Npav Lab

A dangerous new malware named GIFTEDCROOK is targeting Ukrainian government systems. Disguised in phishing emails, this malware is designed to steal sensitive browser data and exfiltrate it through Telegram, making it hard to detect. Cybersecurity experts are warning that this attack is part of a growing trend in cyber-espionage by threat actors.

The infamous Vidar Stealer malware has returned with a dangerous new trick—pretending to be Microsoft’s BGInfo.exe, a tool trusted by IT professionals. This new version is designed to silently steal browser cookies, stored passwords, and crypto wallet data.

Cybersecurity agencies including CISA and FBI have issued a warning about the growing use of a stealthy cyberattack technique called Fast Flux, used by hackers to hide malware servers, enable phishing websites, and build resilient command-and-control (C2) systems.

Cybersecurity researchers have discovered a dangerous new Android spyware app that uses password protection and Android overlay tricks to stay hidden and prevent uninstallation. Installed by someone with physical access, this app secretly spies on the victim while making it very hard to remove.

Oracle has confirmed a major data breach targeting its older Gen 1 servers, exposing sensitive authentication data, usernames, and hashed passwords. The attacker gained access using an old Java exploit and demanded a $20 million ransom.

Cybersecurity researchers have discovered a new Android malware, Salvador Stealer, which is designed to steal banking credentials and one-time passwords (OTPs). This malware pretends to be a legitimate banking app, tricking users into entering sensitive financial details.

Samsung Germany has suffered a serious data breach, with threat actors leaking 270,000 customer support tickets on hacking forums. The breach, traced back to compromised employee credentials from 2021, exposes customer names, email addresses, home addresses, order details, payment information, and tracking data—putting affected users at high risk of scams and fraud.

A dangerous China-linked hacking group, Earth Alux, has been conducting cyber espionage attacks on major industries across Asia-Pacific and Latin America. Using advanced malware called VARGEIT, these hackers infiltrate organizations to steal sensitive data and disrupt operations.

A dangerous Android banking malware named TsarBot is spreading rapidly, targeting over 750 banking, finance, cryptocurrency, and e-commerce apps worldwide. It uses fake login screens, phishing sites, and remote control techniques to steal user credentials and execute fraudulent transactions.

Cybercriminals have devised a new social engineering attack known as ClickFix, which abuses fake CAPTCHA verifications to trick users into installing malware, including ransomware and banking trojans like Qakbot. This attack exploits users’ trust in CAPTCHA systems, leading them to unknowingly execute malicious commands.