Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers #malware

MATCHBOIL: New tricks, same old evil intentions #malware

New budget Android phones are arriving with firmware malware installed before you even turn them on.

Cheap Android Phones Ship with Pre-Installed Malware

#Android #Cybersecurity #Malware

PoeLLM malware has compromised 3,400+ servers, mainly by targeting exposed AI and open-source services.

It finds its current C2 server by decoding four words from a poem hosted on GitHub.

cyberupdates365.com/poellm-malwa...

#Cybersecurity #Malware #AISecurity

DOJ Seizes Seven Domains Used for Alleged China-Linked Hacking of Critical Infrastructure

#cybersecurity #china #fbi #malware

blog.talosintelligence.com/ignore-all-i... Excellent research post from CISCO Talos team discussing Anti AI analysis techniques in malware.

#cybersecurity #AI #malware

Someone searches for a tool, clicks the advert above the real result, and lands on a copy of the brand. Researchers see a blank page; victims see the fake. The fix costs nothing: install from the vendor's site, typed in directly. Read the filing #malware #malvertising #browser #infosec

The Shai-Hulud worm compromised the Tensorlake npm package and hundreds of others, stealing credentials and targeting AI infrastructure in a major supply chain attack.

#Worm #Malware #infosec

Full synthesis & sources: yasna.io

#PoeLLM #malware infects exposed #AI servers in #cryptomining attacks

https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/

#cybersecurity #AI #crypto

Stealthy ASHVEIN RAT hides commands in HTML to spy on Ukrainian gov, infrastructure. #Cybersecurity #Russia #Ukraine #RAT #Espionage #Malware https://thedailytechfeed.com/uac-0099s-new-rat-ashvein-spies-on-ukraine-via-hidden-html-commands/

⚠️📢 Some low-cost Android phones may arrive compromised before users even switch them on.

#MidnightMimosa malware is preinstalled in system firmware, enabling ad fraud, proxyware and silent app installation.

Listen/Read: hackread.com/midnight-mim...

#Android #Malware #Cybersecurity #AdFraud

📢 Un malware retrouve son serveur de commande dans un poème et compromet plus de 3’400 serveurs

Un malware baptisé PoeLLM exploite des serveurs vulnérables, notamment ceux hébergeant des outils d'IA comme LiteLLM et Ollama.

#Malware #Cyberveille

Fake hotel reviews are being used as phishing lures to install EtherRAT/TONResolver malware with blockchain C2 hiding. #Blockchain #EtherRAT #TONResolver #Phishing #Malware https://thedailytechfeed.com/hotel-staff-targeted-malware-uses-negative-reviews-to-hide-c2-in-blockchain/

Malware is now querying smart contracts to hide C2 domains—supply chain security risks just got smarter with Web3. #Web3 #SupplyChainSecurity #BlockchainC2 #Malware #CloudSecurity https://thedailytechfeed.com/hackers-turn-public-blockchains-into-stealth-c2-hubs-in-supply-chain-attacks/

☠️ Ingeniería Inversa del Fraude: Así es como #MagisTV (ahora #Xuper) inyecta #malware, secuestra tu red y roba tus datos bancarios 📱 | #Streaming

Análisis técnico de overlays botnets y robo de #datos bancarios.

www.newstecnicas.com/2025/11/magi...

@talosintelligence.com
Attackers embed prompt injections to manipulate AI malware analysis; plaintext enables detection.
-
IOCs: CVE-2015-2291, F8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d
-
#AI #Malware #ThreatIntel

~Malpedia~
Open-source XenoRAT enables C2, HVNC, surveillance, credential theft and remote control.
-
IOCs: 201[.]7[.]16[.]168:5555
-
#Malware #RAT #ThreatIntel

16 Firefox extensions posing as Rabby/OKX wallet clones stole recovery phrases. All removed—reset your wallet if compromised. #Security #BrowserSecurity #Crypto #Malware #Firefox https://thedailytechfeed.com/16-firefox-wallet-extensions-stole-crypto-recovery-phrases-all-removed/