All About Malware – Malpedia

The primary goal of Malpedia is to provide a resource for rapid identification and actionable context when investigating malware. Openness to curated contributions shall ensure an accountable level of quality in order to foster meaningful and reproducible research.

Malware Wikipedia – Click here

Threat Actor – Click here

Last Update

• Linux Malware 1337_GWTK Server Analysis
  2026-07-30 • Prtheus • elf.1337_gtwk_rootkit Open article on Malpedia
• Joyfill npm Packages Compromised with Blockchain C2 Loader
  2026-07-29 • SafeDep • SafeDep Team • js.jadesnow Open article on Malpedia
• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  2026-07-28 • StepSecurity • Varun Sharma • js.jadesnow Open article on Malpedia
• Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  2026-07-28 • Socket • Socket Research Team • js.jadesnow Open article on Malpedia
• Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon
  2026-07-28 • Hunt.io • Hunt.io Open article on Malpedia
• Two Trojan Families Trotting in Through Google Search Ads
  2026-07-27 • Intezer • Joakim Kennedy Open article on Malpedia
• Dear Diary, Today I found a Ghost in the Network
  2026-07-27 • Intrusiontruth • Intrusiontruth Open article on Malpedia
• An Angry Spark, or a Triangle in Disguise?
  2026-07-27 • Medium (@billmarczak) • Bill Marczak • ios.triangledb Open article on Malpedia
• PureLogs, PureRAT and misleading zgRAT
  2026-07-27 • Netresec • Erik Hjelmvik • win.purelogs, win.pure_rat, win.zgrat Open article on Malpedia
• Inside a DPRK BlueNoroff ClickFix Kit
  2026-07-24 • JUMPSEC LABS • JUMPSEC Open article on Malpedia
• North Korea busts elite hacking ring inside its own banks
  2026-07-24 • Daily NK • Yoon HyeSeong Open article on Malpedia
• Jackskid's residential proxy, brought to you by UPnP
  2026-07-24 • Nokia • Nokia Deepfield ERT • elf.jackskid Open article on Malpedia
• NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign
  2026-07-23 • NSA • NSA • js.zimreaper Open article on Malpedia
• Operation RoundPress Rolls on with More Half-Click Webmail Zero-Days from TA458
  2026-07-23 • Proofpoint • Greg Lesnewich, Konstantin Klinger, Mark Kelly, Nick Attfield, Saher Naumaan • js.spypress Open article on Malpedia
• TA488 Targets Zimbra Mailservers with Half-Click Exploits
  2026-07-23 • Proofpoint • Greg Lesnewich, Konstantin Klinger, Mark Kelly, Nick Attfield, Saher Naumaan • js.zimreaper Open article on Malpedia
• JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake
  2026-07-23 • Group-IB • Group-IB • win.adaptix_c2, win.regeorg Open article on Malpedia
• EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain
  2026-07-22 • Prophet Security • Joshua Hubner Open article on Malpedia
• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
  2026-07-22 • Huntress Labs • Michael Tigges • win.sectop_rat Open article on Malpedia
• Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine
  2026-07-22 • bluecyber • Nguyen Dang Hung • win.giftedcrook Open article on Malpedia
• [QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis
  2026-07-21 • kienmanowar Blog • m4n0w4r, Tran Trung Kien • win.toneshell Open article on Malpedia