Trezor warns of suspected theft implant in a Safe 5 wallet
An Indonesian buyer found an extra cellular board in a CryptoBilis Safe 5; Trezor has not examined it.
72
Country
Indonesia
- Mentions · 7d14
- Mentions · 30d27
- All mentions56
- First seenAug 13, 2026
- Last mentioned12h ago
Timeline
56 articles · newest firstCoruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
84
Trezor warns of suspected Safe 5 implant sold via CryptoBilis
Trezor has not verified the device, and no CryptoBilis customer has reported lost funds to it.
68
Trezor warns of suspected implant in Safe 5 sold by CryptoBilis
Trezor has not lab-tested the device but tells CryptoBilis buyers since March 2026 to move funds to a new recovery phrase.
74
Trezor warns of suspected implant in CryptoBilis wallet
One Indonesian Safe 5 buyer reported an extra board; Trezor has not lab-tested it and knows of no stolen funds.
64
Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026
Attacks rose 208% year over year, but 98% stayed under 1 Gbps and most ended within ten minutes.
58
Meta launches Style Sketch AI fashion app in three countries
The iOS and Android app builds a closet from Instagram photos and offers virtual try-ons and trip plans.
32
Cloudflare blocked over 8,200 network DDoS attacks an hour in Q3
Most attacks lasted under ten minutes and stayed below 1 Gbps, while terabit-scale floods fell nearly 69% from the prior quarter.
58
Cloudflare: short DDoS bursts rose 208% in Q3 2026
Attacks over 1 Tbps fell to 251 from 805 after takedowns of four large IoT botnets.
46
Google to allow one-tap installs from approved Android stores outside the US
Approved stores get the feature on December 1 for Android 17 QPR2 or later after ongoing malware scans.
52
Meta quietly launches Waddle World, an AI pet journal app
The free adult-only app is listed in the Philippines; Meta also launched Style Sketch in parts of Southeast Asia.
28
Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
75
uCreator Android spyware steals Telegram 2FA and clones WeChat
The rentable kit hides in sideloaded Telegram and WeChat copies; its code and C2 match Doctor Web’s Baohuo.
68
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
Hirudo Android trojan swaps real banking apps for hooked copies
ThreatFabric says replacements are ready for eight Indonesian bank apps and that August 2026 backend data held thousands of credential entries.
68
Hirudo Android RAT swaps banking apps using fake updates
ThreatFabric says lure apps drop Hirudo, which can uninstall genuine Indonesian bank apps and install modified copies that spoof integrity checks.
68
Four groups bypass AI guardrails and compromise targets, CrowdStrike says
A Spanish- and English-speaking actor compromised at least 15 Argentine health care organizations.
74
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
ThreatFabric details Hirudo, an Android banking RAT that swaps Indonesian bank apps for trojanized copies.
64
Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Hirudo uninstalls real Android banking apps and installs patched copies to steal credentials and bypass security checks.
74
More Than Three Quarters of Small Business Owners Say AI Makes Them More Productive, But Most Need More Guidance
Meta-commissioned YouGov survey finds 84% of APAC small businesses use AI, but most want guidance.
18
Ledger asks sellers across Asia to halt sales after supply-chain attack
Ledger halted Asia and Hong Kong reseller sales after tampered wallets stole seed phrases over LTE.
78
Hirudo Android malware replaces banking apps to evade security checks
Hirudo Android malware replaces banking apps with hooked copies that steal credentials and bypass integrity checks.
72
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Hirudo Android trojan replaces Indonesian banking apps with patched copies to steal credentials and control devices.
74
Who Is Planting Backdoors in Ledger Crypto Wallets?
Hardware implants in Ledger wallets sold by authorized resellers enabled theft of about $102 million.
80
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site
Extortion group n0n listed 38 global ports, terminals, and shipping firms on its leak site.
76
Ledger Confirms Unauthorized Hardware Implant in Crypto Wallet Sold by CryptoBilis
Ledger confirmed an unauthorized hardware implant in a CryptoBilis-sold wallet linked to cryptocurrency theft.
70
Why Telecom Operators Are Building Their AI Strategy on Open Models
NVIDIA says telecom operators favor open models and released a 30B Nemotron 3 telco model.
44
Meta Names Dhruv Vohra to Lead Southeast Asia Business
Meta named Dhruv Vohra managing director of its Southeast Asia global business group.
18
Meta Partners With Government Agencies, Law Enforcement, and Safety Organizations to Launch Regional Anti-Scam Education Campaign
Meta's One Step Ahead anti-scam campaign reached 303 million people across 18 Asia-Pacific countries.
32
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Threat actors actively exploit critical WordPress CVE-2026-87902 (RCE) shortly after its disclosure, with confirmed exploitation attempts.
90
ChatGPT Ads expands to Southeast Asia and Taiwan
OpenAI is rolling out ChatGPT Ads across Southeast Asia and Taiwan after a $1 billion run rate.
44
Grab and OpenAI bring practical AI skills to Southeast Asia
OpenAI and Grab partner to train 30,000 Southeast Asian gig workers in practical AI skills over two years.
40
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
Unauthenticated RCE CVE-2026-58138 in Orkes Conductor is actively exploited; Fortinet blocked ~7,000 attacks; patch to 3.30.2.
82
“Zero-Code Cloaking”: Attackers Weaponize Google Search and Hacked .ac.th Domain to Bypass Ad Moderation
Attackers chain Google search results, a hacked Thai .ac.th domain, and redirects to push illegal casino ads past moderation, at industrialized scale across gov/edu sites.
45
Hacked Thai College Website Abused to Redirect Google Searchers to Illegal Online Casino
ADEX uncovered a hacked Thai college domain serving casino pages through real Google search redirects, part of a global campaign compromising government and education sites.
40
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
Proofpoint reports multiple espionage groups rapidly adopting BlueMoon, a new exploit kit chaining Chrome and Windows zero-days.
88
New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims
Zimperium uncovered Mantax Otax, an Android ransomware that encrypts files, records screens, steals OTPs, and secretly photographs victims.
45
Mantax OTAX Android Ransomware Spies on Users, Steals OTPs and Encrypts Files
New Android malware family Mantax OTAX combines ransomware, spyware, and OTP theft via sideloaded APKs, linked to Indonesian threat actors.
46
Indonesia Hit by Android Banking App-Cloning Campaign
GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.
45
New Android malware encrypts files, steals data, and harasses victims
Zimperium details Mantax Otax, an Android malware combining ransomware, spyware, and harassment, spread via phishing APKs to Indonesian users.
48
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2022-485033%8.8Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari
- CVE-2026-8790296%8.1Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2)
- CVE-2026-581389%9.3Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS…
- CVE-2026-672769%9.2SSH RSA Authorized-Key Bypass in MikroTik RouterOS 7.x
Appears with
- Googlevendor · 17
- Androidproduct · 12
- UNK_LateNightthreat actor · 7
- CryptoBilisorganization · 7
- UNK_DoubleCheckthreat actor · 7
- UNK_QuietRacketthreat actor · 7
- Hirudomalware · 6
- Trezorvendor · 6
- ThreatFabricorganization · 6
- Gigabudmalware · 6
- APT31threat actor · 6
- GoldFactorythreat actor · 6
- TA412threat actor · 5
- Violet Typhoonthreat actor · 5
- Microsoftvendor · 5
- Metavendor · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.