StreamRat trojan rides fake TV apps to take over Android devices
ThreatFabric details StreamRat, an Android trojan pushed through fake TV streaming ads that can seize device control.
The Latest
Signed node.exe is latest cover for malware delivery, Symantec finds
Symantec documents attackers abusing signed node.exe to run JavaScript payloads in intrusions since February.
Russian man extradited over Excel malware sent to 80,000 freelancers
A Russian man is extradited to face charges over Excel macro malware sent to roughly 80,000 freelancers.
Fake tax and shipping lures push RMM installs across 46 countries
A 46-country phishing wave leans on fake tax and shipping forms to push legitimate RMM tools, with the US the…
Poisoned Git configs make AI coding agents run attacker commands
Manifold finds eight flaws where poisoned Git settings make seven AI coding agents run attacker commands.
Bogus download sites push implants that gut Windows Update and Defender
Microsoft ties counterfeit download sites to Silver Fox as implants disable Windows Update and carve out Defender exclusions.
Spyware wave hits Serbian activists with Pegasus and a fresh NoviSpy
Researchers confirm Pegasus and a new NoviSpy variant hit at least 14 Serbian activists and students since January.
FalconFlank demo lifts CrowdStrike Falcon privileges on patched Windows
A new public exploit abuses CrowdStrike Falcon Sensor's macro cleanup routine to raise privileges on fully patched Windows.
Two GeoNetwork bugs chain into unauthenticated server takeover
Unauthenticated attackers can chain two GeoNetwork flaws into remote code execution on government geoportal servers.
FBI flags OAuth consent phishing that survives password resets
The FBI warns OAuth consent phishing has been seizing prominent people's accounts since late 2025, and password resets do not…
Iran-linked job scam bans AI help that could flag its hidden RAT
Kaspersky ties fake coding tests with a no-AI rule to two new Iranian RATs built for Windows, Linux, and macOS.
Sangoma Switchvox SQLi now exploited for unauthenticated code execution
Attackers began hammering a critical Switchvox SQL injection weeks after the patch shipped, and exposed phone systems may all be…
FBI opens inquiry into ID verifier after license trove emerges
FBI agents opened an inquiry into an identity verification firm after a dark web shop began selling 153 million license…
Claude moves a pre-auth PLC exploit to new hardware for $536
Forescout guided Claude through a $536 exploit port between WAGO controllers, then watched a follow-up session brick the test PLC.
Spotlight
SonicWall pushes urgent fixes for exploited SMA 1000 flaw pair
SonicWall confirms attackers are chaining two new SMA 1000 zero-days into remote code execution and urges immediate hotfixes.
Sality’s peer-to-peer design carried the seed of its own takedown
US and European agencies sinkholed the 23-year-old Sality botnet by poisoning the peer lists its infected machines trust.
Jackpotting crew pleads guilty after ATMs refuse to pay out
Five Venezuelan nationals pleaded guilty to failed ATM jackpotting attempts in Kansas, with one drawing nine months.
Aesto Health breach exposed data of 9.5 million patients
Aesto Health told HHS that 9.5 million people had personal and health data stolen from its AWS infrastructure.
Features
Bogus Claude Opus 5 download on GitHub drops infostealer
A GitHub repo promising free Claude Opus 5 is quietly installing the RevStealer infostealer, according to Morphisec.
JFrog Artifactory auth bypass already abused for admin tokens
WatchTowr reports attackers are minting admin tokens through the critical JFrog Artifactory auth bypass patched August 28.
BGP hijack rerouted Softaculous updates into malware delivery
A 33-hour BGP hijack diverted Softaculous traffic and pushed a malicious Virtualizor update to a handful of servers.
Kaspersky zero-day exploit drops rogue DLL on patched Windows
Researcher Chaotic Eclipse published HardBreacher, a working exploit for a Kaspersky Endpoint Security privilege escalation zero-day.
Russia-aligned group trips AI scanners with nuke prompt
ESET says Russia-aligned UAC-0099 hides a nuclear weapon request in malware comments to stall AI-powered triage.
Thieves burn $600K in AI credits on stolen METR API key
AI safety nonprofit METR says attackers stole an API key and burned about $600,000 in model credits across two incidents.