TrendAI says SHADOW-EARTH-79 used ad bidding to track Starlink users
Researchers say the bidder led Starlink ad wins in 105 countries and bought 66,208 Starlink impressions, without confirming malicious code on every impression.
58
- Mentions · 7d1
- Mentions · 30d3
- All mentions17
- First seenAug 17, 2026
- Last mentioned2d ago
Timeline
17 articles · newest firstPryx and Devman claim a role in deadly Cairo telecom fire
Four workers died and 27 were injured at Ramses Central on July 7, 2025; a cyber cause is still only a claim.
70
When No ID Means No Internet
EFF argues age-verification laws requiring government ID block millions without documents from internet access and expression.
40
Americans Fear AI Will Make the World Worse, Love It Anyway
A Gallup study finds Americans fear AI will make the world worse, despite high global AI optimism and adoption.
15
From Enablement to Execution, Egypt’s AI Ecosystem Reaches Production Scale
NVIDIA highlighted Egypt’s AI builders as African data-center and AI-factory projects move toward production.
46
FBI, Coast Guard boarded hacked oil tankers heading towards US coast
FBI and Coast Guard boarded two US-bound oil tankers after hackers, possibly Iran-linked, compromised networks controlling navigation, propulsion, and cargo systems.
78
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
Gigabud Uses Android App Cloning to Evade Fraud Detection
Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.
52
Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs
Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.
55
Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
58
Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs
Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.
72
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
60
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware
Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.
74
Iranian Hackers Pose as Recruiters to Deliver Cross
Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.
55
Iranian cyber spies target aviation, fintech developers with new malware
Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.
75
Africa’s Cybersecurity Challenge Is Bigger Than Access to Technology
Rapid7 partners with distributor StarLink to expand managed security operations support across Middle East and Africa markets.
15
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
Appears with
- PollCatmalware · 5
- Mirage Kittenthreat actor · 5
- NodeRabbitmalware · 5
- GoldFactorythreat actor · 4
- Shelterproduct · 4
- Group-IBvendor · 4
- Kasperskyvendor · 4
- Gigabudmalware · 4
- Microsoftvendor · 4
- Vworkmalware · 3
- PollCatproduct · 3
- Vworkproduct · 3
- UNC1549threat actor · 3
- Visual Studio Codeproduct · 3
- Nimbus Manticorethreat actor · 3
- NodeRabbitproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.