Malware Roundup Links Twitch Token Theft and Gitea Rootkit Attacks

Security Affairs’ Malware Newsletter Round 115, published on 20 September 2026, is a roundup of recent malware research and threat reports rather than a single incident. It links to reports covering a one-click backdoor known as Gray Rabbits; the Red Heron campaign, which allegedly exploited a Gitea n-day flaw and deployed a Linux rootkit; and a malicious Twitch browser extension said to have exposed 30,000 users’ OAuth tokens to a Russian bot service.

Other entries describe Chinese threat actors chaining zero-day exploits in Chrome and Windows, infection brokering across Asia using MQTT, Iranian cyber targeting of dissidents, activists and journalists, and SpiceRAT infrastructure associated with energy and government targets in Central Asia.

The collection also includes reports on the SparrowWock backdoor, a Brevo supply-chain attack affecting more than 100,000 sites with WordPress backdoors and ClickFix malware, AI-agent “skill poisoning”, the RatHat Android threat, and the KREMLIN browser extension, which allegedly bypasses Chrome integrity checks to steal banking sessions. Several linked papers examine malware detection, adversarial techniques against large language model analysers and botnet detection. The newsletter itself provides no additional technical evidence, affected-version details or remediation guidance beyond linking to the external reports.