Lead story / security
Florida Man, 21, Allegedly Hid Malware in Eight Steam Games
The FBI says Zyaire Wilkins and co-conspirators distributed eight Steam games that infected roughly 8,000 users' computers.
Tagged / malware
malware.
The Revision stories tagged malware — 31 stories on the wire, decoded into one clear voice.
All stories tagged malware
Security
FBI Arrests Student Who Hid Crypto Malware in Steam Games
A 21-year-old student allegedly uploaded fake games to Steam that infected thousands of players and drained cryptocurrency from some of their wallets.
Security
ClickLock Stealer Badgers Mac Users Into Handing Over Passwords
A new macOS infostealer skips exploits entirely, instead spamming password prompts every 210ms until victims give up their credentials.
Security
Florida Man Charged After Steam Malware Drained $220K in Crypto
A 21-year-old allegedly uploaded eight malware-laced games to steal from roughly 8,000 devices and 80 crypto wallets over nearly two years.
Security
GoSerpent Backdoor Spent Five Years in APAC Government Networks
Kaspersky's GoSerpent analysis reveals a five-year APAC government campaign where attackers waited weeks before deploying data-theft tools.
Security
Florida Man Charged Over $220K Steam Malware Scheme
Zyaire Wilkins, 21, faces up to 10 years in prison after the FBI tied stolen Bitcoin to Uber Eats gift cards purchased at his home address.
Security
Sandworm Adopts Clickfix to Hit Ukrainian Networks
Ukraine's CERT warns that Sandworm, the GRU's elite hacking unit, is using fake-CAPTCHA attacks to install malware on Ukrainian networks.
Security
A Hacker Used Gemini CLI to Run an Eight-Device Botnet
A Russian threat actor ran a small botnet targeting a dental clinic by feeding Google's AI tool a fake pen-tester cover story.
Security
292 Fake GitHub Repos Delivered a Broad-Reach Infostealer
ArcticWolf found hundreds of spoofed repositories pushing a BoryptGrab variant that hits browsers, crypto wallets, and Chrome's App-Bound Encryption.
Security
AI-written malware evades antivirus by being one of a kind
A Huntress investigation found a PowerShell script almost certainly generated by an AI chatbot — and its uniqueness is exactly what makes it dangerous.
Security
Microsoft Flags Iranian-Linked Wiper Hiding as OneDrive
GigaWiper, tied to Iran's CyberAv3ngers, destroys drives three different ways while masquerading as a routine Microsoft update task.
Security
Fake Google Notes Extension Hijacks Crypto Clipboard
McAfee identified "Silent Swap," a Chromium extension masquerading as Google Notes that swaps crypto wallet addresses mid-paste to redirect funds.
Security
JADEPUFFER Is the First LLM-Run Ransomware Attack
Sysdig researchers say an AI agent autonomously exploited a Langflow flaw, encrypted data, and issued ransom demands — with no human operator involved.
Security
LLMs Write Functional Malware With 84% Real-World Overlap
New research tested open-weight language models on PowerShell malware generation and found the output alarmingly close to the real thing.
Security
A Smarter Malware Classifier That Handles Obfuscation
Researchers propose a multi-task AI framework that detects packed binaries, classifies malware families, and flags threats with a 97.4% combined detection rate.
Security
Claude Code Tricked Into Running Malware via Fake GitHub Repos
Mozilla's 0din team showed how AI coding agents can be manipulated into opening a reverse shell through a chain of innocent-looking setup steps.
Security
macOS Malware Hides Fake AI Prompts to Stop Security Scans
A newly documented macOS backdoor called Gaslight embeds fake system messages to trick LLM-assisted triage tools into abandoning analysis.
Security
Europol Seizes $47M and 27M Credentials in Malware Sweep
Operation Endgame dismantled infrastructure behind SocGholish, Amadey, and StealC — but no arrests means the clock is already ticking on a rebuild.
Security
Malicious Skills Found on OpenClaw's Official Marketplace
Unit 42 researchers found five malicious OpenClaw skills on ClawHub, including two macOS infostealers that slipped past automated scanners.
Security
Global Op Takes Down Two Malware-as-a-Service Platforms at Once
Coordinated action by international authorities and tech firms disrupted Amadey and StealC, two separate cybercrime tools linked by shared infrastructure.
Security
WhatsApp Phishing Campaign Drops Remote-Access Tool via Fake Docs
Attackers hijack WhatsApp accounts to send VBScript files that install a legitimate endpoint manager, handing over remote system access.
Security
USB Worm Steals Crypto by Swapping Wallet Addresses
Microsoft researchers found a script-based worm that spreads via USB drives, hijacks clipboard wallet addresses, and phones home over Tor.
Security
Two Decompilers Beat One for AI Malware Detection
A new study finds that feeding LLMs output from both Ghidra and RetDec catches more malware than relying on either tool alone.
Security
A Researcher Found 10,000 GitHub Repos Pushing Trojan Malware
One researcher's sweep of GitHub turned up roughly 10,000 repositories quietly distributing trojan malware to unsuspecting developers.
Security
1,500 Arch Linux AUR Packages Hijacked in Credential-Theft Attack
Over 1,500 Arch Linux community packages were seeded with credential-stealing malware last weekend, and no vulnerability was required to do it.
Security
LinkedIn Job Offer Hid a Backdoor
A personal account of how a convincing LinkedIn recruiter message turned out to be a delivery vehicle for malicious code.
Security
400 AUR Packages Found Carrying Infostealer and Rootkit
Roughly 400 community-submitted Arch Linux packages were compromised with credential-harvesting and persistence malware.
Security
TikTok 'Free Spotify Premium' Videos Are a Malware Delivery System
Attackers are posting TikTok videos promising free Spotify subscriptions, then directing viewers to install password-stealing malware via the command line.
Security
Attackers Bundle STX RAT Into Fake X-VPN Installers
Trojanized X-VPN setup files install STX RAT alongside a working VPN client; X-VPN's own servers were not touched.
Security
73 Microsoft Packages Caught Running a Credential Stealer, Again
A self-replicating stealer hidden in 73 packages fires automatically when an AI agent opens them, the second such incident at Microsoft in weeks.
Security
Miasma Worm Plants Credential Harvester in 73 Microsoft GitHub Repos
GitHub disabled 73 repositories across Azure, MicrosoftDocs, and related orgs after a self-replicating worm embedded credential-stealing code.
