Firefox. In some cases, attackers also delete legitimate wallet applications and replace them with trojan versions. Apple has added a protective feature in macOS version 26.4 to prevent the pasting of potentially malicious commands.

According to research by OpenSourceMalware, the North Korean hacker group Lazarus has adopted new techniques in malicious activities targeting developers, such as "infectious interviews" and "TaskJacker," hiding the second-stage loader in the pre-commit scripts of Git Hooks. "Infectious interviews" is a series of attack activities where the organization lures developers into cloning malicious code repositories by faking recruitment processes in the cryptocurrency/DeFi field, ultimately stealing crypto assets and credentials.Researchers recommend that developers who are asked to clone code repositories as part of the interview process should be wary of such risks and preferably run in an isolated environment to avoid mounting personal browser configurations, SSH keys, and cryptocurrency wallets.

According to Slow Fog CISO @im23pds's post on the X platform: attackers used 13 accounts to implant 575 malicious Skills into Hugging Face and ClawHub.

Vercel's CEO Guillermo Rauch tweeted that the team has completed an in-depth security investigation, analyzing nearly 1 PB of complete Vercel network and API logs, far exceeding the initial Context.ai account breach incident.The investigation revealed that the attackers' activities extended beyond Context.ai and have distributed malware on a broader scale, targeting account keys from platforms like Vercel. Once the keys are obtained, the attackers quickly and comprehensively enumerate non-sensitive environment variables. Current measures include deepening collaboration with industry partners such as Microsoft, AWS, and Wiz to jointly protect the broader internet ecosystem; other suspected victims have been notified and advised to immediately rotate credentials and strengthen security best practices.

According to CoinDesk, monitoring by CertiK reveals that the Lazarus Group is conducting an attack operation named Mach-O Man targeting executives in the fintech and cryptocurrency industries. This operation utilizes ClickFix social engineering techniques, sending fake online meeting invitations to lure victims into pasting repair commands on their Mac terminals, thereby gaining access to company and financial systems.CertiK researcher Natalie Newson stated that the Lazarus Group has stolen over $500 million through attacks on Drift and KelpDAO in the past two weeks. Mach-O Man is a modular macOS malware toolkit developed by the Chollima division of the Lazarus Group, capable of automatically deleting itself after use to evade detection.Additionally, attackers have implemented this attack by hijacking DeFi project domain names and replacing them with fake Cloudflare messages.

According to monitoring by the blockchain security firm SlowMist, MistEye has received threat intelligence from the community indicating that a malware named "MacSync Stealer" (v1.1.2) is active and highly destructive. This malware targets macOS users, stealing sensitive data including cryptocurrency wallets, browser credentials, system keychains, and infrastructure keys (SSH/AWS/K8s).The malware uses a spoofed AppleScript system dialog for phishing and displays fake error messages stating "unsupported" after data leakage. It has immediately synchronized this IOC (Indicator of Compromise) to clients. Do not execute unverified macOS scripts and remain highly vigilant against unexpected system password prompts. If an attack is suspected, immediate remediation is required: change all infrastructure credentials (SSH/AWS/K8s), invalidate any exposed keychains, and quickly migrate cryptocurrency assets to a secure wallet.