<rss version="2.0"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:media="http://search.yahoo.com/mrss/">
    <channel><title>Bitdefender Labs</title><description>Daily source of cyber-threat information. Established 2001.</description><link>https://www.bitdefender.com/en-us/blog/labs/</link><image><url>https://download.bitdefender.com/resources/images/favicon/favicon-32x32.png</url><title>Bitdefender Labs</title><link>https://www.bitdefender.com/en-us/blog/labs/</link></image><generator>Bitdefender Blog</generator><lastBuildDate>Sun, 15 Mar 2026 00:35:32 GMT</lastBuildDate><atom:link href="https://www.bitdefender.com/nuxt/api/en-us/rss/labs/" rel="self" type="application/rss+xml"/><ttl>1800</ttl><item><title>Windows and macOS Malware Spreads via Fake “Claude Code” Google Ads</title><description><![CDATA[Bitdefender’s security researchers have discovered a malicious Google Ads campaign targeting anyone searching for downloads related to Claude, the large language model developed by Anthropic.]]></description><link>https://www.bitdefender.com/en-us/blog/labs/fake-claude-code-google-ads-malware</link><guid isPermaLink="false">69aff0aaa89a0404d6eab41a</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Ionut Alexandru BALTARIU</dc:creator><pubDate>Wed, 11 Mar 2026 13:04:49 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2026/03/claude_malvertising.png" medium="image"/><content:encoded><![CDATA[Bitdefender’s security researchers have discovered a malicious Google Ads campaign targeting anyone searching for downloads related to Claude, the large language model developed by Anthropic.]]></content:encoded></item><item><title>Global Scam Machines: Inside a Meta-Powered Investment Fraud Ecosystem Spanning 25 Countries</title><description><![CDATA[In February-March 2026, Bitdefender Labs identified and mapped a sprawling global scam infrastructure and scalable disinformation-for-profit network that uses trusted news brands, real personalities, fabricated media narratives, emotional hooks, and advanced evasion techniques to drive victims into investment fraud funnels.

On February 9-March 5, 2026, we analyzed 310 malvertising campaigns distributed through paid advertising on Meta platforms.


Key findings:

 * This is a global, coordinated]]></description><link>https://www.bitdefender.com/en-us/blog/labs/global-investment-scam-network-using-meta-ads</link><guid isPermaLink="false">69a97b63a89a0404d6eab38e</guid><category><![CDATA[Scam Research]]></category><dc:creator>Alecsandru Cătălin DAJ</dc:creator><pubDate>Mon, 09 Mar 2026 13:06:14 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2026/03/global-scam-machines.jpg" medium="image"/><content:encoded><![CDATA[In February-March 2026, Bitdefender Labs identified and mapped a sprawling global scam infrastructure and scalable disinformation-for-profit network that uses trusted news brands, real personalities, fabricated media narratives, emotional hooks, and advanced evasion techniques to drive victims into investment fraud funnels.

On February 9-March 5, 2026, we analyzed 310 malvertising campaigns distributed through paid advertising on Meta platforms.


Key findings:

 * This is a global, coordinated]]></content:encoded></item><item><title>LummaStealer Is Getting a Second Life Alongside CastleLoader</title><description><![CDATA[Bitdefender researchers have discovered a surge in LummaStealer activity, showing how one of the world's most prolific information-stealing malware operations managed to survive despite being almost brought down by law enforcement less than a year ago.

LummaStealer is a highly scalable information-stealing threat with a long history, having operated under a malware-as-a-service model since it appeared on the scene in late 2022.

The threat quickly evolved into one of the most widely deployed in]]></description><link>https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader</link><guid isPermaLink="false">698b465ea89a0404d6eab2ec</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Bogdan Ionut Lazar</dc:creator><pubDate>Wed, 11 Feb 2026 14:00:09 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2026/02/lumma_castleloader.png" medium="image"/><content:encoded><![CDATA[Bitdefender researchers have discovered a surge in LummaStealer activity, showing how one of the world's most prolific information-stealing malware operations managed to survive despite being almost brought down by law enforcement less than a year ago.

LummaStealer is a highly scalable information-stealing threat with a long history, having operated under a malware-as-a-service model since it appeared on the scene in late 2022.

The threat quickly evolved into one of the most widely deployed in]]></content:encoded></item><item><title>Helpful Skills or Hidden Payloads? Bitdefender Labs Dives Deep into the OpenClaw Malicious Skill Trap</title><description><![CDATA[With hundreds of malicious OpenClaw skills blending in among legitimate ones, manually reviewing every script or command isn’t realistic — especially when skills are designed to look helpful and familiar.

That’s why Bitdefender offers a free AI Skills Checker, designed to help people quickly assess whether an AI skill might be risky before they install or run it.

Using the tool, you can:

 * Analyze AI skills and automation tools for suspicious behavior
 * Spot red flags like hidden execution,]]></description><link>https://www.bitdefender.com/en-us/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap</link><guid isPermaLink="false">6984c68ba89a0404d6eab282</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Andrei ANTON-AANEI</dc:creator><pubDate>Thu, 05 Feb 2026 17:26:40 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2026/02/malicious-skills.jpg" medium="image"/><content:encoded><![CDATA[With hundreds of malicious OpenClaw skills blending in among legitimate ones, manually reviewing every script or command isn’t realistic — especially when skills are designed to look helpful and familiar.

That’s why Bitdefender offers a free AI Skills Checker, designed to help people quickly assess whether an AI skill might be risky before they install or run it.

Using the tool, you can:

 * Analyze AI skills and automation tools for suspicious behavior
 * Spot red flags like hidden execution,]]></content:encoded></item><item><title>Android Trojan Campaign Uses Hugging Face Hosting for RAT Payload Delivery</title><description><![CDATA[Bitdefender researchers have discovered an Android RAT (remote access trojan) campaign that combines social engineering, the resources of the Hugging Face online platform as staging, and extensive use of Accessibility Services to compromise devices.]]></description><link>https://www.bitdefender.com/en-us/blog/labs/android-trojan-campaign-hugging-face-hosting-rat-payload</link><guid isPermaLink="false">697a260ca89a0404d6eab228</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Alecsandru Cătălin DAJ</dc:creator><pubDate>Thu, 29 Jan 2026 13:54:45 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2026/01/ChatGPT-Image-Jan-28--2026--05_18_14-PM.png" medium="image"/><content:encoded><![CDATA[Bitdefender researchers have discovered an Android RAT (remote access trojan) campaign that combines social engineering, the resources of the Hugging Face online platform as staging, and extensive use of Accessibility Services to compromise devices.]]></content:encoded></item><item><title>Fake Leonardo DiCaprio Movie Torrent Drops Agent Tesla Through Layered PowerShell Chain</title><description><![CDATA[After noticing a spike in detections involving what looked like a movie torrent for One Battle After Another, Bitdefender researchers started an investigation and discovered that it was a complex infection chain.

The film, Leonardo DiCaprio's latest, has quickly gained notoriety, making it an attractive lure for cybercriminals seeking to infect as many devices as possible.

People often search for the latest movies on the internet, hoping to find a copy of a new release that has just begun its ]]></description><link>https://www.bitdefender.com/en-us/blog/labs/fake-leonardo-dicaprio-movie-torrent-agent-tesla-powershell</link><guid isPermaLink="false">6932fedaa89a0404d6eab14d</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Raul Vasile BUCUR</dc:creator><pubDate>Wed, 10 Dec 2025 13:48:56 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/12/90cbbfab-b875-4654-a654-df248f9c8a73.png" medium="image"/><content:encoded><![CDATA[After noticing a spike in detections involving what looked like a movie torrent for One Battle After Another, Bitdefender researchers started an investigation and discovered that it was a complex infection chain.

The film, Leonardo DiCaprio's latest, has quickly gained notoriety, making it an attractive lure for cybercriminals seeking to infect as many devices as possible.

People often search for the latest movies on the internet, hoping to find a copy of a new release that has just begun its ]]></content:encoded></item><item><title>CVE-2025-55182 Exploitation Hits the Smart Home</title><description><![CDATA[Shortly after details of CVE-2025-55182 became public, we began noticing large volumes of exploitation attempts across our endpoint and network sensors. The vulnerability, informally referred to as React2Shell, affects Node.js applications that allow user-supplied JSON data to influence internal JavaScript object structures. When improperly validated, attackers can escalate this into remote command execution through access to process.mainModule.require and, subsequently, child_process.execSync. ]]></description><link>https://www.bitdefender.com/en-us/blog/labs/cve-2025-55182-exploitation-hits-the-smart-home</link><guid isPermaLink="false">6937f928a89a0404d6eab153</guid><category><![CDATA[IoT Research]]></category><dc:creator>Ioan Alexandru MELNICIUC</dc:creator><pubDate>Tue, 09 Dec 2025 09:37:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/12/pexels-jakubzerdzicki-19089175.jpg" medium="image"/><content:encoded><![CDATA[Shortly after details of CVE-2025-55182 became public, we began noticing large volumes of exploitation attempts across our endpoint and network sensors. The vulnerability, informally referred to as React2Shell, affects Node.js applications that allow user-supplied JSON data to influence internal JavaScript object structures. When improperly validated, attackers can escalate this into remote command execution through access to process.mainModule.require and, subsequently, child_process.execSync. ]]></content:encoded></item><item><title>Fake Battlefield 6 Pirated Versions and Game Trainers Used to Deploy Stealers and C2 Agents</title><description><![CDATA[Bitdefender Labs has identified malware campaigns exploiting the popularity of EA's Battlefield 6 first-person shooter, distributed via supposedly pirated versions, game installers, and fake game trainers across torrent trackers and other easily found websites. ]]></description><link>https://www.bitdefender.com/en-us/blog/labs/fake-battlefield-6-pirated-games-trainers</link><guid isPermaLink="false">691d9c99a89a0404d6eab0c2</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Raul Vasile BUCUR</dc:creator><pubDate>Tue, 25 Nov 2025 13:45:23 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/11/0d0c073a-b001-4f77-818b-21eec97e3cbd.png" medium="image"/><content:encoded><![CDATA[Bitdefender Labs has identified malware campaigns exploiting the popularity of EA's Battlefield 6 first-person shooter, distributed via supposedly pirated versions, game installers, and fake game trainers across torrent trackers and other easily found websites. ]]></content:encoded></item><item><title>The Scam That Won’t Quit: Malicious “TradingView Premium” Ads Jump from Meta to Google and YouTube</title><description><![CDATA[Over the past year, Bitdefender researchers have been monitoring a persistent malicious campaign that initially spread via Facebook Ads, promising “free access” to TradingView Premium and other trading or financial platforms.

According to researchers at Bitdefender Labs, this campaign has now expanded beyond Meta platforms, infiltrating both YouTube and Google Ads, exposing content creators and regular users alike to increased risks.

Unlike legitimate ads, these malicious campaigns redirect us]]></description><link>https://www.bitdefender.com/en-us/blog/labs/the-scam-that-wont-quit-malicious-tradingview-premium-ads-jump-from-meta-to-google-and-youtube</link><guid isPermaLink="false">68d412f4a89a0404d6eab08d</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Alin MOLOCE</dc:creator><pubDate>Thu, 25 Sep 2025 12:55:05 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/09/The-Scam-That-Won-t-Quit-Malicious--TradingView-Premium--Ads-Jump-from-Meta-to-Google-and-YouTube.jpeg" medium="image"/><content:encoded><![CDATA[Over the past year, Bitdefender researchers have been monitoring a persistent malicious campaign that initially spread via Facebook Ads, promising “free access” to TradingView Premium and other trading or financial platforms.

According to researchers at Bitdefender Labs, this campaign has now expanded beyond Meta platforms, infiltrating both YouTube and Google Ads, exposing content creators and regular users alike to increased risks.

Unlike legitimate ads, these malicious campaigns redirect us]]></content:encoded></item><item><title>Malvertising Campaign on Meta Expands to Android, Pushing Advanced Crypto-Stealing Malware to Users Worldwide</title><description><![CDATA[Many people believe that smartphones are somehow less of a target for threat actors. They couldn’t be more wrong.

Bitdefender Labs warns that cybercriminals are doubling down on spreading malware through Meta’s advertising system. After months of targeting Windows desktop users with fake ads for trading and cryptocurrency platforms, hackers are now shifting towards Android users worldwide.

Bitdefender researchers recently uncovered a wave of malicious ads on Facebook that lure targets with pro]]></description><link>https://www.bitdefender.com/en-us/blog/labs/malvertising-campaign-on-meta-expands-to-android-pushing-advanced-crypto-stealing-malware-to-users-worldwide</link><guid isPermaLink="false">68ac12a8a89a0404d6eaafaf</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Ionut Alexandru BALTARIU</dc:creator><pubDate>Tue, 26 Aug 2025 14:44:16 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/08/Malvertising-Campaign-on-Meta-Expands-to-Android--Pushing-Advanced-Crypto-Stealing-Malware-to-Users-Worldwide.jpeg" medium="image"/><content:encoded><![CDATA[Many people believe that smartphones are somehow less of a target for threat actors. They couldn’t be more wrong.

Bitdefender Labs warns that cybercriminals are doubling down on spreading malware through Meta’s advertising system. After months of targeting Windows desktop users with fake ads for trading and cryptocurrency platforms, hackers are now shifting towards Android users worldwide.

Bitdefender researchers recently uncovered a wave of malicious ads on Facebook that lure targets with pro]]></content:encoded></item><item><title>Vulnerabilities Identified in Dahua Hero C1 Smart Cameras</title><description><![CDATA[Researchers at Bitdefender have identified critical security vulnerabilities in the firmware of the Dahua Hero C1 (DH-H4C) smart camera series. The flaws, affecting the device's ONVIF protocol and file upload handlers, allow unauthenticated attackers to execute arbitrary commands remotely, effectively taking over the device.

The vulnerabilities were reported to Dahua for responsible mitigation and disclosure and are now patched at the time of publication.


Affected Devices

The issues were ver]]></description><link>https://www.bitdefender.com/en-us/blog/labs/vulnerabilities-identified-in-dahua-hero-c1-smart-cameras</link><guid isPermaLink="false">688a2c7495161a04e7e9533a</guid><category><![CDATA[Whitepapers]]></category><category><![CDATA[IoT Research]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Wed, 30 Jul 2025 14:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/07/Technology_Background_-_Digital_Hand_Unlocking_Portal-1.jpg" medium="image"/><content:encoded><![CDATA[Researchers at Bitdefender have identified critical security vulnerabilities in the firmware of the Dahua Hero C1 (DH-H4C) smart camera series. The flaws, affecting the device's ONVIF protocol and file upload handlers, allow unauthenticated attackers to execute arbitrary commands remotely, effectively taking over the device.

The vulnerabilities were reported to Dahua for responsible mitigation and disclosure and are now patched at the time of publication.


Affected Devices

The issues were ver]]></content:encoded></item><item><title>Weaponizing Facebook Ads: Inside the Multi-Stage Malware Campaign Exploiting Cryptocurrency Brands</title><description><![CDATA[A persistent malvertising campaign is plaguing Facebook, leveraging the reputations of well-known cryptocurrency exchanges to lure victims into a maze of malware. Since Bitdefender Labs started investigating, this evolving threat has posed a serious risk by deploying cleverly disguised front-end scripts and custom payloads on users’ devices, all under the guise of legitimate cryptocurrency platforms and influencers.

This report unveils how the attackers use advanced evasion tactics, mass brand ]]></description><link>https://www.bitdefender.com/en-us/blog/labs/weaponizing-facebook-ads-inside-the-multi-stage-malware-campaign-exploiting-cryptocurrency-brands</link><guid isPermaLink="false">681b4e61d38c8a0502eefaec</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Ionut Alexandru BALTARIU</dc:creator><pubDate>Thu, 08 May 2025 12:55:18 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/05/Weaponizing-Facebook-Ads-Inside-the-Multi-Stage-Malware-Campaign-Exploiting-Cryptocurrency-Brands--2-.jpeg" medium="image"/><content:encoded><![CDATA[A persistent malvertising campaign is plaguing Facebook, leveraging the reputations of well-known cryptocurrency exchanges to lure victims into a maze of malware. Since Bitdefender Labs started investigating, this evolving threat has posed a serious risk by deploying cleverly disguised front-end scripts and custom payloads on users’ devices, all under the guise of legitimate cryptocurrency platforms and influencers.

This report unveils how the attackers use advanced evasion tactics, mass brand ]]></content:encoded></item><item><title>Active Subscription Scam Campaigns Flooding the Internet</title><description><![CDATA[Bitdefender researchers have uncovered a surge in subscription scams, both in scale and sophistication, spurred by a massive campaign involving hundreds of fraudulent websites.

What sets this campaign apart is the significant investment cybercriminals have undertaken to make these fake sites look convincingly legitimate.  

Gone are the days when a suspicious email, SMS, or basic phishing link could easily fool users. As people grow more cautious and cyber-aware, scammers are stepping up their ]]></description><link>https://www.bitdefender.com/en-us/blog/labs/active-subscription-scam-campaigns-flooding-the-internet</link><guid isPermaLink="false">6810e6e8d38c8a0502eefa55</guid><category><![CDATA[Scam Research]]></category><dc:creator>Răzvan GOSA</dc:creator><pubDate>Wed, 30 Apr 2025 13:02:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/04/advanced_persistent_threats.jpg" medium="image"/><content:encoded><![CDATA[Bitdefender researchers have uncovered a surge in subscription scams, both in scale and sophistication, spurred by a massive campaign involving hundreds of fraudulent websites.

What sets this campaign apart is the significant investment cybercriminals have undertaken to make these fake sites look convincingly legitimate.  

Gone are the days when a suspicious email, SMS, or basic phishing link could easily fool users. As people grow more cautious and cyber-aware, scammers are stepping up their ]]></content:encoded></item><item><title>Hundreds of Malicious Google Play-Hosted Apps Bypassed Android 13 Security With Ease</title><description><![CDATA[Bitdefender's security researchers have identified a large-scale ad fraud campaign that deployed hundreds of malicious apps in the Google Play Store, resulting in more than 60 million downloads total. The apps display out-of-context ads and even try to persuade victims to give away credentials and credit card information in phishing attacks.

The Google Play Store is often targeted by cybercriminals trying to upload malicious apps by bypassing existing protections. Google purges the store of suc]]></description><link>https://www.bitdefender.com/en-us/blog/labs/malicious-google-play-apps-bypassed-android-security</link><guid isPermaLink="false">67d81eb3d38c8a0502eef971</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Alecsandru Cătălin DAJ</dc:creator><pubDate>Tue, 18 Mar 2025 13:05:28 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/03/Hand-holding-phone--security-app-on-screen-522371570_7360x4912.jpg" medium="image"/><content:encoded><![CDATA[Bitdefender's security researchers have identified a large-scale ad fraud campaign that deployed hundreds of malicious apps in the Google Play Store, resulting in more than 60 million downloads total. The apps display out-of-context ads and even try to persuade victims to give away credentials and credit card information in phishing attacks.

The Google Play Store is often targeted by cybercriminals trying to upload malicious apps by bypassing existing protections. Google purges the store of suc]]></content:encoded></item><item><title>Lazarus Group Targets Organizations with Sophisticated LinkedIn Recruiting Scam</title><description><![CDATA[Bitdefender Labs warns of an active campaign by the North Korea-linked Lazarus Group, targeting organizations by capturing credentials and delivering malware through fake LinkedIn job offers.

LinkedIn may be a vital tool for job seekers and professionals, but it has also become a playground for cybercriminals exploiting its credibility. From fake job offers and elaborate phishing schemes to scams and even state-sponsored threat actors who prey on people’s career aspirations and trust in profess]]></description><link>https://www.bitdefender.com/en-us/blog/labs/lazarus-group-targets-organizations-with-sophisticated-linkedin-recruiting-scam</link><guid isPermaLink="false">67a1dc4fd38c8a0502eef935</guid><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Ionut Alexandru BALTARIU</dc:creator><pubDate>Wed, 05 Feb 2025 13:59:47 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/02/Lazarus-Group-Targets-Organizations-with-Sophisticated-LinkedIn-Recruiting-Scam.jpeg" medium="image"/><content:encoded><![CDATA[Bitdefender Labs warns of an active campaign by the North Korea-linked Lazarus Group, targeting organizations by capturing credentials and delivering malware through fake LinkedIn job offers.

LinkedIn may be a vital tool for job seekers and professionals, but it has also become a playground for cybercriminals exploiting its credibility. From fake job offers and elaborate phishing schemes to scams and even state-sponsored threat actors who prey on people’s career aspirations and trust in profess]]></content:encoded></item></channel>
        </rss>