57
42
RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINsnew
New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.
Zimperium and zLabs analyzed RatHat, an Android banking malware linked to China-based actors that chains Accessibility abuse and Wireless Debugging to obtain a local ADB shell without a host computer. Masqueraded Go binaries in /data/local/tmp provide persistence and an FRP reverse tunnel, while a getevent-based collector maps touch coordinates to PIN pads and pattern locks using locateValues.json layouts. It targets banking, crypto, WeChat and Alipay apps through smishing, malicious ads, and HTML overlays, and serializes the accessibility tree for a generative AI assistant to automate on-screen actions. Layered anti-analysis includes malformed DEX, a padded manifest, and debugger, Frida, and emulator checks.
72
57
42
42
47
42
42
42
Lazarus hackers pair fake job offers with Windows zero-day exploit
Lazarus' Operation Dream Job targets the defense sector with fake job offers, a Windows LPE zero-day (CVE-2026-68820), and new Troy and RelayShell backdoors.
Check Point documented two parallel infection chains in Lazarus' Operation Dream Job: a digitally signed PDF viewer with DLL sideloading delivering the MISTPEN in-memory downloader, and a trojanized SecurityPDF viewer, distributed via fake Enveil websites, installing the newly documented Troy backdoor. A component exploits CVE-2026-68820, a local privilege escalation zero-day in the Windows AFD.sys driver used since at least early July, which Microsoft patched on August 11, 2026, enabling deployment of the FudModule kernel-mode rootkit. Lazarus also compromised Roundcube webmail servers vulnerable to CVE-2025-49113 to deploy the RelayShell PHP web shell and relay C2 traffic, targeting defense-sector organizations primarily in Western Europe and India. Separately, CERT-UA documented Sandworm's UAC-0145 using fake job offers against IT professionals since May 2026.
82
Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest
Huntress and the FBI recount a five-year manhunt for Silk Typhoon, from 88,000 Exchange backdoors to an arrest.
Huntress and the FBI pursued Silk Typhoon for five years after the group left roughly 88,000 backdoors on compromised Microsoft Exchange servers. The campaign culminated in an arrest, with handcuffs closing the global manhunt. Huntress frames the case as part of a wider ongoing fight against cybercrime.
75
57
57
57
60
60
57
42
57
47
47
57
42
57
47
Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter
Joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs shows nation-state and criminal groups independently converge on the same edge infrastructure.
Tenable and SentinelOne jointly analyzed 93 CVE-actor attribution pairs covering exploitation of perimeter devices. The data shows state-sponsored and financially motivated actors independently target the same edge products from Ivanti, Fortinet, and Palo Alto Networks. The findings challenge the narrative that edge exploitation is exclusively a China-nexus nation-state problem, showing a broader shared attack surface.
62
47
42
57
57
57
42
42
57
60
57
57
47
57