Výsledky hledání | VIRY.CZ RADAR

4. 9. 2026 1

Free streaming boxes may be routing criminal traffic through your home

“Free” movies and TV could cost you your privacy, bandwidth, and control of your home network. We’ve warned about illegal streaming and modded Amazon Fire TV Sticks in the past. Now, researchers have found that certain SuperBox devices and apps could quietly enroll a household connection into a proxy network, allowing third parties to route traffic through it. An earlier report identified CyberFlix TV, available through SuperBox’s custom app store, as containing Popanet proxy functionality that…

SuperBox US

tg: rozbor tg: návod tg: propagace tp: malware tp: soukromí

Malwarebytes Labs · 4. 9. 11:20

3. 9. 2026 1

Your Employee’s Password Appeared in an Infostealer Log. Now What?

Infostealers can expose far more than passwords, including authenticated sessions that may let attackers bypass MFA. Flare explains how defenders can prioritize compromised identities, determine whether stolen access is still usable, and respond before it leads to account takeover. [...]

US

tg: návod tg: propagace tp: malware tp: identita

BleepingComputer · 3. 9. 15:50

1. 9. 2026 2

Linux Detection Engineering - Fileless Execution

Fileless execution on Linux has moved from niche tradecraft into real-world intrusion chains. By executing payloads from memory or anonymous file descriptors, attackers can reduce on-disk artifacts and weaken controls that rely heavily on file inspection.In our own analysis of VoidLink, we observed how fileless execution can be paired with a rootkit. The loader scans for processes running from memfd and passes their PIDs to the rootkit, allowing an already running fileless implant to be hidden…

Elastic US

tg: rozbor tg: propagace tp: malware tp: AI

Elastic Security · 1. 9. 16:26

TerminalFix looks like ClickFix, but delivers a very different payload

Microsoft has published details about a Windows malware campaign it calls TerminalFix. The social engineering used to infect people is very similar to what we’ve seen in ClickFix campaigns. A website visitor is presented with a fake Cloudflare CAPTCHA which, when clicked, secretly copies a malicious command to their clipboard. Then they receive instructions on what they need to do to “prove they are human,” when in reality they are being instructed to execute the malicious command. After…

Microsoft US

tg: varování tg: rozbor tg: propagace tp: malware tp: phishing

Malwarebytes Labs · 1. 9. 14:13

28. 8. 2026 1

From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

Elastic Defend 9.5.0 detects dynamic link library (DLL) search-order hijacking [1] in a single field. Writing that rule before 9.5.0 took about 88 lines, covering approximately 2,600 named libraries, 10 excluded Windows system paths, signature checks, and a drop-to-load time window. It now takes one: dll.Ext.defense_evasions: "DLL Hijack: Masquerading".DLL search-order hijacking, which Defend labels Masquerading, runs attacker code inside a legitimate process by abusing the order that Windows…

Elastic US

tg: rozbor tg: novinka v produktu tg: propagace tp: malware

Elastic Security · 28. 8. 02:00

24. 8. 2026 2

BengalSEO Part 1: Anatomy of the Operation

Key Takeaways The DFIR Report Offerings Check out our Products here and our Services here. Want a demo, more information on our services, pricing or just want to chat? Get in Touch Contact us today for pricing or a demo! Case Summary In March 2026, our team identified an SEO poisoning campaign leading to malware deployment […] The post BengalSEO Part 1: Anatomy of the Operation appeared first on The DFIR Report.

US

tg: varování tg: rozbor tg: propagace tp: malware

The DFIR Report · 24. 8. 16:28

ToxicPanda 2.0 can take over your Android phone and banking apps

Researchers have uncovered ToxicPanda 2.0, an Android banking Trojan and remote-access tool designed for account takeover and “on-device fraud.” Not only does ToxicPanda 2.0 have a much larger target list of banks and e-wallets, it has also expanded its capabilities by combining banking overlays, remote access, PIN capture, Android accessibility abuse, and attempted Wireless Debugging automation. Together, those functions can help operators turn a compromised phone into a platform for account…

Google finance US

tg: rozbor tg: návod tg: propagace tp: malware tp: podvod tp: identita

Malwarebytes Labs · 24. 8. 15:40

4. 8. 2026 1

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

In this article What is device isolation?Case study: QNETAttack chain overviewMITRE ATT&CK techniques observedReferencesLearn more Microsoft Defender’s attack disruption now includes device isolation, a new response action that extends autonomous protection directly to compromised endpoints. At QNET, an attacker initiated a multi-stage attack using a legitimate Windows tool on a compromised endpoint to retrieve a malicious remote payload–a classic living-off-the-land (LOL) technique that often…

Microsoft obchod US

tg: incident tg: rozbor tg: propagace tp: malware tp: ransomware

Microsoft Security Blog · 4. 8. 19:54

31. 7. 2026 2

What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support

We know you’re tired of hearing how every vendor is going to finally help you solve alert fatigue. Well, one way we’re improving alert fatigue is from a slightly different angle, better prevention at the endpoint. Because stopping more at the endpoint means fewer alerts ever raised. We have three endpoint enhancements, all contributing to better endpoint prevention: To be even more proactive about Bring Your Own Vulnerable Driver (BYOVD) attacks, we’re continuously monitoring public vulnerable…

Elastic US

tg: novinka v produktu tg: propagace tp: malware

Elastic Security · 31. 7. 02:00

What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support

We know you’re tired of hearing how every vendor is going to finally help you solve alert fatigue. Well, one way we’re improving alert fatigue is from a slightly different angle, better prevention at the endpoint. Because stopping more at the endpoint means fewer alerts ever raised. We have three endpoint enhancements, all contributing to better endpoint prevention: To be even more proactive about Bring Your Own Vulnerable Driver (BYOVD) attacks, we’re continuously monitoring public vulnerable…

Elastic US

tg: novinka v produktu tg: propagace tp: malware

Elastic Security · 31. 7. 02:00

14. 7. 2026 1

How Aikido Intel detects malware and vulnerabilities first

Aikido Intel is a real-time feed that catches malware and undisclosed vulnerabilities across open-source ecosystems, often within 8 minutes of release. Category: Product & Company Updates

BE

tg: novinka v produktu tg: propagace tp: malware tp: dodavatelský řetězec

Aikido Security · 14. 7. 00:12

26. 6. 2026 1

Packagist is now protected by Aikido Intel and other updates to the PHP registry

Aikido's malware feed now blocks bad package versions in Composer by default. A look at how Packagist is closing whole classes of supply chain attacks. Category: Product & Company Updates

Packagist Composer BE

tg: novinka v produktu tg: propagace tp: malware tp: dodavatelský řetězec

Aikido Security · 26. 6. 09:52

23. 6. 2026 1

Aikido x Drydock | A way for maintainers to catch malware before it ships

Aikido partners with Drydock to bring pre-publish package review to npm and PyPI. See exactly what's inside a release before it ships, malware caught before download number one. Category: Product & Company Updates

npm PyPI BE

tg: novinka v produktu tg: propagace tp: malware tp: dodavatelský řetězec

Aikido Security · 23. 6. 14:47

18. 5. 2026 1

Threat Actor Defense Evasion: How Attackers Disable AV & EDR

Threat actors are actively targeting your security tools. Learn how threat actors disable antivirus and EDR through vulnerable drivers, tampering attacks, and malicious firewall rules, and how Huntress detects.

US

tg: rozbor tg: propagace tp: malware

Huntress · 18. 5. 16:00

27. 4. 2026 1

Unified EDR + ITDR: Closing the Identity Gap Before Attacks Spread

See how Huntress EDR/ITDR Correlations stop infostealer-driven attacks before stolen credentials can be reused, linking endpoint compromise to cloud identities for one coordinated response.

US

tg: novinka v produktu tg: propagace tp: malware tp: identita

Huntress · 27. 4. 15:00

7. 4. 2026 1

Introducing C2 Detection: Know When Your Edge Devices Are Calling Home to Attackers

We're launching C2 Detection — a new GreyNoise intelligence module that gives you two distinct, high-confidence signals that a device in your environment has been compromised.

GreyNoise US

tg: novinka v produktu tg: propagace tp: malware

GreyNoise Labs · 7. 4. 02:00

31. 3. 2026 1

Phantom Stealer: Credential Theft as a Service

Group-IB shows how Business Email Protection blocked Phantom Stealer phishing emails across different campaign waves.

SG

tg: varování tg: rozbor tg: propagace tp: malware tp: phishing tp: identita

Group-IB · 31. 3. 08:56

18. 3. 2026 1

Something Phishy in the /tmp Folder

Huntress’ AI-Centric SOC recently stopped a MacSync infostealer attack on a macOS device. The malware attempted to scrape credentials, browser cookies, and crypto wallets, but Huntress contained the threat before any data was sent to the attacker. Learn how we did it.

US

tg: rozbor tg: propagace tp: malware tp: podvod tp: identita

Huntress · 18. 3. 15:00