Product

Google Play Protect

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 22, 2026 · last 23d ago

Timeline2 articles

Google researchers uncover criminal zero-day exploit likely built with AI

Google links a likely LLM-built criminal zero-day for an open-source admin tool to planned mass exploitation and maps AI-assisted threats.

Google Threat Intelligence Group linked a zero-day exploit for a popular open-source web-based administration tool, enabling 2FA bypass with valid credentials via a semantic logic error, to a criminal group, citing educational docstrings, a hallucinated CVSS score, and textbook Python as signs of LLM authorship; the vendor was notified before a planned mass exploitation campaign. The report also details Russia-nexus malware families CANFAIL and LONGSTREAM using AI-generated decoy code, the PROMPTSPY Android backdoor driving the UI through the Gemini API, APT27 using Gemini to build relay tooling, and the TeamPCP (UNC6780) supply chain compromise of LiteLLM and Trivy repositories that planted the SANDCLOCK credential stealer.

Help Net SecurityAug 24, 04:21 UTC · 23d agoThreat actor

ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries

Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.

Zimperium's zLabs documented ToxicPanda 2.0, an Android banking trojan expanding from 16 targeted apps to 349 financial institutions across 16 countries, with 167 remote commands. It poses as a dropper, abuses VPN permissions to block Google Play Protect while installing a hidden payload, then uses the Accessibility Service for screen monitoring and overlay-based credential theft. It automates enabling Android Wireless Debugging and completes the pairing handshake to gain ADB shell access for privilege escalation, and overlays fake lock screens to steal device PINs. Previously unfinished commands are now operational and samples are served from AWS-hosted storage buckets.

Security AffairsAug 22, 16:50 UTC · 24d agoMalware in the wild

Appears with

threat actor APT27 1 threat actor TeamPCP 1 threat actor UNC6780 1 malware CANFAIL 1 malware LONGSTREAM 1 malware PROMPTSPY 1 malware SANDCLOCK 1 malware ToxicPanda 1 ai model Gemini 1 organization Cleafy 1 organization Google Threat Intelligence Group 1 organization Zimperium 1 organization zLabs 1 product Gemini 1 product LiteLLM 1 product Trivy 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.