--- title: Best Malware posts of 2025 | daily.dev description: The most upvoted Malware posts of 2025, curated by the daily.dev community. canonical: https://daily.dev/tags/malware/best-of/2025 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/tags/malware/best-of/2025 og:type: website og:site_name: daily.dev og:title: Best Malware posts of 2025 | daily.dev og:description: The most upvoted Malware posts of 2025, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of Malware — 2025 1. 1 [](/posts/i-use-zip-bombs-to-protect-my-server-fwoackdzz "I use Zip Bombs to Protect my Server") Article Hacker News · 1y I use Zip Bombs to Protect my Server Traffic from bots is a major issue on the web, with many being malicious and aiming to exploit server vulnerabilities. Zip bombs can be used as a protective measure against these bots. A zip bomb is a small compressed file that expands to an enormous size, overwhelming the bot's server and causing it to crash. This method can be implemented by serving bots a deceptive file that they attempt to decompress, leading to system failures in less sophisticated bots. However, it is not foolproof and can be circumvented by more sophisticated scripts. 393 17 2. 2 [](/posts/how-a-senior-devops-interview-became-a-sophisticated-hacking-attempt-uvl51hgin "How a Senior DevOps Interview Became a Sophisticated Hacking Attempt") Article Serdarcan Buyukdereli · 1y How a Senior DevOps Interview Became a Sophisticated Hacking Attempt A developer shares their experience with a sophisticated phishing attack disguised as a legitimate job interview for a Senior DevOps Engineer position at Revolut. The fake recruiter sent a technical task containing malicious Python code that would create admin users and establish remote server connections. The attack demonstrates how cybercriminals are exploiting recruitment processes to target developers with seemingly innocent coding challenges. 290 20 3. 3 [](/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq "How I Almost Got Hacked By A 'Job Interview'") Article Hacker News · 52w How I Almost Got Hacked By A 'Job Interview' A developer shares a close call with a sophisticated phishing attack disguised as a legitimate job interview. The scam involved a fake LinkedIn profile from a real company, a coding challenge containing obfuscated malware designed to steal crypto wallets and credentials, and professional social engineering tactics. The attack was discovered by using an AI assistant to scan the codebase for suspicious patterns before execution. The malware was embedded in server-side code with full Node.js privileges and connected to a remote payload that disappeared within 24 hours. 247 33 4. 4 [](/posts/adult-sites-are-stashing-exploit-code-inside-racy-svg-files-umcf1drk4 "Adult sites are stashing exploit code inside racy .svg files") Article Ars Technica · 1y Adult sites are stashing exploit code inside racy .svg files Adult websites are exploiting SVG image files to embed malicious JavaScript code that automatically generates Facebook likes when users click on the images. Unlike traditional image formats, SVG files can contain executable code, making them vulnerable to attacks like cross-site scripting and clickjacking. The malicious code is heavily obfuscated using techniques like JSFuck to avoid detection, allowing these sites to artificially boost their social media engagement through unwitting user interactions. 177 29 5. 5 [](/posts/whatsapp-api-worked-exactly-as-promised-and-stole-everything-v5sijobfe "WhatsApp API worked exactly as promised, and stole everything") Article InfoWorld · 42w WhatsApp API worked exactly as promised, and stole everything A malicious npm package called "lotusbail" masqueraded as a legitimate WhatsApp Web API library for six months, accumulating over 56,000 downloads. The package functioned correctly while secretly stealing messages, credentials, and contact data through a proxy layer that intercepted all operations. It used four layers of obfuscation and RSA encryption to exfiltrate data to attacker-controlled servers. Most critically, it exploited WhatsApp's multi-device pairing to maintain persistent access even after package removal, requiring manual device unlinking. The package remains available on npm, highlighting the limitations of traditional security checks against supply-chain attacks that mimic legitimate behavior. 127 5 6. 6 [](/posts/ssh-llm-honeypot-caught-a-real-threat-actor-qnivdlatg "SSH LLM Honeypot caught a real threat actor") Article ITNEXT · 2y SSH LLM Honeypot caught a real threat actor A detailed guide on how an SSH LLM honeypot successfully trapped a real threat actor who downloaded and attempted to execute malicious binaries. The honeypot, Beelzebub, was configured with an OpenAI key and analyzed the actions of the attacker, including their attempts to connect the server to a botnet via a Perl script. The post also includes steps to configure and run the honeypot using Docker, and discusses the information gathered from the threat actor's activities, as well as actions taken to mitigate the threat. 78 1 7. 7 [](/posts/two-chrome-extensions-caught-secretly-stealing-credentials-from-over-170-sites-pps6thkfj "Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites") Article The Hacker News · 42w Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites Two malicious Chrome extensions named "Phantom Shuttle" have been discovered stealing credentials from over 170 websites. Disguised as VPN services with paid subscriptions ($1.40-$13.50), the extensions inject proxy credentials, route traffic through attacker-controlled servers, and exfiltrate user passwords, cookies, API keys, and other sensitive data every five minutes. The extensions target developer platforms (GitHub, Stack Overflow), cloud services (AWS, Azure), social media, and other high-value domains. The operation appears to be China-based and has been active since 2017\. Users should immediately remove these extensions, and security teams should implement extension allowlisting and network monitoring. 67 1 8. 8 [](/posts/xkcd-trojan-horse-le6kcg6wn "xkcd: Trojan Horse") Article xkcd · 1y xkcd: Trojan Horse An xkcd webcomic exploring the concept of Trojan Horse attacks, likely drawing parallels between the ancient Greek military strategy and modern cybersecurity threats through humor and technical insight. 62 2 9. 9 [](/posts/this-game-is-stealing-your-data-hh9encd5n "This "Game" is Stealing Your Data") Video Eric Parker · 2y This "Game" is Stealing Your Data Eric discusses the discovery and analysis of a fake game being distributed online, which installs malware on a user's system. This malware is sophisticated, using extended validation (EV) certificates to avoid detection by antivirus software. The video explores the technical details of the malicious payload and emphasizes the importance of zero trust solutions like Threat Locker for robust cybersecurity. The fake game's promotion through a seemingly legitimate campaign highlights the need for vigilance when downloading software. 54 2 10. 10 [](/posts/compromise-of-npm-packages-highlights-supply-chain-vulnerabilities-gnbawgdh4 "Compromise of npm Packages Highlights Supply Chain Vulnerabilities") Article Collections · 1y Compromise of npm Packages Highlights Supply Chain Vulnerabilities A major security breach compromised 18 popular npm packages including debug and chalk through a phishing attack on maintainer credentials. The malicious code targeted cryptocurrency transactions by intercepting wallet interactions in browsers, though no funds were reportedly stolen. This represents the largest supply chain attack in npm's history, affecting packages with billions of weekly downloads. 40 3 11. 11 [](/posts/how-hackers-take-over-computers-with-reverse-shells-atv3yvm1j "How Hackers Take Over Computers With Reverse Shells") Video Mental Outlaw · 2y How Hackers Take Over Computers With Reverse Shells Hackers often use reverse shells to gain control over target computers. This post shows how a reverse shell works using a Windows 11 virtual machine and a Kali Linux system. Despite robust antivirus measures, the reverse shell bypasses Windows Defender and other security tools. Through a detailed breakdown of the malicious code, the post explains how hackers can execute commands and take control of victim machines. It also illustrates how easily such malware can be created and deployed, highlighting the limitations of traditional antivirus solutions. 29 12. 12 [](/posts/so-that-s-why-it-s-free--svwfisqlx "So that’s why it’s free..") Video Low Level Learning · 1y So that’s why it’s free.. Russian hackers are exploiting multiple WinRAR vulnerabilities, including CVE-2025-8088, to attack businesses. The latest exploit uses alternative data streams and directory traversal techniques to place malicious DLL files in system directories, allowing attackers to execute code when legitimate applications load. These logic-based vulnerabilities are easier to exploit than memory corruption bugs because they don't require complex memory manipulation, just crafted file structures with specific properties. 25 10 13. 13 [](/posts/100-fake-chrome-extensions-found-hijacking-sessions-stealing-credentials-injecting-ads-vktm8obbm "100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads") Article The Hacker News · 1y 100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads Over 100 malicious Chrome extensions, active since February 2024, impersonated legitimate utilities to steal data and execute code. These extensions gain excessive permissions to interact with websites and execute commands from attacker-controlled domains. Users are advised to verify developers, scrutinize permissions and reviews, and avoid similar-looking extensions as Google has removed the identified threats. 23 14. 14 [](/posts/npm-sees-surge-of-auto-generated-elf-stats-packages-publis--6rymn7sfv "npm Sees Surge of Auto-Generated “elf-stats” Packages Publis...") Article Socket · 45w npm Sees Surge of Auto-Generated “elf-stats” Packages Publis... Socket's Threat Research Team discovered over 420 automated malicious packages published to npm following an "elf-stats" naming pattern. These packages were published every two minutes from newly created accounts and contained simple malware variants. npm has begun removing the affected packages, but the automated publishing continues with new variations appearing. Developers should avoid installing any packages matching the elf-stats-\* pattern until they can be verified as safe. 22 5 15. 15 [](/posts/new-rust-based-malware-chaosbot-uses-discord-channels-to-control-victims-pcs-1ct19r018 "New Rust-Based Malware "ChaosBot" Uses Discord Channels to Control Victims' PCs") Article The Hacker News · 1y New Rust-Based Malware "ChaosBot" Uses Discord Channels to Control Victims' PCs Security researchers discovered ChaosBot, a Rust-based backdoor that uses Discord channels for command-and-control operations. The malware spreads through compromised VPN credentials and phishing attacks, enabling attackers to execute commands, capture screenshots, and transfer files. A related threat, Chaos-C++ ransomware, combines file encryption with destructive deletion of large files and cryptocurrency wallet hijacking through clipboard manipulation. Both threats demonstrate increasingly sophisticated attack techniques targeting financial services and general users. 20 1 16. 16 [](/posts/fake-security-plugin-on-wordpress-enables-remote-admin-access-for-attackers-dnmrsorbo "Fake Security Plugin on WordPress Enables Remote Admin Access for Attackers") Article The Hacker News · 1y Fake Security Plugin on WordPress Enables Remote Admin Access for Attackers Cybersecurity researchers have uncovered a malicious campaign targeting WordPress sites using a fake security plugin, \`WP-antymalwary-bot.php\`, which grants attackers admin access and enables stealth reinfection and JavaScript ad fraud. The plugin camouflages itself while pinging to a command-and-control server, spreading malware, and injecting ads. Known variants include \`addons.php\` and \`wpconsole.php\`. The malware's rise since January 2025 suggests Russian involvement. Other incidents include fake font domains for card skimming and deceptive CAPTCHA verifications leading to Node.js-based backdoors, attributed to the Kongtuke traffic distribution system. 17 1 17. 17 [](/posts/self-replicating-worm-hits-180-software-packages-krebs-on-security-w74rsix5v "Self-Replicating Worm Hits 180+ Software Packages – Krebs on Security") Article Krebs on Security · 1y Self-Replicating Worm Hits 180+ Software Packages – Krebs on Security A self-replicating worm called Shai-Hulud has infected over 180 NPM packages, stealing developer credentials and automatically spreading to other packages. The malware uses stolen NPM tokens to modify popular packages, creates public GitHub repositories to expose stolen secrets, and briefly compromised CrowdStrike packages. Security experts warn this represents a new type of supply chain attack that can lay dormant and restart spreading, calling for mandatory human-verified 2FA for all package publications. 13 2 18. 18 [](/posts/new-arcane-stealer-spreading-via-youtube-and-discord-ixe5os29e "New Arcane stealer spreading via YouTube and Discord") Article Securelist · 2y New Arcane stealer spreading via YouTube and Discord Arcane stealer is a new malware distributed via YouTube and Discord, initially hidden in game cheats and cracks. It collects sensitive data from various applications, including VPNs, gaming clients, network utilities, messaging apps, and browsers. The stealer disables security features like SmartScreen and employs additional methods to extract browser cookies and keys. To protect against such threats, be cautious with untrustworthy downloads and use robust security software. 13 19. 19 [](/posts/having-fun-with-a-scamming-crypto-job-chay1qo8m "Having Fun With a Scamming Crypto Job") Article Lobsters · 2y Having Fun With a Scamming Crypto Job A detailed account of a crypto job scam that the author encountered and how they identified it as a scam. The post includes insights on recognizing dubious job offers, analyzing potentially malicious code, and provides advice on safeguarding against similar frauds. The author concludes by highlighting the importance of checking job specifics and staying vigilant, especially in the crypto industry. 12 5 20. 20 [](/posts/python-based-whatsapp-worm-spreads-eternidade-stealer-across-brazilian-devices-xay9ho3cz "Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices") Article The Hacker News · 47w Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices Eternidade Stealer, a Delphi-based banking trojan, targets Brazilian users through WhatsApp hijacking and social engineering. The malware uses a Python script (replacing previous PowerShell versions) to automate message spreading via WPPConnect, while employing IMAP to dynamically retrieve C2 addresses from compromised email accounts. The stealer monitors for banking portals, payment services, and cryptocurrency wallets, capturing credentials through overlays and keylogging. The campaign demonstrates hyper-localized targeting with OS language checks and geofencing that restricts C2 access to Brazil and Argentina, while blocked connections get redirected to Google. 11 21. 21 [](/posts/wordpress-skimmers-evade-detection-by-injecting-themselves-into-database-tables-463iy9hac "WordPress Skimmers Evade Detection by Injecting Themselves into Database Tables") Article The Hacker News · 2y WordPress Skimmers Evade Detection by Injecting Themselves into Database Tables New credit card skimmer malware targets WordPress e-commerce checkout pages by injecting malicious JavaScript into database tables, making it hard to detect. The malware activates on checkout pages, creating fake forms or hijacking existing ones to steal payment information. The stolen data is then encoded and sent to an attacker-controlled server. Recent discoveries also highlight phishing email campaigns targeting PayPal users and a novel technique called transaction simulation spoofing used to steal cryptocurrency. 10 [See all Malware archives](/tags/malware/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/tags/malware/best-of/2025#page","url":"https://daily.dev/tags/malware/best-of/2025","name":"Best Malware Posts of 2025","description":"The most upvoted Malware posts of 2025, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/tags/malware/best-of/2025#items","numberOfItems":21,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/i-use-zip-bombs-to-protect-my-server-fwoackdzz","name":"I use Zip Bombs to Protect my Server"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/how-a-senior-devops-interview-became-a-sophisticated-hacking-attempt-uvl51hgin","name":"How a Senior DevOps Interview Became a Sophisticated Hacking Attempt"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/how-i-almost-got-hacked-by-a-job-interview--h744ue0mq","name":"How I Almost Got Hacked By A 'Job Interview'"},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/adult-sites-are-stashing-exploit-code-inside-racy-svg-files-umcf1drk4","name":"Adult sites are stashing exploit code inside racy .svg files"},{"@type":"ListItem","position":5,"url":"https://daily.dev/posts/whatsapp-api-worked-exactly-as-promised-and-stole-everything-v5sijobfe","name":"WhatsApp API worked exactly as promised, and stole everything"},{"@type":"ListItem","position":6,"url":"https://daily.dev/posts/ssh-llm-honeypot-caught-a-real-threat-actor-qnivdlatg","name":"SSH LLM Honeypot caught a real threat actor"},{"@type":"ListItem","position":7,"url":"https://daily.dev/posts/two-chrome-extensions-caught-secretly-stealing-credentials-from-over-170-sites-pps6thkfj","name":"Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites"},{"@type":"ListItem","position":8,"url":"https://daily.dev/posts/xkcd-trojan-horse-le6kcg6wn","name":"xkcd: Trojan Horse"},{"@type":"ListItem","position":9,"url":"https://daily.dev/posts/this-game-is-stealing-your-data-hh9encd5n","name":"This \"Game\" is Stealing Your Data"},{"@type":"ListItem","position":10,"url":"https://daily.dev/posts/compromise-of-npm-packages-highlights-supply-chain-vulnerabilities-gnbawgdh4","name":"Compromise of npm Packages Highlights Supply Chain Vulnerabilities"},{"@type":"ListItem","position":11,"url":"https://daily.dev/posts/how-hackers-take-over-computers-with-reverse-shells-atv3yvm1j","name":"How Hackers Take Over Computers With Reverse Shells"},{"@type":"ListItem","position":12,"url":"https://daily.dev/posts/so-that-s-why-it-s-free--svwfisqlx","name":"So that’s why it’s free.."},{"@type":"ListItem","position":13,"url":"https://daily.dev/posts/100-fake-chrome-extensions-found-hijacking-sessions-stealing-credentials-injecting-ads-vktm8obbm","name":"100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads"},{"@type":"ListItem","position":14,"url":"https://daily.dev/posts/npm-sees-surge-of-auto-generated-elf-stats-packages-publis--6rymn7sfv","name":"npm Sees Surge of Auto-Generated “elf-stats” Packages Publis..."},{"@type":"ListItem","position":15,"url":"https://daily.dev/posts/new-rust-based-malware-chaosbot-uses-discord-channels-to-control-victims-pcs-1ct19r018","name":"New Rust-Based Malware \"ChaosBot\" Uses Discord Channels to Control Victims' PCs"},{"@type":"ListItem","position":16,"url":"https://daily.dev/posts/fake-security-plugin-on-wordpress-enables-remote-admin-access-for-attackers-dnmrsorbo","name":"Fake Security Plugin on WordPress Enables Remote Admin Access for Attackers"},{"@type":"ListItem","position":17,"url":"https://daily.dev/posts/self-replicating-worm-hits-180-software-packages-krebs-on-security-w74rsix5v","name":"Self-Replicating Worm Hits 180+ Software Packages – Krebs on Security"},{"@type":"ListItem","position":18,"url":"https://daily.dev/posts/new-arcane-stealer-spreading-via-youtube-and-discord-ixe5os29e","name":"New Arcane stealer spreading via YouTube and Discord"},{"@type":"ListItem","position":19,"url":"https://daily.dev/posts/having-fun-with-a-scamming-crypto-job-chay1qo8m","name":"Having Fun With a Scamming Crypto Job"},{"@type":"ListItem","position":20,"url":"https://daily.dev/posts/python-based-whatsapp-worm-spreads-eternidade-stealer-across-brazilian-devices-xay9ho3cz","name":"Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices"},{"@type":"ListItem","position":21,"url":"https://daily.dev/posts/wordpress-skimmers-evade-detection-by-injecting-themselves-into-database-tables-463iy9hac","name":"WordPress Skimmers Evade Detection by Injecting Themselves into Database Tables"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tags","item":"https://daily.dev/tags"},{"@type":"ListItem","position":3,"name":"Malware","item":"https://daily.dev/tags/malware"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/tags/malware/best-of"},{"@type":"ListItem","position":5,"name":"2025"}]}]} ```