#Backdoor
All CosmicBytez Labs articles tagged #Backdoor, across news, security advisories, how-to guides, and projects.
- News
Ninja Forms and WPC Product Bundles Flaws Exploited to Backdoor WordPress Sites
Attackers are chaining stored XSS bugs in Ninja Forms and WPC Product Bundles for WooCommerce to plant hidden admins and backdoors on 530,000+ sites.
- News
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database and Shared Memory
Sucuri found the SC WordPress backdoor rebuilding itself from eight file, database, and shared-memory locations, using Ethereum RPC gateways for C2.
- News
China's FamousSparrow APT Deploys New SparroWocky Backdoor Across Latin America
ESET says China-aligned FamousSparrow deployed a new SparroWocky backdoor against Latin American governments across eight countries.
- News
Malicious Admin Menu Editor Pro Plugin Backdoors 1,500 WordPress Sites
Malicious Admin Menu Editor Pro updates backdoored 1,500+ WordPress sites after the developer's site was compromised by an attacker.
- News
Hackers Exploit Critical WooCommerce Wholesale Lead Capture Flaw to Plant PHP Backdoors
Hackers exploit a critical flaw in the WooCommerce Wholesale Lead Capture plugin to upload PHP backdoors; Wordfence has blocked 100,000+ attacks.
- News
Artifactory Flaws Chained in Attacks Deploying Backdoor Malware
Attackers chain three JFrog Artifactory flaws to forge admin tokens and deploy Rust-based backdoors in under five minutes.
- News
Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
StyleSmuggler, a Magento zero-day found by Sansec, injects PHP via failed-payment emails to drop a Rust backdoor on live stores.
- News
TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor
A new ClickFix variant, TerminalFix, tricks victims into running PowerShell via fake Cloudflare CAPTCHAs to install a stealthy reverse-tunnel implant.
- News
14 Trojanized npm Packages Deploy RedC2 4.0 Linux Backdoor with AI-Assisted Command and Control
TrendAI found 14 npm packages masquerading as streak utilities that silently install a Linux backdoor linked to the RedC2 4.0 crimeware kit.
- Security
CVE-2026-15413: WordPress 'Link Factory' Plugin Is an Intentional Backdoor (CVSS 10.0)
The Link Factory WordPress plugin is a supply-chain backdoor. Operator-controlled REST API lets attackers run arbitrary commands. Remove it immediately.
- News
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus Group weaponized a Windows afd.sys kernel flaw to reach SYSTEM, deploy the FudModule rootkit killing 94 EDR channels, and drop new backdoors.
- News
Head Mare Hacktivists Breach TrueConf to Trojanize Client Installers with PhantomCore Backdoors
The Head Mare hacktivist group exploited two unpatched TrueConf server vulnerabilities to replace legitimate client installers with malicious versions...
- Security
ARVE WordPress Plugin Backdoor Grants Instant Admin Access to ~20,000 Sites
A supply chain attack introduced a backdoor into ARVE – Advanced Responsive Video Embedder version 10.8.7, enabling any attacker to gain full WordPress...
- News
North Korean Hackers Target Open Source Developers in Supply Chain Attacks
The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer...
- News
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
A Chinese-speaking advanced persistent threat actor has launched targeted attacks against government entities and critical infrastructure in Southeast...
- News
Russian APT Deploys 'StockStay' Backdoor Against Ukrainian Targets
Turla, a prolific Russian state-sponsored threat actor, has deployed a previously undocumented backdoor dubbed 'StockStay' in espionage operations...
- News
Stealthy Mistic Backdoor Linked to Ransomware Access Broker KongTuke
Security researchers have identified a new backdoor malware named Mistic being deployed by KongTuke, a ransomware initial access broker, in financially...
- News
CryptoBandits Malware Doubles as a Backdoor, Abuses Tor for Stealthy C2
A newly detailed malware family called CryptoBandits routes all traffic through a local SOCKS5 proxy and the Tor network, blending credential theft with...
- News
China-Linked APT GopherWhisper Abuses Legitimate Services
A newly identified Chinese advanced persistent threat group dubbed GopherWhisper has been deploying multiple Go-based backdoors alongside custom loaders...
- Security
CVE-2026-6443: WordPress Accordion Plugin Backdoor in Version 1.4.6
The Accordion and Accordion Slider WordPress plugin version 1.4.6 was sold to a malicious threat actor who embedded a persistent backdoor, granting...
- News
Axios NPM Package Breached in North Korean Supply Chain
A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored versions of the widely used...
- News
Notepad++ Supply Chain Attack Attributed to China-Linked
Notepad++ releases emergency v8.9.2 patch after a China-linked APT group hijacked the update mechanism for six months, deploying the Chrysalis backdoor to...
- Security
Lotus Blossom APT Compromises Notepad++ Updates to Deploy
China-linked Lotus Blossom hijacked Notepad++ software updates for six months, selectively delivering the Chrysalis backdoor to government and IT targets...