Exposed Dixell/Copeland XWEB PRO refrigeration controllers with unpatched vulnerabilities, notably CVE-2026-25085, are being exploited as part of an SMTP botnet. These industrial control devices, commonly used in supermarkets and cold storage, are abused as tunnel gateways, residential proxy exits, and spam senders. Analysis shows coordinated outbound SMTP traffic targeting overlapping mail lists, indicating organized malicious use. The vulnerable devices lack security monitoring, enabling prolonged exploitation without detection.
Over 100 stores across multiple European countries experienced cyberattacks targeting internet-exposed refrigeration controllers, causing fridges and freezers to heat up and spoil food. The attacks affected stores in Belgium, Sweden, Ireland, and other countries, with some units set as high as 50°C. The incidents resemble a prior wave of attacks in France that disrupted around 700 supermarkets. The compromised devices include legacy Danfoss and Copeland refrigeration controllers, many of which have management interfaces exposed to the internet and lack available patches. The attackers exploited default credentials and internet exposure to force refrigeration units into defrost mode. Physical modifications alongside software updates are needed to fully mitigate the vulnerability. Investigations are ongoing, and no group has claimed responsibility.
Star Blizzard is a Russian espionage group linked to the Federal Security Service Centre 18, targeting government, defense, NGOs, and academia mainly in the UK, US, Ukraine, and NATO countries. The group uses spear-phishing, impersonation, and relationship building to steal credentials and conduct hack-and-leak operations. Since 2024, they have expanded to deploying endpoint malware including SPICA, YESROBOT, MAYBEROBOT, and CosmicPulse backdoors. Their tactics evolved from targeted to bulk phishing campaigns using fake CAPTCHA lures and exploiting iOS devices with the DarkSword exploit kit. They also use compromised WordPress sites for infrastructure and rapidly develop new malware variants after exposure. Recent campaigns have targeted over 100 organizations with the RedFlick delivery chain, showing increased scale and sophistication.
SiriusQT is a Windows Remote Access Trojan (RAT) distributed as Malware-as-a-Service since April 2026. It offers advanced capabilities including hidden VNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence. The malware uses custom encrypted command-and-control communication and has both native C++ and .NET loader variants. It is distributed primarily by a reseller named GhostKernel and targets victims in several European countries including the UK, Germany, France, Spain, Italy, and the Netherlands.
Midnight Mimosa is a widespread Android malware campaign involving malicious applications preinstalled in the firmware of low-cost MediaTek-based devices. It affects over 150 countries, with highest concentrations in Mexico, France, and Italy. The malware leverages platform-signed system apps to silently deploy payloads, evade security protections, and execute remotely supplied code. It monetizes compromised devices through advertising fraud and residential-proxy services. The malicious firmware components provide persistent system-level access before device activation and bypass conventional Android security controls by temporarily disabling Google Play Store protections. Affected devices include low-cost Android handsets, counterfeit flagship models, and devices from Doogee and Cubot.
A coordinated disruption targeted Chinese-speaking cybercriminals operating three major phishing kits—CoGUI, CoAceV, and CoFish_Ws—that distributed hundreds of millions of credential phishing messages primarily against Japanese organizations. These phishing campaigns impersonated 66 well-known consumer and finance brands to steal usernames, passwords, and payment data. The threat actors used sophisticated evasion techniques, including approximately 17,000 unique rotating domains. The disruption involved civil lawsuits and domain seizures against ecosystem enablers YAM Store and Iron Man, conducted collaboratively by Microsoft, Health-ISAC, and security partners. This action is expected to significantly disrupt multiple threat groups involved in financial fraud within the Chinese phishing ecosystem.
A sophisticated malware campaign named Midnight Mimosa targets low-cost Android devices using MediaTek platforms by preinstalling malicious code in device firmware before user acquisition. The malware operates as a platform-signed system application with elevated privileges, allowing silent installation of apps, permission grants, and remote code execution. It primarily facilitates ad fraud, click fraud, device data collection, and converts infected devices into residential-proxy botnet nodes. The malicious app disguises itself under system-like names and disables Google Play Store during payload deployment to evade detection. Several related malicious apps were also found on Google Play, linked to the same command-and-control infrastructure.
Operation Master is a sophisticated cybercrime campaign exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257) to compromise enterprise networks across multiple countries. The attackers conducted extensive network scanning to identify high-value targets, executed SQL injection attacks with privilege escalation to steal databases, and exfiltrated Active Directory credentials. They monetized stolen data by selling it on underground forums and operating a multi-tenant automated invoice fraud platform that sent millions of phishing messages and fraudulent links. The operation employed advanced phishing techniques including M365 OAuth device-code phishing and voice-based credential harvesting, with payments collected via PIX through serverless proxies.
RemControl is an Android banking trojan first observed in July 2026 that targets financial institutions across Western Europe, the Middle East, and Canada. The malware is distributed through fake Google Play Store pages advertising TVTap, an IPTV application, using malvertising campaigns with geo-targeted delivery. Once installed, the dropper creates a local VPN to block Play Protect checks and generates unique signing certificates per installation. RemControl exploits Android Accessibility Service permissions to display phishing overlays for over 30 banking applications, capturing PINs, mobile banking codes, and card details. The malware includes remote control capabilities, screen streaming, keylogging, and lock-screen pattern capture. It operates as Malware-as-a-Service with infrastructure showing evidence of AI-assisted development in phishing page creation and documentation.
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...]
RemControl is an Android banking trojan operating as Malware-as-a-Service since May 2026. It targets over 30 financial institutions in Western Europe, the Middle East, and Canada via fake TVTap IPTV download pages distributed through malvertising. The malware abuses Android Accessibility Service to inject phishing overlays, stream device screens in real-time, log keystrokes, and enable full remote control. The criminal infrastructure was partially built using AI-generated content, including phishing pages and C2 panel documentation. The threat actor UNKK operates these campaigns, with possible links to the Medusa UNKN affiliate botnet.
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
The GrelosGTM cybercriminal group abuses the legitimate functionality of Google Tag Manager to compromise e-commerce websites, primarily those running Magento CMS. Since early 2020, they have injected malicious Google Tag Manager scripts that load multi-stage JavaScript payloads via WebSocket connections. The final payload is a heavily obfuscated JavaScript sniffer designed to steal payment card information during checkout through fake payment forms. Stolen data is exfiltrated to attacker-controlled servers. The campaign has affected at least seven websites across Belgium, Italy, the United Kingdom, and the United States.
A threat actor exploited CVE-2026-15409, a critical unauthenticated server-side request forgery vulnerability in SonicWall SMA1000 appliances, to gain command execution and steal credentials. The attacker used a modified public proof-of-concept exploit to access internal Erlang services on the appliance, enabling remote code execution. This allowed extraction of LDAP configurations, Active Directory credentials, and deployment of tools to dump secrets from internal Windows systems. The campaign targeted at least 250 SonicWall SMA1000 devices across multiple countries and sectors, with confirmed credential theft in France, India, Italy, and the US. The attack leveraged compromised appliances as pivots into internal networks, exposing sensitive Active Directory data and enabling DCSync attacks against domain controllers. The targeting was opportunistic and technology-driven rather than sector-specific. The campaign was uncovered through an open directory left exposed by the attacker, providing a comprehensive view of the operation.
Trezor warned customers that threat actors who breached its third-party email provider are conducting phishing attacks targeting its users. The phishing emails impersonate Trezor and claim a critical hardware vulnerability, attempting to trick recipients into clicking malicious links. Trezor has taken down the fraudulent domain and is investigating the breach. This incident follows a prior data breach involving Trezor's shipping provider ShipMonk, which exposed customer order data affecting tens of thousands of users across multiple countries. The phishing attack leverages compromised email infrastructure rather than a direct vulnerability in Trezor products.
AnonyMousKIT is an AI-powered Phishing-as-a-Service platform engineered to disable Apple's Activation Lock on stolen devices. Operating as a credit-metered system, it automates credential harvesting through email, SMS, WhatsApp, and AI-driven voice phishing calls. The investigation exposed a reseller supply chain spanning 506 domains and 168 storefront brands active since early 2024. The platform targets owners of stolen Apple devices using device-specific lures with internal model identifiers and real-time Find My statuses. Conversational AI agents impersonating Apple Support conduct vishing operations, with over 200 calls placed primarily to Brazil at minimal cost. Coding vulnerabilities exposed 120,242 lines of operational logs, revealing 689 distinct WhatsApp operator accounts and detailed attack infrastructure. The ecosystem operates through a decentralized enterprise structure with developers, resellers, and hundreds of subscriber-operators monetizing stolen iPhone hardware through industrialized soc...
Hackers stole the customers’ shipping information, including names, addresses, email addresses, and phone numbers. The post 14,000 Trezor Customers Impacted by Data Breach at ShipMonk appeared first on SecurityWeek .
A data breach occurred at ShipMonk, a shipping provider for Trezor, exposing personal details of approximately 13,689 customers who placed orders between May and August 2026. Exposed data includes full names, email addresses, phone numbers, and shipping addresses. Trezor's own systems and hardware wallets were not compromised. The breach increases the risk of phishing attacks targeting affected customers. Trezor has notified impacted individuals and is working with ShipMonk to investigate and secure systems. Customers are advised to be vigilant against phishing and not to share wallet backups or sensitive information.
Trezor, a hardware wallet manufacturer, disclosed a data breach affecting nearly 14,000 customers due to a hack of its shipping provider, ShipMonk. The attackers accessed customer order data including full names, shipping addresses, email addresses, and phone numbers. The breach impacts customers from multiple countries who received orders between May 10 and August 8, 2026. Trezor's own systems and devices were not compromised, but affected customers may face increased phishing attempts using the stolen data. The company warns users to be vigilant against scams impersonating banks, crypto exchanges, or Trezor itself.
Kratos is a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the United States, Europe, and other regions. The platform enables attackers to steal credentials through trusted platforms, anti-bot verification, and convincing login pages. Researchers traced three generations of the kit and uncovered 1,484 previously unattributed detonations. The operation targets organizations across more than 20 countries with particularly strong concentration in the US, Spain, and Southern Europe. Kratos includes an operator panel allowing deployment of phishing domains, configurable Telegram or email delivery, geographic restrictions, and multiple anti-bot systems. The kit has evolved through three page generations (V0, V1, V2) with different exfiltration code. Activity has been visible since January 2026, with the operator panel active since September 2025.
