Kaspersky Details MovieReaper Malware Framework Distributed via Compromised Torrent Trackers
Kaspersky researchers have published a detailed analysis of MovieReaper, a previously unknown modular malware framework distributed through popular torrent trackers under the guise of films, games, and other media.
The campaign began after attackers compromised the itorrents repository in October 2025. Because many torrent sites rely on this repository, malicious files quickly spread to users worldwide, resulting in hundreds of infections across Europe, Asia, and Africa.
Instead of the expected media file, victims receive an executable such as the odyssey (2026) [1080p] [webrip] [5.1].exe. The file typically carries a long name and uses the icon of a legitimate application such as the VLC media player to appear trustworthy.
Upon execution, the malware contacts an initial command server to retrieve shellcode. It then queries the Solana blockchain for encoded data stored in a specific account; this data reveals the address of a second command-and-control server. The blockchain-based mechanism is designed to maintain operation even if parts of the infrastructure are blocked.
The second-stage payload bypasses Windows UAC to establish persistence. The final module provides 21 commands that allow remote operators to read, download, list, create, copy, rename, move, delete, and change permissions on files, create symbolic links, and generate image thumbnails for selective exfiltration before full file transfer. Additional modules can be deployed on demand.
Additional findings in the same report
The report also examines attacks by the NightEagle group against Russian corporate infrastructure and the PAYLOAD campaign, which uses Active Directory Group Policy objects to extort victim organizations.
Separate research covered in the publication describes the InjectEave attack that amplifies electromagnetic emissions from wired or wireless headphones to eavesdrop on audio up to 30 meters away, and the DDRop hardware attack that bypasses Intel TDX and AMD SEV-SNP memory protections in virtual machines. A zero-day privilege-escalation flaw in the radio module of Google Pixel smartphones has been patched, and two members of the TeamPCP cybercrime group were arrested in Australia after infiltration by the Google Threat Intelligence Group.
Related articles
Freshko: Open-Source Rust Tool Offers Local File and URL Scanning Without Data Upload
A developer has released Freshko, a compact 400x640 pixel desktop application built in Rust that performs quick local checks on files, folders, and URLs without sending data to external services. The tool uses YARA-X rules for file scanning, follows up to eight redirects while querying Cloudflare's filtering DNS, and scores processes for potential cryptocurrency miners based on names, arguments, and launch paths. It explicitly avoids acting as a full antivirus solution, instead providing transparent results that list any skipped items or incomplete checks. Freshko runs on macOS and Windows, keeps all scan results in memory only, and disables system proxies during URL checks to prevent DNS rebinding attacks. The project includes performance benchmarks on Apple Silicon and addresses common pitfalls such as high CPU usage false positives and incomplete disk scans. Unlike VirusTotal or Cloudflare URL Scanner, Freshko performs all file analysis locally and never makes scan reports public.
Yoba Campaign Uses Signed ChatGPT and Claude Binaries for DLL Sideloading and XMRig Deployment
Researchers at Check Point Research have uncovered the Yoba malware campaign that distributes fake desktop clients for ChatGPT and Claude through GitHub repositories. The attackers bundle legitimate signed executables from OpenAI and Anthropic with a malicious DLL that gets loaded via classic sideloading. Once executed, the loader establishes persistence using the Windows Task Scheduler and retrieves additional payloads through Telegram, DNS over HTTPS, and the Catbox file hosting service. The campaign ultimately deploys the XMRig cryptominer, which pauses mining activity when user interaction is detected to avoid detection. No compromise of OpenAI or Anthropic infrastructure was found; the attackers simply repurpose the companies' signed binaries and reputation. The operation primarily targets home users and small-to-medium businesses with Windows systems.
uCreator Spyware Infiltrates Modified Telegram, WeChat and GCash Builds on Android
Security researcher Ovi has published a detailed analysis of uCreator, also known as YingGai, a commercial Android spyware platform designed for surveillance and remote app control. The malware intercepts messages, verification codes and account data directly inside legitimate applications without requiring root privileges. Infection vectors include tampered Telegram, WeChat and GCash APKs distributed through unofficial sources, as well as the Onion Box container that launches the target app inside a controlled environment. Once active, uCreator hooks into the host process, reads Telegram’s local message database through client interfaces, captures two-factor authentication passwords and hides its own session from the user. The operation is supported by cloud-based command panels and exposed GitLab repositories that revealed server-side code and development history. Compatibility problems have been noted on Android 17, and the total number of victims remains unknown.
Researchers Deploy Cowrie Honeypot Disguised as NVIDIA H100 Server to Study SSH Botnet Tactics
A cybersecurity team set up a realistic Cowrie honeypot on a fake server equipped with four NVIDIA H100 GPUs, 128 AMD EPYC cores, and terabytes of storage to observe what SSH brute-force bots actually do after gaining access. The trap used a custom StickyAuth module that allowed entry only after several failed attempts and locked in the successful credential pair per IP address. Over the first 12.5 hours the system recorded 1,846 connections from 126 unique IPs, 175 successful logins, and 1,524 commands executed, with the majority of activity traced to a single botnet linked to the Outlaw group. The attackers deployed SSH keys signed mdrfckr, changed the root password, killed competing processes, installed cron jobs, and downloaded a mining archive called dota3 containing an IRC backdoor and its own SSH scanner. The researchers also identified three realism issues in the base Cowrie setup—limited grep flags, outdated filesystem paths in Debian 12, and inconsistent hostname reporting—and patched them to keep sophisticated bots engaged longer. An auxiliary LLM service later summarized each session in Telegram for easier analysis.