Fake OpenAI Hugging Face Repo: Infostealer Warning
HiddenLayer says a fake OpenAI-themed Hugging Face repository copied a privacy-filter model card and used loader.py/start.bat to fetch Windows infostealer malware.
News desk
Security News
Security incidents, exploited vulnerabilities, breach reports, malware campaigns, and urgent patch notes arranged for fast daily scanning.
July 15, 2026
Latest reports
QLNX RAT Targets Linux Developer and Cloud Credentials
Trend Micro reports QLNX, a Linux-focused Quasar RAT variant that combines persistence, rootkit-style hiding, PAM backdoor access, and credential theft from developer and cloud…
TCLBANKER Banking Trojan Spreads Through WhatsApp and Outlook
Elastic reports that TCLBANKER hides inside a fake peripheral-device installer, uses DLL sideloading, and spreads through WhatsApp and Outlook while targeting Brazilian banking users.
PyPI ZiChatBot Packages Linked to Suspected OceanLotus Campaign
Kaspersky reports a suspected OceanLotus campaign that used malicious PyPI packages to deliver ZiChatBot, turning routine Python installs into a cross-platform backdoor risk.
ClickFix WordPress Attacks Push Vidar Stealer Malware
Australia warns that ClickFix attacks are abusing compromised WordPress sites and fake CAPTCHA prompts to make Windows users run PowerShell commands that install Vidar…
Fake Claude AI Site Pushes Beagle Windows Backdoor
A fake Claude AI download site is using a working-looking installer to hide a Windows malware chain that drops PlugX-related artifacts and the newer…
GoDaddy ManageWP Phishing Ads Target WordPress Admins
A paid-search phishing campaign is targeting GoDaddy ManageWP logins, turning one stolen dashboard session into a potential multi-site WordPress incident.
Microsoft AiTM Phishing Targeted 35,000 Users
Microsoft says a code-of-conduct phishing campaign targeted 35,000 users with PDF lures, CAPTCHA gates, and AiTM token theft that can bypass ordinary MFA.
CloudZ Malware Abuses Microsoft Phone Link to Steal OTPs
Cisco Talos says CloudZ RAT and its Pheno plugin target Microsoft Phone Link data on infected Windows PCs, turning phone-to-PC syncing into a path…