The KeyHunter operation is a multi-vector cyber campaign by the Chinese-speaking threat actor leepsmarts targeting academic institutions and cloud infrastructure. It involves theft of large numbers of LLM API keys from misconfigured cloud platforms, creation of fraudulent student accounts at multiple universities, and processing of stolen Harvard alumni data. The operation uses AI agent frameworks and Telegram bots for automation. Parallel financial fraud includes cryptocurrency draining and credit card validation using stolen credentials. The infrastructure spans multiple countries and has been active since early 2026.
A large-scale supply chain compromise affected MECOOL Android set-top boxes manufactured by Videostrong Technology Co., Ltd. Over 1.3 million devices were pre-infected with the x.cpe backdoor, enabling system-level access via MQTT infrastructure. The backdoor deploys multiple payloads including residential proxy SDKs and various ad fraud modules. Approximately 500,000 infected devices remain active, primarily in Malaysia, Mexico, and Brazil. The operation supports a pay-per-install campaign that fuels ad fraud and proxy ecosystems. Google has permanently banned Videostrong from the Android ecosystem due to this compromise.
The Aurora ransomware group has been active since April 2026, targeting multiple organizations globally with a Linux ransomware variant tailored for ESXi environments. This ransomware uses ChaCha20 encryption combined with RSA-4096 key wrapping. A notable feature of their operations is the abuse of Cursor Agent alongside Claude Sonnet AI to assist in exploitation activities such as privilege enumeration, network scanning, NTLM relay attacks, and certificate attacks. The group imposes operational restrictions to avoid detection and disruption, including prohibiting DCSync, account lockouts, and adding new computer objects to domains. A separate cluster of Aurora activity involves SQL Server lateral movement, GodPotato escalation, and S3-based data exfiltration. The threat affects organizations in multiple countries including the United States, Argentina, Austria, Germany, Israel, and Spain.
Star Blizzard is a Russian espionage group linked to the Federal Security Service Centre 18, targeting government, defense, NGOs, and academia mainly in the UK, US, Ukraine, and NATO countries. The group uses spear-phishing, impersonation, and relationship building to steal credentials and conduct hack-and-leak operations. Since 2024, they have expanded to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Their tactics evolved from targeted to bulk phishing campaigns using fake CAPTCHA lures and exploiting iOS devices with the DarkSword exploit kit. They also use compromised WordPress sites for infrastructure and rapidly develop new malware variants after exposure. Recent campaigns have targeted over 100 organizations with the RedFlick delivery chain, showing increased scale and sophistication.
Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data is partially initialized, leading to invalid data treatment. CVE-2026-109619 exploits stale global state where request-owned internal state survives after memory is freed. Both vulnerabilities can be exploited successfully on ARM64 systems and x86 systems without ASLR. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Over 2.6 million internet-facing hosts running PHP were identified as vulnerable, with 42% on end-of-life branches receiving no official patches. Early exploitation attempts were observed from multiple sources, including scanning activity and webshell deployment attempts targeting the upload-progress vulnerability path.
SiriusQT is a Windows Remote Access Trojan (RAT) distributed as Malware-as-a-Service since April 2026. It offers advanced capabilities including hidden VNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence. The malware uses custom encrypted command-and-control communication and has both native C++ and .NET loader variants. It is distributed primarily by a reseller named GhostKernel and targets victims in several European countries including the UK, Germany, France, Spain, Italy, and the Netherlands.
Midnight Mimosa is a widespread Android malware campaign involving malicious applications preinstalled in the firmware of low-cost MediaTek-based devices. It affects over 150 countries, with highest concentrations in Mexico, France, and Italy. The malware leverages platform-signed system apps to silently deploy payloads, evade security protections, and execute remotely supplied code. It monetizes compromised devices through advertising fraud and residential-proxy services. The malicious firmware components provide persistent system-level access before device activation and bypass conventional Android security controls by temporarily disabling Google Play Store protections. Affected devices include low-cost Android handsets, counterfeit flagship models, and devices from Doogee and Cubot.
A cyberattack targeted refrigeration controllers in hundreds of European supermarkets, causing refrigerators and freezers to defrost by raising temperatures to 50°C. The attack affected major supermarket chains including Auchan, Carrefour, E.Leclerc, Intermarché, Monoprix, and Cooperative U, with most damage in France and additional impacts in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain. The attackers exploited vulnerabilities in Danfoss refrigeration controllers, leading to significant food spoilage and financial losses estimated in the millions of euros. The incident followed a recent disclosure of vulnerabilities in the Danfoss AK-SM 800A management platform, which could allow remote code execution and configuration manipulation. It is unclear if the disclosed vulnerabilities were exploited in this attack. Recovery efforts are ongoing, and investigations are underway.
A sophisticated malware campaign named Midnight Mimosa targets low-cost Android devices using MediaTek platforms by preinstalling malicious code in device firmware before user acquisition. The malware operates as a platform-signed system application with elevated privileges, allowing silent installation of apps, permission grants, and remote code execution. It primarily facilitates ad fraud, click fraud, device data collection, and converts infected devices into residential-proxy botnet nodes. The malicious app disguises itself under system-like names and disables Google Play Store during payload deployment to evade detection. Several related malicious apps were also found on Google Play, linked to the same command-and-control infrastructure.
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
Analysis reveals HEAVYGRAM, a multi-stage Windows backdoor attributed to Iran-linked threat actor Handala Hack, deployed since Fall 2023 targeting Iranian dissidents, journalists, and government opponents. The surveillance tool uses Telegram bot API for command-and-control operations, enabling remote command execution, screen capture, data exfiltration, and persistent access. Victims receive social-engineered files masquerading as legitimate applications like Telegram, KeePass, or Pictory. The implant supports DLL side-loading, registry persistence, and system reconnaissance. Infrastructure analysis identified 29 samples utilizing networks of Telegram bots and groups for operations. The malware aligns with activity disclosed by U.S. Department of Justice regarding Iran's Ministry of Intelligence and Security infrastructure seizures, with tradecraft including Vultr Object Storage and Persian-language decoys targeting specific victim profiles including academics and media personnel.
VectraRAT is a previously undocumented Malware-as-a-Service platform active since August 2022. It consists of a Go-based control server (VectraHub) and a native C++ Windows implant. The malware offers capabilities including hidden desktop control, keylogging, clipboard hijacking with cryptocurrency address replacement, browser credential theft, and a UAC bypass that elevates privileges without user prompts. It is distributed via Amadey loader and ClickFix campaigns using tax-themed lures. Victims include corporate Windows users, including Windows Server 2025, across multiple countries such as the United States, Russia, and Germany. Infrastructure analysis revealed exposed operational panels and directories across various hosting providers.
A threat actor exploited CVE-2026-15409, a critical unauthenticated server-side request forgery vulnerability in SonicWall SMA1000 appliances, to gain command execution and steal credentials. The attacker used a modified public proof-of-concept exploit to access internal Erlang services on the appliance, enabling remote code execution. This allowed extraction of LDAP configurations, Active Directory credentials, and deployment of tools to dump secrets from internal Windows systems. The campaign targeted at least 250 SonicWall SMA1000 devices across multiple countries and sectors, with confirmed credential theft in France, India, Italy, and the US. The attack leveraged compromised appliances as pivots into internal networks, exposing sensitive Active Directory data and enabling DCSync attacks against domain controllers. The targeting was opportunistic and technology-driven rather than sector-specific. The campaign was uncovered through an open directory left exposed by the attacker, providing a comprehensive view of the operation.
MacSync Stealer is a macOS information stealer and remote-access stager delivered through ClickFix social engineering and malvertising campaigns. Operating under a malware-as-a-service model, it employs sophisticated evasion techniques including process daemonization, single-byte XOR obfuscation, and in-memory AppleScript execution to bypass Apple Gatekeeper, XProtect, and EDR solutions. The malware exfiltrates credentials, browser data, cryptocurrency wallets, and SSH keys through fault-tolerant 10MB chunked uploads to command-and-control infrastructure. MacSync targets professionals in software engineering, cryptocurrency, fintech, and corporate environments across North America, Europe, and Asia-Pacific regions, with campaigns impersonating legitimate services like Google Meet, Claude AI, Docker, and TradingView to trick victims into executing malicious Terminal commands.
BigBear 2.0 is a phishing-as-a-service campaign leveraging Evilginx2 to target Microsoft 365 credentials worldwide. It uses adversary-in-the-middle techniques combined with geo-matched residential proxies to bypass multi-factor authentication, including disabling FIDO2/WebAuthn MFA. The campaign has exfiltrated thousands of credentials and session cookies, impacting over 3,300 unique victim IPs across more than 40 countries. The platform is operated by an entity known as 'General Boss' and leased to multiple affiliates. It automates cookie replay and real-time data exfiltration via Telegram.
Manic is a newly discovered Android malware family that steals banking credentials, intercepts sensitive data, and allows remote control of infected devices. It uniquely exfiltrates stolen data even without an internet connection by exploiting Android Accessibility services to capture keystrokes and replay them on targeted apps. The malware targets banking apps, government apps, crypto wallets, and two-factor authentication apps across multiple European countries. Infection vectors likely include unofficial app stores, malicious APKs, and phishing links, with no evidence of distribution via Google Play. Manic abuses Accessibility permissions to spy on users, grant itself additional permissions, and prevent removal. It overlays an invisible keyboard to capture passwords and sensitive input. The malware has been active since at least May 2026 and continues to evolve to evade detection.
Three distinct implants—SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS—have been discovered embedded in ZBT router firmware distributed through a global supply chain reaching the United States, Canada, Australia, Philippines, Germany, and Russia. DARKLANTERN is an unauthenticated UDP backdoor listening on port 9992, offering root shell access from the internet with trivial MAC address bypass. SPEAKINGSTONE is a phone-home surveillance implant that beacons to ZBT's cloud infrastructure, capable of DNS hijacking, ISP credential theft, and remote command execution. A sinkholed backup domain revealed 392 devices, 390 located in China, primarily on China Mobile's network. Internet scans identified 203 DARKLANTERN instances across 22 countries. These implants use plaintext protocols without authentication, making them hijackable by any network adversary. The affected hardware appears in white-labeled consumer products sold through mainstream retailers, representing embedded surveillance capabilities in commerciall...
A newly identified Android malware family named Manic combines banking malware and mobile spyware capabilities, targeting Ukrainian banks, government services, messaging applications, Russian and European financial institutions, and global fintech and cryptocurrency services. Active since February 2026, Manic enables extensive Device Takeover operations through sophisticated surveillance and remote-control features. It employs advanced PIN stealing techniques without requiring traditional overlay attacks, utilizing Accessibility services as a UI keylogger to capture lock-screen inputs, recovery phrases, and authentication codes. A distinctive feature is its Wi-Fi mesh egress technique, allowing compromised devices to relay stolen data through other infected phones via Wi-Fi Direct, Bluetooth, or BLE when direct C2 access is unavailable. The malware monitors 169 applications including banks, cryptocurrency wallets, government eID services, and military-focused messengers across multiple countries.
Researchers identified an exposed web directory on infrastructure supporting a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, achieving a 13.6% hit rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fake support cases before being directed to counterfeit wallet applications designed to steal recovery phrases via Telegram exfiltration. Notable findings include extensive use of AI coding assistants throughout development, including GitHub Copilot and Claude Code. When one AI model resisted malicious requests, the operator switched providers and attempted to bypass safety controls using a structured jailbreak prompt targeting the model's reasoning patterns and safety mechanisms.
Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. [...]
