Hacker Infects 18,000 'Script Kiddies' with Fake Malware Builder

A threat actor targeted low-skilled hackers, known as "script kiddies," with a fake malware builder that secretly installed a backdoor to steal data and take over computers. Security researchers at CloudSEK report that the malware infected 18,459 devices globally, mostly in Russia, the US, India, Ukraine, and Turkey. The malware, a trojanized XWorm RAT builder, was distributed through various channels including GitHub, file hosting sites, Telegram, YouTube, and websites. While many infections were cleaned via a kill switch, some remain compromised. The malware stole data like Discord tokens, system information, and location data, and allowed remote control of infected machines.