Virus Bulletin

#VB2027 is heading to London, 6–8 October 2027! 🎉

We’re excited to return to this iconic city and bring together brilliant minds from across the cybersecurity industry for another three days of cutting-edge research, insightful discussions and unforgettable moments.

Ransom-ISAC examined logs from an exposed refrigeration controller where intruders made 743 parameter changes across 31 devices and issued alarm-mute and defrost commands. The logs do not show whether the commands caused physical damage. ransom-isac.org/blog/the-copel…

Socket analysed a malicious Ruby gem carrying a Shai-Hulud descendant. It targets developer credentials and poisons AGENTS.md, CLAUDE.md and MCP configs so coding agents can run attacker code. No victims were confirmed. socket.dev/blog/shai-hulu…

Seqrite analysed a newer Armorsteal build after finding three scheduled tasks on an infected Windows system. The Python kit uses 11 fallback domains, steals data, and stops its cryptominer whenever Task Manager or another monitoring tool opens. seqrite.com/blog/armorstea…

Intrinsec's Ruben Madar examines browser extensions that launch clean, then add malware through silent updates. The report also covers tools sold to install extensions without user interaction and maps Needle and Lunex panels. intrinsec.com/malicious-brow…