Cybersecurity and Infrastructure Security Agency (Organization): news timeline & CVEs

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories

ThreatsDay details the RemControl Android banking trojan, a ZCode source leak, and related phishing and ICS risks.

Group-IB described RemControl, an Android banking trojan first seen in July 2026, targeting retail customers in Italy, France, Spain, Poland, Portugal, the Middle East, and Canada through fake TVTap Google Play pages promoted in Meta ads. It abuses Accessibility Service for phishing overlays, live screen streaming, keylogging, and remote control, and resolves command-and-control through an encrypted Telegram dead-drop; Russian-language comments and a possible link to the Medusa UNKN affiliate botnet were noted. Separately, Z.ai disabled ZCode features that uploaded local code repositories to Alibaba Cloud by default, and FBI and CISA warned critical-infrastructure operators about broad access for third-party ICS integrators. The bulletin also describes surveillance features in Russia's MAX super-app and a fake Claude Max giveaway that steals Google credentials with a browser-in-the-browser login.

The Hacker NewsSep 24, 17:52 UTC · 2d agoMalware in the wild

How tax policy can stop threat actors from breaching US water systems

State-backed threat actors are actively breaching US water systems and industrial infrastructure, with a 2024 incident causing water tank overflow in Texas.

State-backed threat actors are actively breaching US water systems and industrial infrastructure, including Siemens S7 PLCs, with a 2024 incident causing water tank overflow in Texas.

CyberScoopSep 24, 10:00 UTC · 3d agoData breach in the wild

No evidence of successful foreign meddling in 2024 election, spy agencies found

U.S. spy agencies found no successful foreign interference in the 2024 election, though Russia, China, and Iran ran influence campaigns.

U.S. intelligence officials found no evidence that any foreign adversary successfully interfered in the 2024 presidential election, sources said of a classified assessment finished last year. Russia, Iran, and China each ran influence campaigns; Moscow’s was the largest and sought to boost Donald Trump while undercutting Kamala Harris. The conclusions match earlier reviews that foreign actors preferred influence operations to hacking election systems or changing votes. Officials still see probing of electoral systems before the midterms but no effort to tamper with vote counting, and a public version of the assessment is expected soon.

The RecordSep 23, 19:30 UTC · 3d agoThreat actor

A bold new strategy or a dangerous precedent? Experts are divided on Trump's memo.

Trump presidential memorandum authorizes private-sector companies to conduct federally supervised hacking operations against transnational criminal organizations.

A newly signed presidential memorandum enlists private companies in federal law enforcement hacking operations aimed at transnational criminal organizations, with a 60-day window to establish the program. Experts told CyberScoop the shift raises attribution, targeting and constitutional questions, including risks of private firms accidentally attacking foreign governments and procedures for prior approval before targeting US persons. Critics likened the approach to historical letters of marque, while supporters including NSC cyber policy director Amanda Naylor framed it as bringing private-sector speed to the fight against cybercrime and fraud.

CyberScoopAug 13, 22:19 UTC · Aug 13, 2026Policy & legal

Cybersecurity and Infrastructure Security Agency

Timeline4 articles

Appears with

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories

How tax policy can stop threat actors from breaching US water systems

No evidence of successful foreign meddling in 2024 election, spy agencies found

A bold new strategy or a dangerous precedent? Experts are divided on Trump's memo.