Malware
Stealers, botnets, RATs
New VOLTA infostealer uses commercial AI models to profile and rank stolen victim data
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer that harvests credentials, cookies, session data and cryptocurrency information. It then uses large language models, reported to include Claude, Gemini and Kimi, to enrich identities and rank victims by monetisation value.
Trojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
Researchers found that anthropic.claude-code version 2.1.313, obtained from Open VSX, had 66 lines of malicious JavaScript added to the legitimate extension bundle. The loader runs before the extension's normal code and sets up persistent SSH access to infected hosts. The issue has been traced to a compromise of the Cursor Marketplace, and Cursor briefly took the service down to remove the malware.
Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces
Phorion researchers found that Claude Code extension version 2.1.313 was tampered with and published on Open VSX, the Eclipse Foundation's open-source marketplace for VS Code-compatible editors. BleepingComputer reports it was distributed through Cursor's extension marketplace for about 11 hours on October 29, exposing up to 5,000 developers to malware that installs persistent SSH backdoors. Microsoft's Visual Studio Marketplace never carried the compromised build.
NetamLoader malware targets custom Windows 10 build used by Asian government bodies
Kaspersky's GReAT team reported NetamLoader, a .NET and XAML-based loader found in a CAB archive in the Windows update download folder, built for a custom Windows 10 build used only by Asian government bodies. It abuses Microsoft-signed components, patches AMSI, cleans up logs and contacts its C2 server slowly to evade sandboxes and EDR. Kaspersky saw one victim, could not say how the archive was delivered and found no sign that Patch My PC was compromised.
Apple warns users in 99 countries of mercenary spyware attacks, over 150 countries notified to date
Apple issued a new round of threat notifications to targeted users in 99 countries, bringing its total to over 150 countries. Apple does not attribute the attacks to any specific attackers or regions. Citizen Lab and Access Now advise recipients to enable Lockdown Mode and contact Access Now, and warn that the absence of a notification does not rule out infection. The previous major batch was sent in August, and the latest one comes shortly before final negotiations on industry standards under the voluntary Pall Mall Process.
Criminals exploit ebook downloads with malware, fake search pages and phishing
Kaspersky describes how attackers target ebook readers through pirate sites that deliver malware disguised as books, including a miner and infostealers hidden in fake PDFs. Search spam pages, fake Goodreads and Orell Füssli adverts, and clones of pirate libraries such as Z-Library are used to harvest card details and credentials. The article also notes a 2024 Z-Library clone leak of about 10 million user records and a 2025 Kindle vulnerability that could allow account hijacking.
319 Chrome extensions with 13.4 million installs hijacked users' search settings and routed queries via operator servers
Socket researcher John Tuckner identified 319 Chrome extensions, with an estimated 13.4 million installs over a decade, that hijacked default search settings and proxied queries through operator-controlled servers before forwarding them to Yahoo or Bing. The operators could read queries, which were often tied to a unique identifier, and earned referral payments. The extensions were promoted through ads on networks including Google Ads and were listed in the official store, mostly as unlisted entries reachable only by direct link.
Cheap Android car head unit found loaded with bloatware and spyware-like apps
A Civic owner bought a low-cost aftermarket Android head unit from Amazon and used Claude to analyse its firmware, as might be done with a smart TV. The unit shipped with a voice assistant using WebView that reportedly consumed about a third of processing power while idle, Baidu location services, a call recorder, a DAB radio client and Adobe Acrobat. Schneier notes that this illustrates the insecurity of IoT software and that AI is lowering the barrier to reverse engineering.
Coruna and DarkSword iPhone exploit kits spread via 608 web domains and a backdoored npm package
Zimperium zLabs documented 608 domains delivering Coruna-family code, which selects an exploit chain by iOS version: Coruna for iOS 17.2.1 or older and a DarkSword-based chain for iOS 18. Delivery is through decoy lure sites with hidden frames, a backdoored art-template npm package reported by SafeDep, and a fake jquery.min.js loaded from a look-alike Google domain. The malware steals data such as Telegram storage and the Apple Notes database, and deletes crash logs and Safari data to hide its tracks. Every CVE in the chains is already patched.