Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
84
Country
Brazil
- Mentions · 7d12
- Mentions · 30d45
- All mentions107
- First seenAug 12, 2026
- Last mentioned20h ago
Timeline
107 articles · newest firstDiscord will let search engines index public server messages
About 63,000 Discoverable Servers get public web pages from November 16; new-message indexing starts mid-December.
52
Google to allow one-tap installs from approved Android stores outside the US
Approved stores get the feature on December 1 for Android 17 QPR2 or later after ongoing malware scans.
52
Buyer's guide ranks 12 hardware security modules for 2026
The comparison stresses FIPS 140-3 status, post-quantum firmware, and appliance versus cloud delivery.
17
Attackers hijack Convertr analytics script to skim checkout card data
Sansec says a Brazilian gang altered Convertr’s Plausible tracker; the skimmer was later removed and Plausible upgraded to a patched version.
74
Election scams seek voter data, donations, fines, and fake merch
Malwarebytes outlines five lures, including a fake Minnesota absentee text and a Brazilian WhatsApp app push, backed by FBI and court warnings.
32
VLC and VMware binaries side-load malware targeting Brazil and Portugal
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
62
Finaxis WoWInstaller Moodle MyHairCare HT Médica data leaks
SOCRadar reports leaks involving Finaxis, WoWInstaller, Moodle, MyHairCare and HT Médica.
50
uCreator Android spyware steals Telegram 2FA and clones WeChat
The rentable kit hides in sideloaded Telegram and WeChat copies; its code and C2 match Doctor Web’s Baohuo.
68
Overlord and Lampion campaigns hide malware with Windows tools
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
58
Lula wins Brazil presidential runoff; Bolsonaro refuses to concede
Lula took 51.79 percent to Flávio Bolsonaro's 48.21 percent, and Bolsonaro says he will seek annulment.
4
Magecart skimmer hits Convertr checkouts through Plausible tracker
Sansec says the tracker was still serving the skimmer on October 26 and that card data plus CPF was posted to 1x0.is.
76
Four groups bypass AI guardrails and compromise targets, CrowdStrike says
A Spanish- and English-speaking actor compromised at least 15 Argentine health care organizations.
74
AOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
AOMEI has not notified customers after update-server malware hijack
Attackers briefly swapped update configs from April to July so Backupper fetched malware, and already infected PCs stay infected.
74
AOMEI Backupper updates briefly served malware in 2026
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
78
Midnight Mimosa malware ships in Android phone firmware
A platform-signed system app installs ad-fraud plugins after briefly disabling the Play Store; proxy use was not seen.
70
Man travels 2,000 km in Brazil to meet an AI-generated woman
He sold belongings to fund the bus trip; police have not established that a crime occurred.
28
Midnight Mimosa hides ad-fraud malware in cheap Android firmware
Bitdefender saw thousands of infected phones in more than 150 countries over about two years.
74
UNC7017 hijacked AOMEI updates to install CROSSROAD and SHINYROAD
Five- to ten-minute tampering windows in May and July 2026 exposed organizations in eleven countries without a CVE.
76
Google adds Android AI protections against scam calls, phishing and OTP theft
Enhanced Protection in Google Messages will use Gemini on unknown-sender chats and Gemini Nano to score unfamiliar links.
46
How Itaú is building generative AI for its entire customer base
Itaú uses OpenAI models in ia.i and IARA to deliver generative AI banking for about 70 million Brazilian customers.
44
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
78
Google Android Flags 5 Million Suspected Scam Calls and Texts Monthly
Google says Android now flags over five million suspected scam calls and texts monthly and is adding Gemini protections.
46
Teaching students to think and learn through questions
OpenAI launched a free Brazilian Portuguese AI for Educators course and promoted ChatGPT Study Mode for classroom learning.
24
Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
82
Manacá-1B-Instruct-2: Reproducible Safety Alignment for a Native Brazilian-Portuguese LLM. Negative DPO Results, a Controlled Composition Scan, and a Silent Failure Mode of the LLM Judge
Manacá-1B-Instruct-2 gained safety from iterated safety finetuning after three failed DPO runs, beating four Portuguese baselines.
51
Meta is meddling with Brazilian democracy
A Brazilian survey alleges Meta restricted or banned 1,088 mostly pro-Lula accounts during the election.
4
How a leaked builder of XWorm turned a remote access trojan into a surveillance kit
Netskope says leaked XWorm builders turned the RAT into a surveillance kit with live browser, mic, and location plugins.
76
Cerebras CEO pushes back on AI doomsday warnings
Cerebras CEO Andrew Feldman says AI leaders overemphasize doom and should stress benefits while regulating risks.
34
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site
Extortion group n0n listed 38 global ports, terminals, and shipping firms on its leak site.
76
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.
76
Low-cost Android phones are arriving with malware that owners can’t uninstall
Bitdefender found preinstalled Midnight Mimosa malware on budget Android phones that owners cannot uninstall.
74
Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
Midnight Mimosa, preinstalled Android firmware malware, monetizes thousands of phones in 150 countries through ad fraud and proxies.
74
Midnight Mimosa Infects Android Phones Before Users Even Turn Them On
Midnight Mimosa ships in low-cost Android firmware, silently running ad fraud and proxy modules before first boot.
76
Desertification Forecasting in Semi-Arid Regions: Using Deep Learning to Probe the Observability Limits of Land Degradation Dynamics
ConvLSTM forecasts regional desertification trends in Ceará but not cell-level land degradation.
22
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Bitdefender found Midnight Mimosa firmware malware preinstalled on budget Android phones in over 150 countries.
72
Low-cost Android phones ship with residential proxy malware
Midnight Mimosa malware preinstalled on cheap Android phones enables ad fraud and residential proxy abuse.
74
Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure
Hunt.io says BraZetsu access-broker infrastructure kept stable TLS and hosting patterns months before public IOCs.
60
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
A suspected Chinese operator used the ARTEX AI pentest tool to steal data from South Korean financial firms.
76
Related CVEs
by mentions- CVE-2026-68820<1%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-8467<1%9.5Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in…
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2019-18935100%9.8Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2023-3602588%8.8Windows SmartScreen Bypass (CVE-2023-36025) Exploited via Crafted Shortcut Files
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
- CVE-2022-09959%7.8Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation
- CVE-2021-3156100%7.8Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156)
Appears with
- Googlevendor · 19
- Microsoftvendor · 15
- Androidproduct · 13
- Google Threat Intelligence Grouporganization · 9
- Palo Alto Networksvendor · 8
- Bitdefenderorganization · 8
- Midnight Mimosamalware · 8
- MediaTekvendor · 7
- Mandiantorganization · 7
- Group-IBvendor · 7
- FBIorganization · 6
- Windowsproduct · 6
- UNC7017threat actor · 6
- AOMEI Backupperproduct · 6
- ManageEngineorganization · 5
- Check Pointvendor · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.