malware
8 articles with this tag
NIKKE (Goddess of Victory) PC Launcher Files Were Tampered With and a Malicious Program Was Distributed: What Windows Users Since September 27, 15:41 JST Should Do
On November 5, 2026, the operator of Goddess of Victory: NIKKE (Level Infinite) announced that some files of its PC launcher had been tampered with by a third party, so a malicious program could run when the launcher started. According to the operator, an external domain used by part of the game service was taken over on September 27, four official CDN scripts that the launcher downloads were tampered with at 15:41 JST that day, and distribution of the malicious program through those scripts began at 3:52 on October 30. It noticed the anomaly on November 4 and replaced the scripts to block further distribution. Anyone who started the Windows PC launcher at least once since 15:41 on September 27 is in scope; people who play only on mobile are not affected. The operator says the PC, accounts on external services and assets may be affected, and since 8:00 on November 5 it has offered a scan-and-remove function in the official PC client. The scope of damage and the route of tampering are under investigation. This site's take: if you are in scope, use a separate clean device to change passwords (email, banking, crypto, game stores, Discord first), sign out other sessions, re-issue API keys and tokens, and turn on two-factor authentication.
AOMEI Backupper Update Server Tampered With (April to July 2026): Who May Be Affected, the Dates, and How to Check Your PC
AOMEI, the maker of the Windows backup software AOMEI Backupper, published a statement on October 19, 2026 (last updated October 30) about a software supply chain compromise of its update server. Citing a security company's investigation, it says that between April and July 2026 configuration files on the AOMEI Backupper update server were repeatedly changed for about five to ten minutes and then put back. During those windows, the changed configuration could make the software download malicious files. Three windows have been identified so far: May 28 (05:40–05:50 UTC), July 16 (08:33–08:39 UTC) and July 20 (10:35–10:40 UTC). The company hardened the servers by July 29, moved the update service to a new server on August 5, and released AOMEI Backupper 8.5.1 on October 19. It asks all AOMEI Backupper users, affected or not, to run its AOMEI Security Scanner, update to 8.5.1, scan with their security software and change their Windows or domain account password. The number of affected users and the affected versions have not been published. This site's take: if AOMEI Backupper was installed on a PC that was on during those windows, do all four steps, and change the Windows password from a different, clean device if you can.
Rank Math PRO 3.0.123 Shipped with Malware (October 2026): Who Is Affected and What WordPress Site Owners Should Do
On October 16, 2026 (UTC), Rank Math announced that Rank Math PRO v3.0.123, the paid version of its WordPress plugin, contained malware for a limited number of users who downloaded it between 20:02 UTC on October 15 and 07:12 UTC on October 16. The malware could compromise a site if the plugin was activated, and could recreate its hidden backdoor whenever the site was visited. The company removed the affected files and released a clean v3.0.124. The free version distributed on WordPress.org is not affected. Neither the number of affected users nor how the malware got into the files has been disclosed. As of October 20, the last change to the notice was on October 19, when a note that the free version is not affected was added. This site's conclusion: treat any site that activated a copy of 3.0.123 obtained during the affected window as compromised, and either restore from a backup taken before the window or delete the whole plugin folder and clean up in the order the company gives. Either way, change every credential the site could read.
Malware on a Daiichikosho Contractor's PC (About 8.72 Million Records): Big Echo and Other Members' Names, Birth Dates and Phone Numbers May Have Leaked — What to Do
On October 8, 2026, Daiichikosho Co., Ltd. announced that a company to which it outsources the handling of personal information had reported that one PC used by one of its employees was infected with malware, and that Daiichikosho's customer information may have leaked. Personal data related to the outsourced work had been temporarily stored on that PC. The records concern about 8,631,000 customers who registered as members or made reservations at the company's stores (Big Echo, Mega Big, Karaoke CLUB DAM, Banana Club, B-GARAGE and DK Dining, after removing duplicates) and about 93,000 employees, about 8,724,000 in total. The items are name (registered name), gender, date of birth, email address and phone number. Passwords were not included, and the company says points cannot be used with this information alone. No actual external leak, misuse or impact on the company's own systems had been confirmed. A toll-free inquiry line opened on October 9. In an addition dated October 26, the company said it is contacting customers who may be affected individually, in turn, by SMS and other means, and published the sender numbers (NTT Docomo, au and Rakuten Mobile: 05036052572, which may appear as +815036052572; SoftBank: 247473). It says this contact does not mean a new leak has been found, and that no actual external leak or misuse resulting from the incident has been confirmed. It also says the sender number alone does not guarantee that an SMS is genuine. On November 6 it published the results of a forensic investigation by an outside specialist organisation: malware infection and unauthorized communication with an outside server were found on the device the contractor had been using, and the malware had a function to send information on the device to outside parties, but what information was actually sent, and how much, could not be identified. No leak or misuse of personal information resulting from the incident has been confirmed. No traces suggesting remote control were found, and the malware had already been neutralized when the investigation began. Individual notices to customers who may be affected continue. This site's take: do not open links in messages claiming to be Big Echo or DAM about coupons, membership renewal or points, or in texts claiming to be from Daiichikosho; check in the official app or a site you open yourself, and stop using your birth date as a PIN or password.
'Your PC is infected' warnings are almost always fake: how to close them, and what to do if you already called
A browser page shouting 'your computer is infected' with a phone number is a tech support scam. Japan's IPA says that if the screen merely appeared, the PC is not infected and closing it is enough, and that most victims get hurt because they couldn't close it and called. This site's view: the goal of the fake warning is not infection — it is getting you to call. Genuine security features never show a phone number. If you can close it, you're done; if it went further, act on the stage you reached.
What is a backdoor — how attackers keep their way in, and how to spot it
A backdoor is a hidden entry point planted so an attacker can return while bypassing normal authentication. It usually follows an initial breach and turns one intrusion into ongoing access; it can also arrive inside a poisoned dependency. What separates it from legitimate remote maintenance is whether someone authorised it, knows about it, and can see it in the logs. Defense: least privilege, integrity monitoring, egress monitoring, dependency review.
Coincheck NEM Heist (2018) — How ~$530M Was Stolen, and the Key-Management Defense
The entry point was reported to be spear-phishing / malware aimed at employees, which stole the private key of an internet-connected hot wallet; ~523 million XEM (~$530M at the time) was then moved out in a single transfer. The core failure was keeping a huge, instantly-spendable balance in an online wallet with no multisig, so a single stolen key moved almost everything. Defend by keeping important keys offline or in a dedicated key store (HSM/KMS), minimizing the hot balance, removing single points of failure (multi-approval), and detecting and stopping abnormal bulk operations.
What is malware? Types, infection routes, and the basic defenses
Malware (malicious software) is the umbrella term for software built to harm your devices or data. Viruses, worms, trojans, ransomware, spyware, and bots are all types under it. However different they look, the defense is the same three parts: prevent infection (updates, don't open suspicious attachments/macros, MFA), detect (EDR, antivirus), and be able to recover (backups). Getting these shared defenses right matters far more than memorizing the type names.