42
42
42
47
42
42
57
Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
Unisoc modem firmware flaw CWE-1189 allows VoLTE video call RCE chain to gain full Android kernel access on T606/T612/T7250 chipsets; no patch yet.
SSD Secure Disclosure published the second stage of an exploit chain, first disclosed in March 2026, that achieves full Android kernel access on Unisoc modem firmware via a VoLTE video call. The privilege-escalation flaw, classified as CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip), exploits shared physical memory between modem and application processor with no hardware boundary, letting modem code map the entire 32-bit address space and modify Android kernel pages via ARM Memory Protection Unit registers. Confirmed affected chipsets include Unisoc T606 (Motorola E13), T612 (Realme C33), and T7250 (Xiaomi Redmi A5), sold across more than 140 countries. No CVE has been assigned, the August 2026 Android Security Bulletin does not address it, and Unisoc has not responded to researchers; exploitation requires an attacker-controlled private 4G network and a victim answering the call.
75
42
How hackers used Claude for missiles, drone swarms, and surveillance, while Chinese labs mined it for training data
Anthropic's threat report details eight months of Claude misuse: AI-assisted espionage against 20+ organizations, self-rewriting malware, and Chinese labs distilling Claude via fraudulent accounts.
Anthropic's threat intelligence report covering December 2025 through August 2026 documents Claude misuse across seven categories including cyber operations, surveillance, fraud, and unauthorized model distillation. A Russian-speaking espionage actor tracked as GTG-20006 used AI agents to rewrite and recompile malware evading antivirus detection, targeting more than 20 organizations in Ukraine and Europe and stealing a drone vision system SDK. Alibaba's Qwen lab ran the largest distillation campaign, with over 151 million exchanges between May and July 2026 peaking near 3 million per day to train Qwen 3.5, 3.6, and 3.7. DeepSeek, Moonshot AI, Xiaomi, and Zhipu also relayed customer or replayed traffic to Claude, including PLA-linked users analyzing CCTV footage and users with credentials tied to the Russian Ministry of Defense.
80
42
57
42
42
42
42
42
AI lets small actors run state-level hacking campaigns, Anthropic report finds
Anthropic's threat report finds AI let a Russian-aligned espionage campaign, a Chinese student-run exploit foundry and ShinyHunters operators run state-grade operations.
Anthropic's report covering December 2025 to August 2026 details a Russian-aligned espionage campaign by actor 'JackPoterz' — matching Midnight Blizzard behaviors — against more than 20 government and defense organizations across Ukraine and Europe, with AI agents autonomously rebuilding Windows implants to evade detections. Chinese undergraduates ran an automated vulnerability-research foundry using Claude agent swarms, yielding more than a dozen potential zero-days in one month. ShinyHunters-affiliated operators used AI to dump over 2,100 Azure access tokens across 40 corporate tenants in 34 hours. Seven Chinese labs including Alibaba, DeepSeek, Moonshot AI, Xiaomi and Zhipu distilled Claude outputs; Alibaba peaked at nearly 3 million exchanges per day from more than 3,500 fraudulent accounts to train its Qwen systems.
80
ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.
Zimperium's zLabs documented ToxicPanda 2.0, an Android banking trojan expanding from 16 targeted apps to 349 financial institutions across 16 countries, with 167 remote commands. It poses as a dropper, abuses VPN permissions to block Google Play Protect while installing a hidden payload, then uses the Accessibility Service for screen monitoring and overlay-based credential theft. It automates enabling Android Wireless Debugging and completes the pairing handshake to gain ADB shell access for privilege escalation, and overlays fake lock screens to steal device PINs. Previously unfinished commands are now operational and samples are served from AWS-hosted storage buckets.
65
42
42
42
42
42
57
42
42
42
42
42
42
42
42
42
47
42
42
42
42
47