All CosmicBytez Labs articles tagged #Backdoor, across news, security advisories, how-to guides, and projects.
A new ClickFix variant, TerminalFix, tricks victims into running PowerShell via fake Cloudflare CAPTCHAs to install a stealthy reverse-tunnel implant.
TrendAI found 14 npm packages masquerading as streak utilities that silently install a Linux backdoor linked to the RedC2 4.0 crimeware kit.
The Link Factory WordPress plugin is a supply-chain backdoor. Operator-controlled REST API lets attackers run arbitrary commands. Remove it immediately.
Lazarus Group weaponized a Windows afd.sys kernel flaw to reach SYSTEM, deploy the FudModule rootkit killing 94 EDR channels, and drop new backdoors.
The Head Mare hacktivist group exploited two unpatched TrueConf server vulnerabilities to replace legitimate client installers with malicious versions delivering PhantomCore and PhantomGraph backdoors, targeting Russian organizations across multiple sectors.
A supply chain attack introduced a backdoor into ARVE – Advanced Responsive Video Embedder version 10.8.7, enabling any attacker to gain full WordPress admin access with a single HTTP request. Wordfence PRISM detected the compromise within two hours. The plugin has been removed from WordPress.org.
The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer...
A Chinese-speaking advanced persistent threat actor has launched targeted attacks against government entities and critical infrastructure in Southeast...
Turla, a prolific Russian state-sponsored threat actor, has deployed a previously undocumented backdoor dubbed 'StockStay' in espionage operations...
Security researchers have identified a new backdoor malware named Mistic being deployed by KongTuke, a ransomware initial access broker, in financially...
A newly detailed malware family called CryptoBandits routes all traffic through a local SOCKS5 proxy and the Tor network, blending credential theft with...
A newly identified Chinese advanced persistent threat group dubbed GopherWhisper has been deploying multiple Go-based backdoors alongside custom loaders...
The Accordion and Accordion Slider WordPress plugin version 1.4.6 was sold to a malicious threat actor who embedded a persistent backdoor, granting...
A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored versions of the widely used...
Notepad++ releases emergency v8.9.2 patch after a China-linked APT group hijacked the update mechanism for six months, deploying the Chrysalis backdoor to...
China-linked Lotus Blossom hijacked Notepad++ software updates for six months, selectively delivering the Chrysalis backdoor to government and IT targets...