INJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup
A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.
64
- Mentions · 7d4
- Mentions · 30d9
- All mentions12
- First seenAug 17, 2026
- Last mentioned2d ago
Timeline
12 articles · newest firstCyberDakait malware hits 17,960 Indian banking Android devices
Operators intercepted 7,611,443 SMS messages and paired credential theft with XMRig mining on idle phones.
72
INJ3CTOR3 FreePBX implant now steals SIP trunk and admin credentials
Cleaning the host no longer ends exposure: stolen trunk secrets let the operator place calls from anywhere.
66
Storm-1865 used ClickFix and Booking.com lures against hotels
Fake CAPTCHA pages pushed mshta commands that installed stealers and RATs; Booking.com says its own systems were not breached.
36
Cyble finds live secrets in browser code of 35 AI-built sites
Of 22,306 AI-built sites among 1.3 million new domains, 35 exposed server-only credentials including OpenAI, Stripe, and database tokens.
48
New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs
GhostBat Android malware steals UPI PINs from 60 Indian banking apps using accessibility overlays and transparent keypads.
64
Hackers Target 60 Indian Banking and UPI Apps With New GhostBat Android Malware
GhostBat Android malware targets 60 Indian banking and UPI apps, capturing PINs via Accessibility overlays.
72
The GhostX Ecosystem: Forged in Transit, Licensed to Deceive
GhostBat RAT, part of the GhostX ecosystem, steals banking PINs from Android users in India via smishing and overlays.
74
The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws
Cyble sensors logged exploitation attempts against about 20 flaws as CISA issued 14 ICS advisories.
68
Attack Surface Management in 2026: Why Point-in-Time Scans Can’t Keep Up With Cloud Sprawl
Cyble's marketing piece argues point-in-time attack surface scans leave cloud assets exposed for months and promotes its continuous Odin ASM product.
14
Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions
Nation-state actors abuse SS7, BGP, and unpatched telecom routers, including Salt Typhoon persistence via GRE tunnels.
60
Brand Impersonation Takedown: From Whack-a-Mole to Managed Response
Mandiant-tracked group UNC3753 impersonated US professional services firms' brands in 2026; Cyble urges managed takedowns over manual abuse reports.
50
Related CVEs
by mentions- CVE-2024-3400100%10.0Unauthenticated Root Command Injection in Palo Alto Networks PAN-OS GlobalProtect
- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2018-10562100%9.8Unauthenticated RCE in Dasan GPON Routers (CVE-2018-10562)
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2017-0147100%7.5Information Disclosure in Microsoft Windows SMBv1 Server (CVE-2017-0147)
- CVE-2020-1189918%5.4Out-of-Bounds Read in Treck TCP/IP Stack (IPv6) Affecting Dell Wyse Thin Clients
- CVE-2019-1226023%9.8Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4)
- CVE-2019-1225575%9.8Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4)
- CVE-2024-759144%7.2Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects
- CVE-2025-465651%6.0Vite: 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be…
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.