Alwar

Cisco Talos researchers report that the Volta infostealer uses large language models to automatically appraise infected machines and prioritize victims by their potential financial value. The malware feeds system details to an AI model, which estimates each victim's worth so attackers can focus on the most profitable targets. The finding highlights a new stage in cybercrime automation, where AI is used not only to write malware but to direct it.

Level Infinite, the publisher of the mobile game Goddess of Victory: Nikke, has issued an apology after a security breach involving the game's PC launcher resulted in malware being distributed to players. The company acknowledged the incident and is working to address the compromise, though details on how many users were affected remain unclear.

Binance has revealed details of how hackers stole $6.3bn from the cryptocurrency exchange, saying the operation began in June. According to reports, the attackers used malware and bogus job interviews to gain access. The disclosure is drawing attention to security risks across the crypto industry.

Malwarebytes researchers report that a hidden backdoor infected roughly 1.3 million Android TV boxes, secretly conscripting the devices into criminal activity without their owners' knowledge. The finding highlights how cheap, mass-market streaming hardware can be compromised at scale and used for fraud and other illicit operations.

Google says it has disrupted a botnet known as XCPE that infected roughly a million Android devices, many of them cheap TV streaming boxes sold with malware pre-installed or added after sale. The company banned the manufacturer tied to the scheme from its services and Play Store. Security observers are highlighting the risks of low-cost Android hardware shipping with hidden malicious code.

The PC game launcher for Goddess of Victory: NIKKE was compromised to distribute remote access and data-stealing malware, security outlet BleepingComputer reports. Players who downloaded the launcher risked having their credentials and personal data harvested by attackers. Gamers and security researchers are warning users to download the game only through official channels and to scan systems for infection.

The UK's National Cyber Security Centre says AI-powered malicious software is 'highly likely' to be used in hacking attacks against critical national infrastructure by 2028, with power stations, airports and hospitals among the facilities it expects to be targeted. The warning highlights how AI is lowering the barrier for cyber attackers and increasing the sophistication and speed of potential strikes on essential services.

Fraudulent PlayStation 5 emulator repositories hosted on GitHub are being used to distribute password-stealing malware to people searching for console emulation software. The fake projects pose as legitimate PS5 emulators, which do not genuinely exist, tricking users into downloading infected files that can harvest saved passwords and credentials. Security watchers are warning users to avoid downloading emulator software from unverified sources.

Cisco Talos researchers have detailed VOLTA, a Windows infostealer that sends stolen victim data to Claude so the AI ranks the victim's assets by value, building a custom target assessment. The malware can switch to another model if one refuses the request, or skip the AI step entirely, and deletes itself after finishing. Security observers are highlighting the case as a notable example of criminals abusing mainstream AI tools in malware operations.

A new assessment warns that AI-powered malware is 'highly likely' to be used in cyberattacks against UK infrastructure by 2028, with artificial intelligence expected to make malicious software faster, more adaptive and harder to detect. The warning highlights growing concern among security officials that hostile states and criminal groups could exploit AI to target energy networks, transport and other critical systems.

Android TV boxes carrying Google certification have been found to include preinstalled malware, raising questions about the scope of the certification programme. The certification apparently does not cover the complete firmware across the supply chain, meaning a device can be officially certified while malicious code is present before it even boots for the first time.

Security researchers at Pluto Research say they have exposed a malware campaign distributed through Hugging Face, the popular AI model-sharing platform. The campaign reportedly deploys cryptominers and backdoors onto self-hosted AI servers, posing a supply chain risk for organisations running their own AI infrastructure.

A critical remote code execution vulnerability in Node-RED, tracked as CVE-2026-58115 and rated 10.0 on the CVSS scale, is being exploited in the wild. Attackers are using it to compromise exposed instances and deploy Linux bot malware. Security commentators are urging administrators to patch and secure internet-facing Node-RED deployments immediately.

A maximum-severity vulnerability in a widely used operational technology programming tool is being actively exploited to deliver Linux malware. Security reporting indicates attackers are leveraging the flaw to compromise industrial environments, raising concerns about targeted intrusions against critical infrastructure. Administrators are being urged to patch affected systems and monitor for signs of compromise.

WIRED reports on a new infostealer malware that uses artificial intelligence to 'autodox' victims — automatically compiling and exposing personal information stolen from infected devices. The story highlights how AI is being folded into criminal tooling, letting malware analyze and weaponize stolen data with minimal human involvement, raising fresh concerns for cybersecurity defenders and ordinary users alike.

Security researchers are examining IPWeb, a residential proxy network reportedly built on malware-infected smart TVs and IoT devices. The service allegedly routes criminal traffic through home gadgets without owners' knowledge, enabling activities including DDoS attacks. The findings were published in a technical writeup detailing how the botnet peers from within compromised devices, drawing attention in the infosec community.