ADEX: 52% of 2026 ad-fraud schemes use AI as cloaking share falls
Across 1.2 million campaigns, iOS scripts and messenger phishing rose while cloaking’s share of suspensions fell to about 45%.
44
Product
Telegram
- Mentions · 7d5
- Mentions · 30d17
- All mentions43
- First seenAug 12, 2026
- Last mentioned1d ago
Timeline
43 articles · newest firstOffensiveCon Japan agenda covers Chrome, Telegram and iOS research
October 27–28 session titles name Skia, Telegram stickers and Muse Spark, but list no CVEs, versions or confirmed attacks.
28
Fake Android apps push ZloyRAT at Russians amid fuel and drone fears
F6 says three apps, including a police-and-fuel map, steal banking data; download counts and losses were not disclosed.
58
Rentable Android spyware uCreater targets WeChat, Telegram and wallets
YingGai hooks sideloaded apps to steal chats, OTPs and wallet data and can spoof camera checks.
68
uCreator Android spyware steals Telegram 2FA and clones WeChat
The rentable kit hides in sideloaded Telegram and WeChat copies; its code and C2 match Doctor Web’s Baohuo.
68
India SIM-binding rules may block WhatsApp without a registered SIM
Covered apps have until December 31, 2026, with the requirement expected to take effect on January 1, 2027.
46
India to require WhatsApp and Telegram accounts to stay tied to active SIMs
DoT’s deadline is December 31, 2026; how far accounts stop working depends on each app’s implementation.
48
Here’s What Telegram Giving Data to the U.S. Government Looks Like
Court records show Telegram gave U.S. investigators a user's phone number, ID, and IP address.
48
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Kazakhstan-linked Silent Lynx spies on Russia's Orsk refinery and regional governments using spear-phishing and lightweight malware.
76
ZDI-26-757: (0Day) Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability
ZDI discloses a user-interaction Telegram rlottie RCE tracked as CVE-2026-111105.
58
Learning to use local AI is exciting, overwhelming, and frustrating
Verge tester runs 125B Qwen locally via Hermes Agent on a 256GB Mac Studio.
18
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer now bypasses Chromium app-bound encryption, runs remote commands, and exfiltrates data over encrypted TCP.
56
Leaked chats show Russian extortion gang sending ‘agents’ into US law firms
Leaked chats show Silent Ransom Group recruiting U.S. operatives to physically infiltrate law firms and extort them.
79
The Man Behind a West Bank Telegram Channel Trying to Keep Palestinian Drivers Safe
A West Bank Telegram channel with nearly 350,000 followers warns Palestinian drivers about Israeli checkpoints.
4
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Eight malicious npm packages, downloaded 40,767 times, installed Overlord RAT and a Node.js stealer.
73
Pump-and-Dump meets Honeypot Tokens: Detection and Analysis of Telegram Bait-and-Trap Schemes
Analysis of 3,677 Telegram events shows DEX bait-and-trap honeypots earned organizers over $7 million.
62
Milk Dragon AiTM Kit Uses Real-Time OTP Relay and WebSocket Keylogging to Bypass MFA
Group-IB says the Milk Dragon kit relays OTPs live to steal shoppers' card payments across 66 countries.
68
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
Carbonato installs Hermes Agent on hacked Docker hosts to run Telegram commands and steal AI API keys.
64
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
74
Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers
CARBONATO infects exposed Docker hosts, persists, spreads to nearby daemons, and runs a Telegram-controlled AI agent.
74
TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace
TWEAKOS steals Discord tokens and Telegram sessions, then sells that access through a Telegram bot.
48
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
ThreatsDay details the RemControl Android banking trojan, a ZCode source leak, and related phishing and ICS risks.
61
New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
73
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
CTM360 says ClickFix, now the top enterprise initial-access method, hides lure hosts on Polygon and delivers info-stealers.
80
A Bulletproof Business? Towards Detecting Infrastructure-as-a-Service Offerings on Telegram
Researchers detect cybercrime infrastructure-as-a-service ads across more than one million Telegram messages.
52
Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords
Hackers are using a Microsoft-signed driver to disable 145 security tools and steal passwords via fake LastPass download pages on GitHub.
78
New Remus Infostealer Steals OpenAI and Anthropic API Tokens, Passwords and Crypto Wallets
SpyCloud Labs details Remus, a Windows infostealer harvesting AI platform API tokens, passwords, 2FA artifacts, and crypto wallets.
68
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
Jade Sleet breached an Indian IT provider with macOS backdoors FLATROOF and ROOFDECK.
76
North Korean IT Workers Pay People to Sit Through Job Interviews While They Control the Computer
Silent Push found North Korean IT workers recruiting on-camera proxies for job interviews while remotely controlling the computer, defeating identity and location checks.
60
Chosen Brick, Iran’s Surveillance Malware
UK, US, and Dutch agencies warn Iranian CHOSEN BRICK malware targets dissidents and journalists via Telegram, harvesting contacts, emails, and messages since 2025.
70
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.
78
US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
US, UK, and Dutch agencies warn Iranian state actors deploy Windows surveillance malware 'Chosen Brick' against dissidents, activists, and journalists worldwide.
60
Atomic macOS (AMOS) Stealer Activity
Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.
45
Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists
UK NCSC, FBI and Dutch AIVD warn Iranian state hackers deploy CHOSEN BRICK spyware via WhatsApp and Telegram lures against dissidents and journalists since 2025.
78
NCSC and Allies Warn of Iranian Spyware Campaign
NCSC, FBI and AIVD warn Iranian-backed actors deliver Chosen Brick spyware to regime critics via social engineering; stolen data has surfaced on pro-Iranian leak sites.
76
Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results
NCSC, FBI, and AIVD warn Iranian state-linked actors deliver CHOSEN BRICK Windows spyware via fake AI apps, antivirus installers, and MRI-result lures.
72
Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023
FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.
66
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
55
Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline
Rapid7 exposed infrastructure behind a cryptocurrency fraud pipeline using phishing panels, voice-dialing scripts, fake wallets, and AI coding assistants.
52
AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
Jamf details AmnesiaStealer, a new Rust-based macOS infostealer that hijacks Chromium sessions for live attacker-controlled browser access and steals Keychain data.
58
Related CVEs
by mentions- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
- CVE-2020-9771<1%7.1This issue was addressed with a new entitlement
- Numeric truncation RCE in Telegram rlottie
Appears with
- WhatsAppproduct · 7
- FBIorganization · 7
- Microsoftvendor · 7
- Googlevendor · 6
- Chosen Brickmalware · 6
- Discordproduct · 6
- Microsoft Defenderproduct · 6
- NCSCorganization · 5
- Steamproduct · 4
- Hermes Agentproduct · 4
- AIVDorganization · 4
- Chromeproduct · 3
- Carbonatomalware · 3
- Microsoftorganization · 3
- Dockerproduct · 3
- WordPressproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.