Meet SpamGPT and MatrixPDF, New AI Toolkits Driving Malware and Phishing Attacks
Source: https://hackread.com/spamgpt-matrixpdf-ai-toolkits-malware-attacks/
Red Hat OpenShift AI Flaw Exposes Hybrid Cloud Infrastructure to Full Takeover
Source: https://thehackernews.com/2025/10/critical-red-hat-openshift-ai-flaw.html
New Android Banking Trojan “Klopatra” Uses Hidden VNC to Control Infected Smartphones
Source: https://thehackernews.com/2025/10/new-android-banking-trojan-klopatra.html
New MatrixPDF toolkit turns PDFs into phishing and malware lures
Source: https://www.bleepingcomputer.com/news/security/new-matrixpdf-toolkit-turns-pdfs-into-phishing-and-malware-lures/
Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs
Source: https://thehackernews.com/2025/10/ukraine-warns-of-cabinetrat-backdoor.html
Rhadamanthys is a sophisticated, multi-modular malware family sold on underground markets since September 2022, developed by experienced threat actors. It builds upon previous malware projects by the same authors, indicating continuous evolution and refinement. Although no known exploits are currently observed in the wild, its high complexity and modularity suggest it can be adapted for various attack scenarios, including espionage, data theft, or sabotage. The malware's design allows it to evade detection and maintain persistence, posing a significant risk to targeted organizations. European entities, especially those in critical infrastructure, finance, and government sectors, could be prime targets given the malware's capabilities and the strategic value of these sectors. Mitigation requires proactive threat hunting, network segmentation, and monitoring for indicators of compromise linked to Rhadamanthys. Countries with advanced digital economies and strategic geopolitical importance, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Given the malware's high potential impact on confidentiality, integrity, and availability, combined with its ease of adaptation by skilled actors, the suggested severity is high. Defenders should prioritize awareness of this threat, implement advanced detection mechanisms, and maintain updated incident response plans.
When Audits Fail: Four Critical Pre-Auth Vulnerabilities in TRUfusion Enterprise
Source: https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/
Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and military operations, with the objective of gathering sensitive information. Phantom Taurus employs distinctive tactics, techniques, and procedures, including a new malware suite called NET-STAR. This suite consists of three web-based backdoors designed to target Internet Information Services (IIS) web servers. The group has recently shifted from targeting emails to directly accessing databases, demonstrating their ability to adapt and evolve their methods. Phantom Taurus' activities align with Chinese strategic interests, and their infrastructure overlaps with other known Chinese APT groups.
Researchers Disclose Google Gemini AI Flaws Allowing Prompt Injection and Cloud Exploits
Source: https://thehackernews.com/2025/09/researchers-disclose-google-gemini-ai.html
Hacker Breaches US Surveillance Firm RemoteCOM, Accesses Court Supervision Records and Criminal Data
Source: https://hackread.com/us-surveillance-remotecom-hack-court-data/
A new Android Trojan named Datzbro has been discovered targeting seniors through fake Facebook groups promoting travel and social activities. The malware, which combines spyware and banking Trojan capabilities, is distributed via malicious APKs disguised as community apps. Datzbro features remote access, screen sharing, black overlay attacks, and keylogging, allowing attackers to perform financial fraud. It specifically targets banking and crypto-related apps, stealing credentials and sensitive information. The malware's origin appears to be Chinese-speaking developers, and its command-and-control application has been leaked, potentially making it a global threat. The campaign demonstrates the evolving sophistication of mobile threats, blending social engineering with advanced technical capabilities.
