Security Affairs rounds up malware campaigns and spyware research

The Security Affairs Malware Newsletter Round 121 collects a selection of notable malware research and related security pieces from across the international landscape, as published by Pierluigi Paganini. The roundup highlights a mix of new malware campaigns, spyware developments and research papers, drawing from vendor write-ups, security researchers and industry analyses.

Among the items featured are a virtualization-based Android spyware platform named UCreator targeting messaging apps such as WeChat and Telegram; a Magento CMS loader family called deepveindrilling in connection with 953 store infections; and reports about spyware and backdoors connected to Claude code found in various feeds and extensions.

The compilation also notes Lazarus-group activity under the banner “Operation FlashHole,” and a security notice about a malicious version of Anthropic’s Claude code identified in Cursor’s extension marketplace.

Further entries include analyses of attacks deploying signed binaries associated with ChatGPT and Claude, plus warnings from Trezor about a suspected crypto-theft implant in a hardware wallet. The newsletter also covers campaigns such as Load/Mine, described as a Hugging Face malware resurgence after takedown, and links to research papers on malicious software detection, malware classification and related topics from MDPI and arXiv.

The piece is published on 1 November 2026 and serves as a curator’s snapshot rather than a single incident report, with each item directed to the original source noted in the round-up.