Banking trojans infect 17,960 Android phones in India
Group-IB says seven families intercepted 7,611,443 SMS messages and stole cards, OTPs, and identity data.
74
Organization
Group-IB
- Mentions · 7d2
- Mentions · 30d25
- All mentions43
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
43 articles · newest firstCyberDakait malware hits 17,960 Indian banking Android devices
Operators intercepted 7,611,443 SMS messages and paired credential theft with XMRig mining on idle phones.
72
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
INTERPOL Serengeti III nets 1,462 arrests and $105 million
Agencies in 21 countries identified 65,929 victims and losses exceeding $385 million from June 29 to August 31.
54
k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
78
Interpol operation disrupts nearly 11,000 cybercrime networks in Africa
Serengeti III brought 1,462 arrests, identified 65,929 victims, and recovered more than $105 million.
56
INTERPOL Africa sweep arrests 1,462 and recovers over $105 million
Operation Serengeti III, from June 29 to August 31, linked networks to over $385 million in losses and 65,929 victims.
60
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
78
Fraudsters use open-banking links to test stolen cards, Group-IB says
Group-IB says a spend platform paid aggregator fees while attackers checked credentials and phished via its own notices.
58
Scammers use a fintech platform’s notifications to phish sellers
Group-IB says operators impersonated Poshmark, harvested cards and OTPs, and checked stolen bank logins.
48
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
86
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
Group-IB says KGB RAT, an NjRAT-based Windows trojan sold from $150 monthly, steals passwords, spies via webcam, and includes ransomware.
62
KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs
Group-IB analyzed KGB RAT, a malware-as-a-service trojan based on NjRAT that steals credentials and controls PCs.
50
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.
58
Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure
Hunt.io says BraZetsu access-broker infrastructure kept stable TLS and hosting patterns months before public IOCs.
60
ASOS Confirms Data Breach Linked to Stolen Employee Credentials
ASOS confirmed attackers used stolen employee credentials to access customer account data via third-party platforms.
60
Telegram Account Behind ASOS Rogue Notification Tied to Gaming Trading
ASOS says names and contact details may have been accessed after rogue customer notifications; broader hack claims remain unproven.
74
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Citrix NetScaler and Fortinet FortiMail zero-days are under active attack, alongside ransomware arrests and new threat activity.
88
Fake brand discounts on social media prey on shoppers’ fear of missing out
Group-IB details the Milk Dragon phishing kit using fake social-media discounts to steal payment cards and 3DS one-time passwords across 66 countries.
50
Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA
Group-IB says the Milk Dragon kit relays OTPs live to steal shoppers' card payments across 66 countries.
68
Police Target KillSec Ransomware Group with Arrests and Seizures
European police seized KillSec infrastructure and arrested suspects, including a 16-year-old alleged ringleader.
75
Milk Dragon Phishing Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA
Milk Dragon uses fake social-media discounts to steal cards and intercept 3-D Secure codes.
67
Police disrupt KillSec ransomware, arrest suspected teenage leader
Spanish police arrested KillSec's suspected 16-year-old leader and seized the ransomware gang's leak site, five servers, and infrastructure across Europe.
65
Police dismantle KillSec ransomware gang allegedly led by 16-year-old
International Operation KillSwitch seized KillSec's servers and leak site, arrested three suspects, and identified a 16-year-old as the ransomware gang's leader.
78
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader
Europol-led Operation KillSwitch dismantled KillSec ransomware, seizing its leak site and 110TB of stolen data; a 16-year-old alleged leader was identified.
72
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
74
RemControl Banking Trojan Gives Attackers Remote Control of Android Devices
RemControl, an Android banking trojan, remotely controls devices and steals credentials from customers of 30-plus banks.
74
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
ThreatsDay details the RemControl Android banking trojan, a ZCode source leak, and related phishing and ICS risks.
61
New Android Banking Trojan Uses AI-Built Overlays to Steal Users’ Banking PINs
RemControl, a new Android banking trojan, uses fake streaming-app downloads and overlays to steal banking PINs.
64
New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
73
RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials
RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.
76
New RemControl Android banking malware targets users in Europe and Canada
New RemControl Android banking MaaS steals credentials via 30+ phishing overlays targeting Europe, Canada, and the Middle East.
58
Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.
68
Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware
Group-IB links HEAVYGRAM, a Telegram-based Windows surveillance backdoor targeting Iranian dissidents and journalists since 2023, to the Handala Hack group with moderate confidence.
65
Smishing Triad Hackers Use JWR Phishing Kit to Steal Cards, OTPs and Bank Credentials
Group-IB attributes large-scale smishing using the JWR real-time phishing kit to the Smishing Triad's Outsider cluster, harvesting card data, OTPs, and bank credentials.
65
Android malware creates a hidden copy of your banking app
Group-IB found the Gigabud Android banking trojan clones banking apps into a hidden work profile to conduct fraud undetected.
45
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps
Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.
50
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
Gigabud Uses Android App Cloning to Evade Fraud Detection
Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.
52
ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On
Zimperium and IBM Trusteer report expanded ToxicPanda 2.0 and GoldDigger Android banking trojan campaigns now targeting 349 financial institutions across 16 countries.
70
Related CVEs
by mentions- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2025-6444691%9.8Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution
- CVE-2026-1042865%9.8Unauthenticated path traversal file write in Fortinet FortiMail
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2019-66937%6.5Hard-Coded Encryption Key in Fortinet FortiOS Configuration Backups
- CVE-2026-42542<1%7.5TDengine: In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single…
Appears with
- Googlevendor · 9
- Androidproduct · 9
- Microsoftvendor · 7
- RemControlmalware · 6
- Fortinetvendor · 6
- Group-IBvendor · 6
- Europolorganization · 5
- Google Playproduct · 5
- Team Cymruorganization · 5
- KillSecthreat actor · 5
- Palo Alto Networksvendor · 5
- GoldFactorythreat actor · 4
- Qilinthreat actor · 4
- FortiGateproduct · 4
- UNKKthreat actor · 4
- GlobalProtectproduct · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.