ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories
Weekly ThreatsDay bulletin details a ShinyHunters-style social engineering hit on ReliaQuest, the 296,000-device Dysphoria IoT botnet, and several new malware families.
ReliaQuest confirmed a social engineering attack on August 22, 2026, in which an attacker used a fake SSO page and MFA push approval to gain brief view-only access to an identity dashboard, with tactics matching ShinyHunters, which has since listed the firm on its leak portal. The Shadowserver Foundation reported the Dysphoria botnet has compromised nearly 296,000 IoT devices for DDoS attacks and recently added residential proxy capability. Cisco Talos documented JWR, an operator-driven phishing-as-a-service framework linked to The Outsider that harvests credentials, identity documents, and 2FA codes over an encrypted WebSocket. New malware coverage includes the Octagon Android fraud bot ($1,400/month), the C2Looper Rust backdoor delivered via ClickFix, and the Aeternum loader that moved C2 to the Polygon blockchain.
- ReliaQuest employee approved a rogue MFA push after a fake SSO page; access was view-only with no customer data affected.
- Dysphoria botnet controls ~296,000 IoT devices for DDoS and recently added residential proxy functionality.
- JWR phishing framework, a likely The Outsider PhaaS variant, uses live operator steering via encrypted WebSocket to harvest identities and 2FA codes.
- Octagon Android on-device fraud bot sold as MaaS targets crypto wallets and banking apps for $1,400 monthly.
- C2Looper Rust backdoor arrives via multi-stage ClickFix chains; one variant uses GitHub for command-and-control.
- ATT&CK
- T1566.004 Spearphishing VoiceT1621 Multi-Factor Authentication Request GenerationT1078 Valid AccountsT1498 Network Denial of Service
- Threat actors
- ShinyHuntersAndroidKitKat
- Victims
- ReliaQuest
- Organizations
- ReliaQuest
From the original article
13 min read at thehackernews.com
A fake login page. A fake security scan. A fake productivity app.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.