> SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 118

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure   UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER MALFEX – A malicious npm postinstall no advisory has caught for fourteen months   Canto incognito: tracking the PoeLLM malware TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack   Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia Sleep, Beacon, Steal, Repeat – The Story of P7 DarkSword Variant   Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer       Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight The phone was compromised before the user turned it on: the rise of Midnight Mimosa       ORCAGen: Orchestrating Context-Aware Malware Deception with RAG-Guided Generative AI MARS: Malware Analysis with Rule-Based Scoring of LLM Claims   An IoT Malware Detection Framework Based on Large Language Models and Deep Learning Techniques An Explainable Attention-Enhanced Deep Learning Model for Memory-Forensic Malware Detection Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)