Security Affairs Tracks Malware, Ransomware and Active Exploits

On 13 September 2026, Security Affairs published its 114th malware newsletter, a collection of links to recent malware research and threat reports. The roundup covers REVSTEALER, JSCeal’s compiled V8 bytecode and “GuardBreaker”, a technique intended to disrupt AI-assisted malware analysis through a code comment.

Other items examine North Korean-linked activity involving the Ted backdoor and curlRAT against South Korean media and automotive organisations, the BengalSEO operation, and a PHP web-server rootkit. The newsletter also links to research on authentication attacks, including Okta’s “signing in without actually signing in”, and reports of active exploitation involving Cisco Secure Firewall Management Center vulnerabilities.

The collection further highlights alleged in-the-wild exploitation of JFrog Artifactory vulnerabilities CVE-2026-42016, CVE-2026-42018 and CVE-2026-82329, as well as Mantax Otax, an Indonesian Android ransomware strain with spyware capabilities. Academic papers address AI-assisted Windows malware detection, limitations in using SHAP alone to explain malware detections, evaluation bias in malicious-package detection for NPM and PyPI, and a multimodal Android malware-detection framework.

The newsletter provides links to the original reports and research but does not itself give additional technical details, affected versions or mitigation instructions.