Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Two Android spyware campaigns, ProSpy and ToSpy, have been discovered targeting users in the United Arab Emirates. These campaigns impersonate secure messaging apps like Signal and ToTok, distributing malware through deceptive websites and social engineering tactics. Once installed, the spyware exfiltrates sensitive data including contacts, SMS messages, files, and device information. The campaigns use persistence mechanisms to ensure continuous operation on compromised devices. ProSpy disguises itself as encryption plugins or pro versions of apps, while ToSpy exclusively mimics the ToTok app. The malware is distributed through unofficial sources, highlighting the risks of downloading apps outside official app stores.

The identified threat involves two distinct Android spyware campaigns named ProSpy and ToSpy, targeting privacy-conscious users in the United Arab Emirates (UAE). These campaigns leverage social engineering and app impersonation tactics to deceive victims into installing malicious software. Specifically, the spyware masquerades as legitimate secure messaging applications such as Signal and ToTok, which are popular for their privacy features. Distribution occurs primarily through unofficial channels and deceptive websites, bypassing official app stores, thereby increasing the risk of infection for users who download apps from untrusted sources. Once installed, both ProSpy and ToSpy establish persistence mechanisms to maintain long-term presence on compromised devices. They actively exfiltrate sensitive personal data including contacts, SMS messages, files, and device information, which could be exploited for surveillance or further malicious activities. ProSpy disguises itself as encryption plugins or premium versions of legitimate apps, while ToSpy exclusively impersonates the ToTok app. The campaigns highlight the risks associated with downloading apps outside official marketplaces and the challenges in protecting Android users against sophisticated spyware that targets privacy-focused individuals.

MD5 of 43f4dc193503947cb9449fe1cca8d3feb413a52d

MD5 of db9fe6cc777c68215bb0361139119dafee3b3194

MD5 of 154d67f871ffa19dce1a7646d5ae4ff00c509ee4

MD5 of bdc16a05bf6b771e6edb79634483c59fe041d59b

MD5 of ffaac2fdd9b6f5340d4202227b0b13e09f6ed031

SHA256 of 154d67f871ffa19dce1a7646d5ae4ff00c509ee4

SHA256 of bdc16a05bf6b771e6edb79634483c59fe041d59b

SHA256 of ffaac2fdd9b6f5340d4202227b0b13e09f6ed031

SHA256 of 43f4dc193503947cb9449fe1cca8d3feb413a52d

SHA256 of db9fe6cc777c68215bb0361139119dafee3b3194

Detailed information about New spyware campaigns target privacy-conscious Android users in the UAE. Get real-time updates, technical details, and mitigation str

Threats Tagged 't1398'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 't1398'

Lead Pen Test Professional