VLC and VMware binaries side-load malware targeting Brazil and Portugal
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
62
Country
Portugal
- Mentions · 7d2
- Mentions · 30d10
- All mentions22
- First seenAug 13, 2026
- Last mentioned4d ago
Timeline
22 articles · newest firstOverlord and Lampion campaigns hide malware with Windows tools
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
58
AOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
AOMEI Backupper updates briefly served malware in 2026
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
78
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
78
Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
ANSSI says the French supermarket refrigeration attack also hit Copeland and Dixell controllers, affecting about 700 stores.
84
Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
82
EU Grocers Pay a Steep Price for Unpatched Fridge Firmware
Hackers exploited unpatched Danfoss fridge controllers, spoiling food at more than 400 European grocery stores.
82
Fridge hack costing millions and sparking fires stemmed from poor security
Poorly secured supermarket refrigeration controllers were mass-hacked, causing fires and huge reported losses across Europe.
72
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
Warlock ransomware is hitting large Spanish and Portuguese organizations; the Chinese actor blends cybercrime and APT behavior.
66
Old-School Credit Card Scams Are Far From Dead
Mailed fake credit cards and magnetic-stripe skimmers, including SNAP EBT fraud, still steal victims' money.
46
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
ThreatsDay details the RemControl Android banking trojan, a ZCode source leak, and related phishing and ICS risks.
61
New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
73
RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials
RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.
76
Nscale’s IPO will test Wall Street’s appetite for concentrated AI bets once again
Nscale's planned NYSE IPO concentrates revenue on Microsoft and Anthropic compute contracts worth about $88 billion.
67
Trezor: 347,000 users targeted in phishing attacks after Brevo breach
Trezor reported phishing after the Brevo breach targeted 347,000 newsletter subscribers, with 2,500 users clicking before the domain was taken down.
65
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
76
Trezor warns users of email provider breach, phishing attacks
Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.
58
Trezor customers hit with phishing calls and letters after shipping-partner breach
A breach at shipping partner ShipMonk exposed data for about 67,000 additional US Trezor customers, who now face phishing calls and QR scam letters.
50
Trezor data breach impact now reaches 81,000 customers
Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.
70
BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
Group-IB details BraZetsu, a modular Python Windows malware that monetizes compromised-host access through the Infected Marketplace for initial access brokers.
45
Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal
Cloudflare traffic data shows clear dips in Iceland, Spain, and Portugal along the path of the August 12, 2026 total solar eclipse.
5
Related CVEs
by mentions- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2025-41451<1%8.7Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version…
- CVE-2025-41450<1%8.2Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
- CVE-2025-41452<1%6.8Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow…
Appears with
- ShinyRoadmalware · 4
- AOMEI Backupperproduct · 4
- Metabasevendor · 4
- Google Threat Intelligence Grouporganization · 4
- Mandiantorganization · 4
- CrossRoadmalware · 4
- UNC7017threat actor · 4
- Danfossvendor · 3
- Google Playproduct · 3
- Group-IBorganization · 3
- RemControlmalware · 3
- Androidproduct · 3
- ShipMonkvendor · 3
- ManageEngineorganization · 3
- ShinyHuntersthreat actor · 3
- AOMEI Technologyvendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.