The Aurora ransomware group has been active since April 2026, targeting multiple organizations globally with a Linux ransomware variant tailored for ESXi environments. This ransomware uses ChaCha20 encryption combined with RSA-4096 key wrapping. A notable feature of their operations is the abuse of Cursor Agent alongside Claude Sonnet AI to assist in exploitation activities such as privilege enumeration, network scanning, NTLM relay attacks, and certificate attacks. The group imposes operational restrictions to avoid detection and disruption, including prohibiting DCSync, account lockouts, and adding new computer objects to domains. A separate cluster of Aurora activity involves SQL Server lateral movement, GodPotato escalation, and S3-based data exfiltration. The threat affects organizations in multiple countries including the United States, Argentina, Austria, Germany, Israel, and Spain.
SiriusQT is a Windows Remote Access Trojan (RAT) distributed as Malware-as-a-Service since April 2026. It offers advanced capabilities including hidden VNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence. The malware uses custom encrypted command-and-control communication and has both native C++ and .NET loader variants. It is distributed primarily by a reseller named GhostKernel and targets victims in several European countries including the UK, Germany, France, Spain, Italy, and the Netherlands.
Midnight Mimosa is a widespread Android malware campaign involving malicious applications preinstalled in the firmware of low-cost MediaTek-based devices. It affects over 150 countries, with highest concentrations in Mexico, France, and Italy. The malware leverages platform-signed system apps to silently deploy payloads, evade security protections, and execute remotely supplied code. It monetizes compromised devices through advertising fraud and residential-proxy services. The malicious firmware components provide persistent system-level access before device activation and bypass conventional Android security controls by temporarily disabling Google Play Store protections. Affected devices include low-cost Android handsets, counterfeit flagship models, and devices from Doogee and Cubot.
Between April and July 2026, AOMEI Backupper, a Windows backup and disk cloning software, was compromised multiple times in short-lived supply chain attack windows. During these brief periods, users received a downloader for the ShinyRoad modular backdoor framework. The attacker, tracked as UNC7017, tampered with update server configurations to redirect users to malicious payloads, including the CrossRoad dropper, a modified Radmin Server with a malicious DLL, and the Adaptix C2 framework. The campaign used ephemeral tampering windows lasting only five to ten minutes, reverting quickly to authentic versions, which complicated detection. The attack affected a broad range of users opportunistically, with some higher education, IT services, and telecommunications organizations in multiple countries identified as compromised. AOMEI initially dismissed reports of tampering but later took corrective actions after repeated notifications.
Between April and July 2026, attackers compromised AOMEI's update servers to distribute malware via brief modifications to configuration files used by AOMEI Backupper's built-in promotional and notification features. The attackers altered two configuration files to redirect software updates to malicious payloads, delivering a downloader named CROSSROAD and a backdoor called SHINYROAD. These changes were short-lived, lasting only minutes, making detection difficult. The malware established persistence and enabled remote control of infected systems. Additionally, a technique to steal Windows authentication hashes was observed during one attack window. Affected organizations spanned multiple countries and sectors. AOMEI has since upgraded its servers, patched vulnerabilities, and taken corrective actions, though details on the initial breach vector remain undisclosed.
A cyberattack targeted refrigeration controllers in hundreds of European supermarkets, causing refrigerators and freezers to defrost by raising temperatures to 50°C. The attack affected major supermarket chains including Auchan, Carrefour, E.Leclerc, Intermarché, Monoprix, and Cooperative U, with most damage in France and additional impacts in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain. The attackers exploited vulnerabilities in Danfoss refrigeration controllers, leading to significant food spoilage and financial losses estimated in the millions of euros. The incident followed a recent disclosure of vulnerabilities in the Danfoss AK-SM 800A management platform, which could allow remote code execution and configuration manipulation. It is unclear if the disclosed vulnerabilities were exploited in this attack. Recovery efforts are ongoing, and investigations are underway.
A sophisticated malware campaign named Midnight Mimosa targets low-cost Android devices using MediaTek platforms by preinstalling malicious code in device firmware before user acquisition. The malware operates as a platform-signed system application with elevated privileges, allowing silent installation of apps, permission grants, and remote code execution. It primarily facilitates ad fraud, click fraud, device data collection, and converts infected devices into residential-proxy botnet nodes. The malicious app disguises itself under system-like names and disables Google Play Store during payload deployment to evade detection. Several related malicious apps were also found on Google Play, linked to the same command-and-control infrastructure.
BraZetsu is a Python-based Windows malware framework used by the Brazilian threat actor Exilware. It functions as a toolkit for Initial Access Brokers, converting compromised systems into assets for sale in underground markets. The malware targets corporate, financial, industrial, and law enforcement sectors primarily in Iberia and Latin America. It harvests financial transaction files in the Brazilian CNAB format, browsing histories, and digital certificates. BraZetsu supports the 'Infected Marketplace' where initial access is sold to criminal clients for further exploitation. Since early 2026, it has rapidly evolved to include AI-enhanced reconnaissance and advanced evasion techniques. There is no indication of known exploits in the wild or available patches.
Operation Master is a sophisticated cybercrime campaign exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257) to compromise enterprise networks across multiple countries. The attackers conducted extensive network scanning to identify high-value targets, executed SQL injection attacks with privilege escalation to steal databases, and exfiltrated Active Directory credentials. They monetized stolen data by selling it on underground forums and operating a multi-tenant automated invoice fraud platform that sent millions of phishing messages and fraudulent links. The operation employed advanced phishing techniques including M365 OAuth device-code phishing and voice-based credential harvesting, with payments collected via PIX through serverless proxies.
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. [...]
RemControl is an Android banking trojan operating as Malware-as-a-Service since May 2026. It targets over 30 financial institutions in Western Europe, the Middle East, and Canada via fake TVTap IPTV download pages distributed through malvertising. The malware abuses Android Accessibility Service to inject phishing overlays, stream device screens in real-time, log keystrokes, and enable full remote control. The criminal infrastructure was partially built using AI-generated content, including phishing pages and C2 panel documentation. The threat actor UNKK operates these campaigns, with possible links to the Medusa UNKN affiliate botnet.
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
The Spanish Data Protection Agency (AEPD) reported the first known data breach executed by an autonomous AI agent. The AI agent chained together multiple attack phases including a successful login, vulnerability discovery, and access to personal data such as invoices. This incident marks a potential milestone in autonomous cyberattacks where AI agents independently plan and execute complex attack sequences. The investigation is ongoing, and the exact method of breach remains unclear. The AEPD highlights the need to incorporate AI adversarial risks into risk management, improve incident response speed, enhance credential protection, and adopt AI-assisted defense mechanisms with human oversight.
StreamRat is an Android banking trojan distributed via Meta and TikTok ads disguised as a free TV-streaming app targeting Spanish-speaking users, mainly in Spain. It uses a two-stage installation with a dropper that disables internet connectivity through fake VPN connections. After installation, it abuses Accessibility Services and the MediaProjection API to grant attackers near-complete control over the device, including VNC remote control, hidden screen manipulation, keylogging, credential-stealing overlays, UI data collection, and screen blocking. The malware operates as a Malware-as-a-Service with a multi-role control panel and WebSocket-based command and control communications. The campaign potentially affected around 570,000 users. No official patch or remediation guidance is currently available.
Manic is a newly discovered Android malware family that steals banking credentials, intercepts sensitive data, and allows remote control of infected devices. It uniquely exfiltrates stolen data even without an internet connection by exploiting Android Accessibility services to capture keystrokes and replay them on targeted apps. The malware targets banking apps, government apps, crypto wallets, and two-factor authentication apps across multiple European countries. Infection vectors likely include unofficial app stores, malicious APKs, and phishing links, with no evidence of distribution via Google Play. Manic abuses Accessibility permissions to spy on users, grant itself additional permissions, and prevent removal. It overlays an invisible keyboard to capture passwords and sensitive input. The malware has been active since at least May 2026 and continues to evolve to evade detection.
BraZetsu is a sophisticated Python-based Windows malware framework attributed to the Brazilian threat actor Exilware, functioning as a comprehensive toolkit for Initial Access Brokers. Unlike standard infostealers, BraZetsu transforms compromised systems into commercial assets through deep reconnaissance capabilities targeting Iberian and Latin American corporate, financial, industrial, and law enforcement environments. The framework scans for standardized financial remittance files in Brazilian CNAB format, extracts detailed browser histories, and employs AI-enhanced data triage for target prioritization. Operating through a modular architecture with stealth techniques, BraZetsu powers the Infected Marketplace where Exilware commercializes initial access to compromised hosts. The platform allows criminal customers to remotely execute secondary malicious payloads on purchased access, creating a persistent threat-multiplier effect. Tracked since February 2026, BraZetsu demonstrates rapid technical progressi...
Between late September 2025 and early April 2026, the threat group BlueDelta conducted espionage campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye. They deployed HOOKEDGE, a lightweight Windows batch-script backdoor, via macro-enabled Word documents with diplomatic-themed lures. HOOKEDGE shares code and tradecraft overlap with the HEADLACE backdoor and abuses legitimate webhook services for command-and-control, payload staging, and data exfiltration. The implant was continuously refined to evade sandbox detection and adapt to webhook service constraints. BlueDelta used a tiered operational model, deploying second-stage payloads with shorter beaconing intervals for high-value targets while preserving initial access infrastructure.
AnonyMousKIT is an AI-powered Phishing-as-a-Service platform engineered to disable Apple's Activation Lock on stolen devices. Operating as a credit-metered system, it automates credential harvesting through email, SMS, WhatsApp, and AI-driven voice phishing calls. The investigation exposed a reseller supply chain spanning 506 domains and 168 storefront brands active since early 2024. The platform targets owners of stolen Apple devices using device-specific lures with internal model identifiers and real-time Find My statuses. Conversational AI agents impersonating Apple Support conduct vishing operations, with over 200 calls placed primarily to Brazil at minimal cost. Coding vulnerabilities exposed 120,242 lines of operational logs, revealing 689 distinct WhatsApp operator accounts and detailed attack infrastructure. The ecosystem operates through a decentralized enterprise structure with developers, resellers, and hundreds of subscriber-operators monetizing stolen iPhone hardware through industrialized soc...
A newly identified Android malware family named Manic combines banking malware and mobile spyware capabilities, targeting Ukrainian banks, government services, messaging applications, Russian and European financial institutions, and global fintech and cryptocurrency services. Active since February 2026, Manic enables extensive Device Takeover operations through sophisticated surveillance and remote-control features. It employs advanced PIN stealing techniques without requiring traditional overlay attacks, utilizing Accessibility services as a UI keylogger to capture lock-screen inputs, recovery phrases, and authentication codes. A distinctive feature is its Wi-Fi mesh egress technique, allowing compromised devices to relay stolen data through other infected phones via Wi-Fi Direct, Bluetooth, or BLE when direct C2 access is unavailable. The malware monitors 169 applications including banks, cryptocurrency wallets, government eID services, and military-focused messengers across multiple countries.
Grandoreiro, a notorious banking trojan active since 2016 across Latin America, continues operations despite major law enforcement disruption in 2024. Recent campaigns leverage DLL sideloading techniques, abusing the legitimate Duplicate Files Finder application to execute malicious code. The loader incorporates extensive anti-analysis mechanisms including sandbox detection, virtual machine artifact checks, process blacklisting, and environment profiling to evade automated analysis systems. These defensive checks occur before C2 contact, indicating high priority on avoiding detection. Telemetry from June 2026 shows activity concentrated in Latin America, primarily Mexico, with limited presence in Europe and North America. The malware uses custom string obfuscation combining proprietary decryption with Base64 encoding, and communicates with C2 infrastructure over TCP port 6432 using encrypted requests containing host-specific information.
