backdoor

highmalware

LiteLLM Supply Chain Attack Compromises Release Pipeline, Distributes Malicious Python Package

LiteLLM disclosed that threat actors compromised its release pipeline to distribute a malicious Python package version 1.107.0. The compromised package was pushed to both the Python Package Index (PyPI) and Docker Hub registries around October 21, 2026. The package contains a credential stealer and a backdoor, posing risks of credential theft and unauthorized system access for users who download the affected version.

The Hacker News1 day ago1 min read

highCyber Attacks

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

A Belarus-aligned hacktivist group attributed to Partisan Zmiy (also known as Cyber Partisans) conducted a cyber espionage campaign against a Russian healthcare organization. According to a report by Russian cybersecurity firm Solar, the group hid the Vasilek backdoor in compromised VMware Tools installers, enabling nearly two years of unauthorized access beginning around October 2024 and discovered in October 2026. The attackers leveraged signed, seemingly legitimate software updates to maintain persistence and exfiltrate data.

The Hacker News5 days ago1 min read

highMalware

LiteLLM Python Package Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

Security researchers from SafeDep, Socket, StepSecurity, and Upwind have reported that the LiteLLM Python package version 1.107.0 was compromised in a software supply chain attack. The tampered distribution delivered a credential stealer and a backdoor to users. The package has been quarantined on PyPI. Users of the affected version are advised to upgrade to a clean version and verify package integrity.

The Hacker News6 days ago1 min read

highMalware

WordPress SEO Plugin Rank Math Compromised in Supply-Chain Attack

Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website were found to carry malware that planted hidden backdoors in a supply-chain attack. The incident impacts WordPress website owners and their visitors, with the full extent of compromise still being assessed.

BleepingComputer8 days ago1 min read

highmalware

Rank Math PRO WordPress Plugin Compromised with Self-Restoring Backdoor

Rank Math, the developer of the popular Rank Math PRO and Rank Math SEO WordPress plugins, confirmed that plugin copies distributed via rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, were compromised with malware. The company stated that any site installing one of these compromised copies should be treated as compromised. The malware includes a self-restoring backdoor mechanism that may persist even after plugin removal if not fully cleaned. Rank Math has released a fix and is advising users to update to the latest version from official sources and perform full site scans.

The Hacker News8 days ago1 min read

highMalware

Fake Web3 Accelerator Distributes Malicious npm Packages Targeting Developers and AI Enthusiasts

Elastic researchers have uncovered a campaign in which threat actors operating a fake Web3 accelerator distributed malicious npm packages to developers and AI enthusiasts. The packages were promoted under the pretext of offering free artificial intelligence credits for Anthropic Claude and Google Gemini, coding tools, and security audits. Once installed, the packages deployed information-stealing malware and backdoors capable of compromising Windows and macOS systems, potentially leading to credential theft, session hijacking, and further compromise of AI agent traffic and development environments.

The Hacker News8 days ago1 min read

highcyber attacks

Attackers Tampered with AOMEI Backupper Update Servers to Deliver Backdoor

Threat actors briefly modified files served by AOMEI Backupper's update infrastructure during five to ten minute windows between May and July 2026. Any system checking for updates during those intervals downloaded and executed a backdoor. The incident was reported by The Hacker News and attributed to activity monitored by Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis team.

The Hacker News11 days ago1 min read

highMalware

Linux Backdoors Disguised as Email Security Tools Target Telecom Infrastructure in Korea and Taiwan

Researchers have identified Linux-based backdoors targeting telecom and network appliances in South Korea and Taiwan. The malware disguises its network traffic and process names as legitimate email services to blend in with normal administrative traffic and evade endpoint and network security controls. The campaign highlights the ongoing use of defense-evasion techniques that borrow legitimate binary names to avoid detection.

The Hacker News21 days ago1 min read

highMalware

Malicious Linux Implants Mimic Asian Mail Security Products

Security researchers have identified three new Linux backdoors -- KamiKaze, MoRoot, and Watercrack -- that mimic legitimate Asian mail security products. The implants blend into administrative traffic to enable remote code execution and persistence while avoiding detection by traditional security tools.

Dark reading25 days ago1 min read

highCyber Attacks

Cisco Talos Identifies Antino Backdoor Leveraging Outlook and OneDrive in China-Nexus Espionage Campaign

Cisco Talos has uncovered a new cyberespionage campaign attributed to a China-nexus threat actor. The operation deploys a previously undocumented backdoor codenamed Antino, which specifically targets government and policy organizations across Asia. The backout leverages legitimate Microsoft services, including Outlook and OneDrive, for command and control communication, making detection more difficult. Victims have been identified in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar.

The Hacker News25 days ago2 min read

backdoor

Quick answers

Related Articles

LiteLLM Supply Chain Attack Compromises Release Pipeline, Distributes Malicious Python Package

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

LiteLLM Python Package Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

WordPress SEO Plugin Rank Math Compromised in Supply-Chain Attack

Rank Math PRO WordPress Plugin Compromised with Self-Restoring Backdoor

Fake Web3 Accelerator Distributes Malicious npm Packages Targeting Developers and AI Enthusiasts

Attackers Tampered with AOMEI Backupper Update Servers to Deliver Backdoor

Linux Backdoors Disguised as Email Security Tools Target Telecom Infrastructure in Korea and Taiwan

Malicious Linux Implants Mimic Asian Mail Security Products

Cisco Talos Identifies Antino Backdoor Leveraging Outlook and OneDrive in China-Nexus Espionage Campaign