# Dropper Published articles for Dropper. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Cheap Android TV boxes came with malware, and Google says the manufacturer was behind it DevFeed: [Cheap Android TV boxes came with malware, and Google says the manufacturer was behind it]() Original publisher: [Read original article]() Author: Kishalaya Kundu Published: 2026-11-04T19:06:00Z Content type: news Language: en Sources: [TechSpot]() Topics: [Malware](), [IoT botnets](), [Android Security](), [Google](), [google play protect](), [Remote Access Trojan]() Tags: [ad-fraud](), [android](), [android-tv](), [backdoor](), [botnet](), [cybersecurity](), [digital-signage](), [dropper](), [electronics](), [exploited](), [firmware](), [fraud](), [global](), [google](), [international](), [japan](), [karaoke](), [malware](), [mecool](), [security](), [set-top-box](), [tv](), [videostrong]() ### AI overview Google says it severed ties with Videostrong after XCPE, a backdoor reportedly built into firmware across more than 1.3 million devices, was linked to a global botnet. Synthient identified at least 182 affected models, including Android TV boxes and other Videostrong products. The malware reportedly exploited a firmware vulnerability during first boot, disabled Play Protect, and evolved from a simple dropper into a modular system designed to evade detection and support criminal modules. Operators used infected devices for ad fraud, data theft, remote access, and residential proxy traffic. Google worked with law enforcement and security firms to disrupt command-and-control domains, banned Videostrong and affiliates from making certified Android devices or supplying software to Android partners, and says it is improving firmware integrity checks. Device counts vary: Google estimates about 1.3 million, while TrendMicro counted 1,472,554. ### Source excerpt The backdoor was discovered in the firmware of multiple Videostrong devices, such as the Mecool KTI, as well as several white-label Android TV boxes. Seattle-based cybersecurity and fraud intelligence research group Synthient, which worked with Google to analyze the malware, claims it identified at least 182 different device models that... Read Entire Article ## macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor DevFeed: [macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor]() Original publisher: [Read original article]() Author: Kevin Townsend Published: 2026-10-02T13:15:00Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [ClickFix](), [macOS](), [zoom](), [fake account fraud]() Tags: [application](), [backdoor](), [browser](), [dropper](), [encrypted](), [exploited](), [infostealer](), [installer](), [macos](), [malware](), [malware-threats](), [zoom]() ### AI overview Researchers found CloudSyncD, a macOS backdoor delivered through a fake Zoom installer. It can establish persistent access, profile the host, and send system and user details to command-and-control infrastructure. The report describes how the dropper executes the malware and notes that deployment builds share indicators that can help defenders monitor for it. ### Source excerpt The dropper "carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime. The post macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor appeared first on SecurityWeek. ## SMTP is the key: BPFDoor and AVERAT hitting the network edge DevFeed: [SMTP is the key: BPFDoor and AVERAT hitting the network edge]() Original publisher: [Read original article]() Author: Rapid7 Intelligence Published: 2026-10-02T13:00:00Z Content type: article Language: en Sources: [Rapid7 Cybersecurity]() Topics: [Endpoint security](), [Network](), [Encryption](), [code analysis](), [Domain Name System (DNS)](), [Virtual Private Network](), [Network Attached Storage (NAS)](), [Process]() Tags: [2026](), [appliances](), [cctv](), [cybersecurity-company](), [dropper](), [edge](), [embedded-devices](), [encryption](), [exposure-assessment-platform](), [exposure-management](), [implant](), [korean](), [linux](), [managed-detection-and-response](), [managed-security-solutions](), [network](), [network-edge](), [research](), [shell-script](), [smtp](), [tcp](), [telecom](), [telecommunications](), [threat-research](), [vulnerability-management]() ### AI overview The samples blend into telecom and mail appliance environments while using port 25 for distinct purposes: AVERAT beacons outbound over SMTP and starts its encrypted session after STARTTLS; a BPF Rekoobe build watches for magic packets in port-25 traffic; and BPFDoor variants wait for packet triggers. A dropper stages two binaries in /sbin, runs them, then deletes their files while the processes remain active; one binary re-executes as a watchdog. The analyzed AVERAT infrastructure uses compromised Taiwanese NAS, network appliance and DVR hosts as relays, but the report finds no overlap with named ORB networks and does not confirm membership in one. Defenders are advised to look for unlinked executables under /proc, raw packet sockets and classic BPF filters, unexpected port-25 callbacks, process masquerading, and appliance-specific staging artifacts and process sequences. File-based detection may miss the staged payloads because they are removed from disk. ### Source excerpt Overview Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese appliances. Additionally, we provide source code details of the Rapid7 BPFDoor controller introduced in our April 2026 blog, Stealthy BPFDoor Variants are a Needle That Looks Like Hay. The chain uses two binaries. A dropper writes a shell script to the appliance's storage mount and executes it. The script stages both payloads into /sbin under the names ntpdate and udevds, launches them, and deletes each file ten seconds later while the processes continue running. One of those payloads is the dropper itself, re-executing as a resident watchdog, leaving both processes running without an on-disk image. The dropper derives its encryption key from the string ShareTech and lives in the appliance's own add-on package directory. The BPFDoor variants seen against South Korean systems impersonate the PID file of SpamSniper, a Korean anti-spam product, and rotate through ten Linux daemon names. Across the samples, each component adopts names and conventions designed to look unremarkable in the environment it targets. The common thread is regionalized disguise: each sample is aware of the vendor's software running on the targeted systems and implements process spoofing accordingly. Passive BPF implants avoid conventional port scans; while outbound beacons hide inside ordinary DNS, TCP, and traffic, the threat-actor(s) are leveraging SMTP to stay under the radar. Telecommunications and network-edge operators are most affected, including embedded devices such as CCTV and DVR systems that can sit close to the network core. Readers will learn how each component works, what binds the six AVERAT builds to one another, and which behaviors and indicators to ## Android Malware Delivered Through DoFun Car Head-Unit Updaters Builds a Proxy Botnet DevFeed: [Android Malware Delivered Through DoFun Car Head-Unit Updaters Builds a Proxy Botnet]() Original publisher: [Read original article]() Author: Dmitry Kalinin Published: 2026-08-21T08:00:29Z Content type: article Language: en Sources: [Securelist]() Topics: [Malware](), [Android](), [proxy](), [Mobile](), [Cybercrime](), [Embedded Software Dev]() Tags: [adware](), [android](), [automotive](), [automotive-security](), [badbox](), [botnets](), [cybersecurity](), [dropper](), [firmware](), [full](), [google-android](), [infection-chain](), [kaspersky](), [large](), [malware](), [malware-descriptions](), [malware-technologies](), [medium](), [mqtt](), [proxy](), [thumbnail](), [trojan](), [trojan-clicker]() ### AI overview Kaspersky reports Android malware delivered through legitimate software updaters for DoFun automotive head units. The multi-stage downloader is used for ad fraud and to create a proxy botnet, and the activity is attributed to the MoYu Group, which is linked to BADBOX. ### Source excerpt Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It's delivered through legitimate software for DoFun head units. ## Armored Likho expands its cyber-espionage toolkit DevFeed: [Armored Likho expands its cyber-espionage toolkit]() Original publisher: [Read original article]() Author: Konstantin Isakov Published: 2026-08-13T08:00:15Z Content type: article Language: en Sources: [Securelist]() Topics: [infection chain](), [C2](), [API](), [kaspersky](), [Rust](), [Tauri](), [App](), [Framework](), [data](), [Server]() Tags: [api](), [app](), [apt](), [apt-reports](), [armored-likho](), [audio-surveillance](), [command-and-control](), [cyber](), [cyber-espionage](), [dropper](), [eavesdropping](), [espionage](), [files](), [framework](), [full](), [great-research](), [infection-chain](), [kaspersky](), [large](), [logs](), [malware](), [malware-descriptions](), [malware-technologies](), [medium](), [rust](), [spyware](), [still-toolkit](), [targeted-attacks](), [tauri](), [telegram](), [thumbnail](), [trojan](), [trojan-stealer]() ### AI overview Kaspersky researchers describe an Armored Likho cyber-espionage campaign that uses a fake donation app to deliver the Rust-based Still Toolkit. Its components steal Telegram session data and conduct covert audio surveillance. ### Source excerpt Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims. ## Keyv and friends compromised in active Shai-Hulud supply chain attack DevFeed: [Keyv and friends compromised in active Shai-Hulud supply chain attack]() Original publisher: [Read original article]() Author: Ilyas Makari Published: 2026-08-04T10:37:00Z Content type: news Language: en Sources: [Aikido Security's Blog]() Topics: [Malware](), [npm](), [npm packages](), [GitHub](), [Vulnerabilities](), [Bun](), [GitHub Actions](), [JavaScript]() Tags: [2026](), [bun](), [dropper](), [file](), [filesystem](), [github](), [github-actions](), [javascript](), [malware](), [mini-shai-hulud](), [npm](), [npm-packages](), [packages](), [secret](), [shai-hulud](), [supply-chain](), [supply-chain-attack](), [threats](), [tokens](), [vulnerabilities]() ### AI overview A maintainer's compromised GitHub account was used to inject a credential-stealing worm into key-value storage and related npm packages. The malware was distributed through poisoned releases, used the Bun runtime to execute its payload, harvested credentials, and spread to other packages. An update reported at least 444 compromised packages across 1,381 versions. ### Source excerpt Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account Category: Vulnerabilities & Threats ## SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts DevFeed: [SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts]() Original publisher: [Read original article]() Author: Charlie Eriksen Published: 2026-07-19T08:45:00Z Content type: article Language: en Sources: [Aikido Security's Blog]() Topics: [Malware](), [Vulnerabilities](), [rubygems](), [.env](), [Continuous integration](), [forgejo](), [PowerShell](), [VirusTotal](), [GitHub Actions](), [GitLab](), [CircleCI](), [Jenkins]() Tags: [ci](), [circleci](), [developer](), [dropper](), [environment-variables](), [forgejo](), [git](), [github-actions](), [gitlab](), [gitlab-ci](), [jenkins](), [malware](), [powershell](), [supply-chain](), [supply-chain-attack](), [vulnerabilities]() ### AI overview The article examines SleeperGem, a RubyGems supply-chain attack in which malicious binaries were delivered through a public Forgejo repository. It traces how successive gem versions evolved from a staged dropper into code that executed when the library was loaded, while avoiding CI environments and targeting developer laptops. ### Source excerpt SleeperGem: two dormant RubyGems maintainer accounts were hijacked to inject malware into trusted gems, one with over 500,000 total downloads Category: Vulnerabilities & Threats ## Untangling a Linux Incident With an OpenAI Twist (Part 2) DevFeed: [Untangling a Linux Incident With an OpenAI Twist (Part 2)]() Original publisher: [Read original article]() Author: James Northey; John Hammond Published: 2026-04-22T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [incident](), [Security](), [Linux](), [OpenAI](), [AI Agent](), [Security Operations Center](), [Cybercrime](), [Persistence](), [cURL]() Tags: [agent](), [ai](), [ai-agent](), [codex](), [curl](), [developer](), [dropper](), [edr](), [huntress](), [incident](), [linux](), [openai](), [persistence](), [security](), [security-operations](), [security-operations-center](), [soc]() ### AI overview Huntress SOC analysts investigate a Linux security incident involving a developer who used OpenAI Codex while malicious actors deployed a cryptominer, a dropper, and persistence mechanisms. The article describes how legitimate Codex commands complicated EDR triage alongside genuine malicious activity. ### Source excerpt A developer used OpenAI's Codex to handle suspicious activity, leading to unexpected outcomes found by Huntress SOC analysts during an investigation. ## LightSpy Malware Variant Targeting macOS | Huntress DevFeed: [LightSpy Malware Variant Targeting macOS | Huntress]() Original publisher: [Read original article]() Author: Stuart Ashenbrenner; Alden Schmidt Published: 2024-04-25T00:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Malware](), [macOS](), [iOS](), [x86](), [file](), [Android](), [GitHub]() Tags: [android](), [dropper](), [github-repository](), [ios](), [kaspersky](), [macos](), [malware](), [technical-analysis](), [virustotal]() ### AI overview Huntress analyzes a previously unreported macOS variant of the LightSpy mobile spyware framework. The examined samples run on Intel macOS devices or Apple Silicon devices with Rosetta 2, rather than iOS devices, and the article provides YARA and Sigma rules for detection. ### Source excerpt There's a new variant of LightSpy malware targeting macOS. Here, Huntress' macOS researchers dive into the macOS variant of the LightSpy malware, after gaps in recent reports stating that the LightSpy malware strictly targets iOS.