Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including
Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. SafePal says the breach impacts customers who placed orders between March 2, 2025, and April 11, 2026, exposing their names, email addresses, shipping addresses, phone numbers, and purchase information. The company says the breach did not expose customers' wallet seed phrases, private keys, passwords, bank account information, payment card numbers, government-issued identification numbers, or other credentials. "No evidence has been found that the incident itself compromised access to SafePal wallets or funds," SafePal said in a security advisory published Sunday.
Claude is experiencing a major outage, with users reporting login problems and degraded performance across several Anthropic services. The incident began on August 16, 2026, at around 21:58 UTC, and is affecting Claude.ai, Claude Code, and Claude Cowork. According to Anthropic’s status page, the company first said it was investigating an issue preventing some users from authenticating to Claude.ai, Claude Code, and Claude Cowork. A few minutes later, Anthropic reported a broader service disruption involving degraded performance on Claude.ai and platform.claude.com. For users, the outage can result in problems signing in, Claude failing to load, requests not completing, or other errors when using the affected services. Anthropic’s status page currently classifies Claude.ai, Claude Code, and Claude Cowork as experiencing a major outage. Claude Console and the Claude API are currently listed as operational.
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection Concept Drift Detection and Adaptive Retraining of Malware Classification Models A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models C-GUARD: Context-Adaptive Conformal Gating for Improving Robustness Against Evasive Windows PE Malware An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect. HoneyMyte, also known as Mustang Panda, has pushed its CoolClient backdoor another step deeper into Windows. Kaspersky’s latest analysis shows a new variant that can deploy a signed kernel-mode driver as a Windows service, communicate with it through IOCTL requests, and use it to hide processes, files and registry entries from inspection. That distinction matters. CoolClient was already a capable espionage tool, with keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and a plugin architecture, but the new driver changes how difficult the implant can be to see and remove. Kaspersky observed the updated variant in intrusions across Pakistan, Mongolia and Myanmar, while the wider victim set also includes Russia and confirmed government entities. CoolClient first appeared publicly in 2022 through Sophos research, followed by Trend Micro analysis in 2023. Kaspersky documented another evolution in 2025, when the malware gained clipboard theft and HTTP traffic interception for credential harvesting. The latest version keeps those capabilities and adds something more fundamental: kernel-level control. “The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified.” reads Kaspersky’s report. “The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.” In the Myanmar campaign described by Kaspersky, Mustang Panda first used PlugX as the post-compromise implant and then deployed CoolClient. Before launching the malware, the actor added exclusions to Microsoft Defender for a fake Windows Defender directory and the executable used as the DLL sideloader. The deception is straightforward. The attackers created a fake Microsoft\Windows Defender installation directory, copied the CoolClient components there and renamed a legitimate Sangfor executable, normally Sang.exe, to defender.exe. That trusted executable then loads the malicious libngs.dll through DLL sideloading. Persistence starts early as well. A scheduled task launches defender.exe with SYSTEM privileges at startup, while CoolClient can also create an AutoRun entry and install itself as a Windows service. The malware checks for security software, including several 360 Total Security processes, before taking the service installation route. The user-mode chain has several stages. libngs.dll acts as the first-stage loader, loadcert.ini handles the second stage, cert.ini provides the final backdoor, and time.ini stores configuration data. The names have changed from earlier variants, but the basic architecture remains familiar. libngs.dll also tries to look like the legitimate DLL it replaces. It exports dummy functions that call OutputDebugStringA and then terminate, while the actual malicious code sits inside DllMain. The loader decrypts loadcert.ini and loads it directly into memory. CoolClient prepares the system by establishing persistence, bypassing UAC and injecting its payload into synchost.exe. It then uses an RPC-based technique and parent-process spoofing to gain elevated privileges without relying on a visible administrator prompt. Once privileged, it extracts the compressed msagent.sys driver, installs it as a Windows service and loads it into the kernel. Through IOCTL requests, CoolClient registers itself as trusted, provides its C2 address and defines the files, registry keys and processes to protect. The driver can then block security tools from accessing or terminating protected components, making the malware harder to detect and remove. The driver reads its configuration from \REGISTRY\MACHINE\SYSTEM\RNG. The configuration identifies directories, files, registry keys and values to hide or protect, as well as processes that should be ignored or protected. “To support kernel module hiding, the driver resolves the address of the non-exported kernel variable PsLoadedModuleList at runtime using MmGetSystemRoutineAddress.” continues the report. “This global linked list maintains information about all loaded kernel modules and drivers, allowing the rootkit to enumerate and manipulate module entries.” For process hiding, the driver dynamically locates ActiveProcessLinks inside the Windows EPROCESS structure instead of depending on a fixed offset. That matters because Windows changes internal structures between versions. Once it finds the correct field, the rootkit can unlink a process from the active process list and later restore it. The driver also registers object, process and image-load callbacks. These mechanisms let it track processes and restrict access to protected ones, including the CoolClient code running inside synchost.exe. A process that tries to open a protected process or thread can receive reduced access rights, blocking operations such as termination or code injection. Files get similar treatment through a Windows filesystem minifilter. The driver maintains protected path lists and checks filesystem activity against them, denying access to matching files and directories. Registry protection works in much the same way: protected keys and values disappear from enumeration results, while direct attempts to open, modify or delete them can return STATUS_ACCESS_DENIED. The driver contains 33 IOCTL handlers, although the analyzed CoolClient sample normally uses only three. The unused handlers reveal just how much more the driver can do: hide kernel modules, inject shellcode, terminate processes, remove PPL protection, manipulate registry values, hide processes and modules, disable kernel notification callbacks, load another kernel driver and even write to an arbitrary kernel address. That’s an important distinction between capability and observed behavior. Kaspersky didn’t see the sample invoke all of those functions during normal execution, but their presence shows that msagent.sys isn’t a narrowly designed hiding component. It provides a broader kernel-level toolkit that CoolClient can potentially use when needed. The rootkit doesn’t stop at processes, files and registry entries. It also hooks the Windows Nsiproxy driver to filter network information returned to user mode. CoolClient supplies its C2 IPv4 address to msagent.sys, and the driver removes matching entries before applications receive the network information. For a defender, that creates an unpleasant problem. A tool looking at network information from user mode may simply fail to see the address associated with the malware’s command-and-control infrastructure. The connection still exists, but the rootkit can interfere with what security software and analysts are allowed to observe. The driver can also hide kernel modules by manipulating PsLoadedModuleList. When it finds a matching module, it removes the corresponding entry from the kernel’s linked list, preventing the module from appearing in standard enumeration routines. This is where the new CoolClient variant becomes materially different from a conventional backdoor. An implant running entirely in user mode can still be powerful, but defenders have many opportunities to inspect processes, files, handles and network activity. A kernel component that actively filters those views changes the detection problem. The driver uses a digital signature linked to Nanjing Ranyi Technology Co., Ltd., with a certificate valid from 2013 to 2014. Kaspersky also found older malicious drivers using the same certificate, but no direct link to CoolClient. PDB strings mention a “Nanjing Laboratory” and “Zhang Xuejie Yunnan m,” but researchers found no evidence tying them to a specific developer or threat actor. These clues alone do not prove Chinese involvement. The stronger attribution comes from the wider operation, which matches HoneyMyte activity through CoolClient, PlugX and the deployment techniques observed. HoneyMyte continues to use PlugX to gain an initial foothold before deploying CoolClient as a secondary backdoor, but the latest version adds kernel-level capabilities. By loading msagent.sys, the malware can hide processes, files and registry entries while blocking security tools from accessing or terminating protected components. This complicates incident response: finding Sang.exe, defender.exe or libngs.dll is no longer enough. Investigators must also examine drivers, services, registry changes and unusual network activity. The driver includes additional functions for manipulating kernel components, even if they were not observed in use. For defenders, CoolClient is no longer just a backdoor to hunt in user space—it can change what Windows itself reveals. “The latest CoolClient variant represents a significant evolution of the malware. Rather than operating solely as a user-mode backdoor with plugin support, it now deploys and communicates with a kernel-mode driver that extends its capabilities beyond earlier versions.” concludes the report. “Through this driver, CoolClient can hide and protect processes, files, and registry objects, as well as filter selected network information, making detection and analysis considerably more difficult.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CoolClient)
A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. A notable capability is copying the victim's Chromium profile, including its authentication state, and loading it into a hidden, headless browser on the infected system. This allows the hacker to access victims' authenticated sessions while preserving the identifiers associated with the browser, host, and network. AmnesiaStealer can collect data in 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes and documents, and keychain data. The malware is currently distributed through ClickFix campaigns that use a fake GitHub download page to drop a password-protected ZIP archive.
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Crooks Are Buying Your Expired Domains and Using Them to Deliver MalwareSAP Commerce Cloud CVE-2026-58231 Exploited in the WildmacOS Screen Sharing Flaw Exploited to Deploy Monero MinersGeoServer Zero-Day Is Already Being Probed. That’s the ProblemApple warned hundreds of users of mercenary spyware attacksAmnesiaStealer Gives Attackers Live Control of Victims’ macOS BrowsersChess.com Leak Exposes 7.3 Million Users – Evidence Points to ScrapingUS Authorizes Private Cyber Firms to Hack Transnational Criminal NetworksAdobe Commerce CVE-2026-71362 Comes Under Attack Shortly After Public DisclosureU.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalogSharePoint CVE-2026-55040 Comes Under Attack Following Public ExploitStorm-1175 Replaces Medusa With New StormEncryptor RansomwareNorth Korean Lazarus Group Uses Windows Zero-Day in Operation Dream JobCEVA Logistics Cyberattack Disrupts European Warehouses and ShipmentsChina-Linked Hackers Use AI Agents in Autonomous Attack on TaiwanKimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and EthereumShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet PatchMicrosoft Patch Tuesday for August 2026 Fixed a Zero-Day and Wormable RCEZoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code ExecutionExfilSquad Targets New Victims, Shares Data via TorrentsIran-Linked Hackers Target More US Water Infrastructure in New Jersey and AlabamaThe inconvenient truth about AI pentesting: someone has to check all the workCisco Warns of Seven ClamAV Flaws, Two With Public PoCsGym Booking Task Turns Into Real-World AI CyberattackU.S. Defense Manufacturer IEH Hit by Phishing Attack, Exposing Potentially Export-Controlled DataWebmail CSS Attacks Expose a New Risk for AI-Powered Email Tools International Press – Newsletter Cybercrime ExfilSquad Targets New Victims, Shares Data via Torrents Israeli population registry for sale, but the data is old Before Fraud Transacts ExfilSquad Targets New Victims, Shares Data via Torrents Fake CAPTCHA, Real Business: Traffic Distribution for Hire 7.3M chess.com records leaked, and the data is real Drop Something? Don’t Worry, Someone Caught it Malware ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection Hacking Chinese Model Kimi K3 Breaks UK AI Safety Institute Benchmark Evaluations AI assistant hacks gym website in first known Australian autonomous cyber attack Zoomsday Attackers Exploit SharePoint Authentication Bypass After Public PoC Release Hackers exploit macOS Screen Sharing flaw to deploy Monero miner It’s a pre-auth, stupid! A root remote command execution on macOS with M5 in 2026? Intelligence and Information Warfare Follow-Up Analysis of the 29 December 2025 Energy Sector Incident New Jersey, Alabama Join States Targeted in Water Cyberattacks Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM China-linked hackers hit Taiwan in unprecedented ‘autonomous’ AI cyber attack State Sponsored Hackers Use Fake Job Offers to Deliver New Zero Day Exploit Social engineering performed by UAC-0145: compromising in the employment process Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by Side PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring How Tehran’s Use of Cyber Operations in the U.S.-Iran Conflict Has Evolved Cybersecurity How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta Responding to the next frontier of critical cyber capabilities Facebook is paying controversial creators to produce rage-bait content Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC The August 2026 Security Update Review Cyberattack on logistics giant CEVA delivers customer data into the wrong hands About Apple threat notifications and protecting against mercenary spyware If Apple sends you a push notification alerting you to a spyware attack, take it seriously AI isn’t changing how companies work. It’s changing what a company is Swarms of OpenAI systems set up their own chatrooms to discuss and carry out hacks, company reveals Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Acronis uncovered PATCHCORD, a stealthy backdoor targeting Afghan telecom and South Asian infrastructure via fake VPN tools and Google Sheets C2. Researchers at Acronis just documented an espionage operation that reads like it was built by someone with genuinely good taste in disguises. Their Threat Research Unit report tracks a previously undocumented backdoor called PATCHCORD, hitting Afghan telecom providers and South Asian critical infrastructure through fake VPN installers and management tools branded to look exactly like the real thing. “Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools.” reads the Acronis’s report. “Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD’s capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India’s National Informatics Centre (NIC).” The delivery method leans hard into specificity. One installer impersonated Afghan Telecom down to matching the company name, product fields, and even the URL of the real support portal customers actually use, the kind of detail that only comes from someone who studied the target closely rather than mass-producing generic lures. Click through it, and a 64-bit Windows implant quietly installs itself while a real browser session opens normally in the background, so nothing looks wrong to the person who just got infected. PATCHCORD’s persistence trick is worth pausing on because it’s genuinely sneaky. Instead of the usual registry-only approach, it hijacks the actual shortcut files for Edge, Chrome, and Firefox, backing up the originals and rewriting them to launch the malware first, silently starting the real browser afterward so the shortcut still works exactly as expected. “PATCHCORD establishes persistence by hijacking browser shortcuts. Before modifying shortcuts, the implant checks whether it is running with elevated privileges and then attempts to hijack shortcuts for Microsoft Edge, Google Chrome and Mozilla Firefox.Browser identifier and executable-name mapping.” continues the report. “The implant searches for shortcuts associated with Microsoft Edge, Google Chrome and Mozilla Firefox before attempting to hijack them.” Every time someone clicks their browser icon, the malware runs invisibly in the background before the browser they wanted even opens. Once installed, PATCHCORD checks in with its command server and waits for instructions, supporting five core capabilities: adjusting how often it phones home, listing running processes, executing shellcode entirely in memory, running arbitrary commands through a hidden shell, and controlling its own browser-hijacking persistence remotely. The in-memory shellcode execution is the standout feature here, since the payload never touches disk at any point, which keeps forensic evidence to a minimum for anyone investigating after the fact. Pivoting off the infrastructure led researchers to a second, more evolved implant they’re calling SHEETCORD, written in Go and delivered through a domain impersonating India’s National Informatics Centre. “The Go-based malware combines functionality previously observed in the SHEETCREEP RAT with several capabilities introduced in PATCHCORD, suggesting an evolution of the operator’s tooling.SHEETCORD executing shell command function.” states Acronis. “The implant implements a remote command execution capability main.executeShellCommand similar to PATCHCORD. However, instead of invoking cmd.exe /c, it executes commands through powershell -Command with script block wrapping, suggesting an evolution of the operator’s tooling.” This one drops the traditional web server entirely and instead uses the Google Sheets API for command and control, creating a dedicated spreadsheet tab for each victim to send and receive instructions. Hiding malicious traffic inside a service as mundane as Google Sheets is a clever way to blend in with normal corporate network traffic that nobody thinks twice about. The researchers also found a third malware family, HACKERAI C2 Agent, that uses GitHub Gists for the same purpose and shows clear signs of having been built with AI coding assistance. Acronis pointed to leftover debug messages, AI-style code comments, and a redundant double-XOR routine using the same key twice as tells. “The implant contains code comments and implementation patterns consistent with AI-assisted code generation. Together, these observations suggest that the malware was developed, at least in part, using LLM-assisted coding tools.” the researchers state. Threat actors are actually using generative AI in practice, not only for some dramatic autonomous hacking campaign, but just as an ordinary coding shortcut. What really opened the investigation up was an exposed staging server the operator left unsecured. It contained the operator’s entire toolkit laid bare: SuperShell, a Chinese-language command-and-control framework, multiple remote access trojan frameworks, credential-harvesting tools, exploit code for a known OpenSSH vulnerability, and files that appear to follow an iOS call history database format, hinting the group may have also pulled data off mobile devices. Finding a threat actor’s actual staging server is rare, and it’s the kind of mistake that turns a hard-to-attribute campaign into a much clearer picture very quickly. Acronis links this activity to APT36, also known as Transparent Tribe, a threat group with a documented history of targeting Indian government and defense organizations, though the researchers rate the connection at moderate rather than full confidence. The reasoning holds up: matching credential-harvesting tools previously seen in confirmed APT36 campaigns, a shared C2 framework independently attributed to the same group by other researchers, and a Google Sheets technique closely resembling an earlier documented campaign already linked to the same actor. None of these signals alone would be conclusive, but stacked together they paint a consistent picture rather than a coincidence. The infrastructure was still live at the time of publication, with domains steadily rotating while the underlying server stayed the same for months. If your organization touches Afghan telecom operations, Indian government systems, or South Asian energy infrastructure, this is exactly the kind of report worth forwarding to whoever handles phishing awareness training, because the lures here are good enough that “just don’t click suspicious links” isn’t much of a defense on its own. “The PATCHCORD campaign demonstrates an evolving espionage operation targeting telecom, government, defense, and critical infrastructure organizations across South Asia. The discovery of PATCHCORD, SHEETCORD, and HACKERAI C2 Agent highlights the operator’s continued evolution, from a custom C/C++ backdoor to Go-based implants that abuse legitimate cloud services, including Google Sheets and GitHub Gists, for command-and-control.” concludes the report. “The exposed staging server and related infrastructure provided valuable insight into the operator’s tooling, campaign development, and operational practices, enabling the identification of additional infrastructure and previously undocumented malware.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, PATCHCORD)
A maximum-severity security vulnerability impacting SAP Commerce Cloud is witnessing active exploitation efforts. The vulnerability, tracked as CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It relates to an instance of insufficient authorization checks and input validation. "SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit
A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner, the Netherlands National Cyber Security Centre (NCSC) has warned. The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to
Confirm this action.
Leaving now will discard your changes.