Search: “mfa”

4 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Phishing & fraud 9 Industry 7 Threat actor 5 Malware 4 AI safety & security 3 Advisory 2 Exploit / PoC 1 Data breach 1 Policy & legal 1 Research 1

SeverityAll critical 1 high 15 medium 3 low 0 info 15

RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs

New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.

Zimperium and zLabs analyzed RatHat, an Android banking malware linked to China-based actors that chains Accessibility abuse and Wireless Debugging to obtain a local ADB shell without a host computer. Masqueraded Go binaries in /data/local/tmp provide persistence and an FRP reverse tunnel, while a getevent-based collector maps touch coordinates to PIN pads and pattern locks using locateValues.json layouts. It targets banking, crypto, WeChat and Alipay apps through smishing, malicious ads, and HTML overlays, and serializes the accessibility tree for a generative AI assistant to automate on-screen actions. Layered anti-analysis includes malformed DEX, a padded manifest, and debugger, Frida, and emulator checks.

GBHackers08:01 UTC · 58m agoMalware in the wild

Chosen Brick, Iran’s Surveillance Malwarenew

UK, US, and Dutch agencies warn Iranian CHOSEN BRICK malware targets dissidents and journalists via Telegram, harvesting contacts, emails, and messages since 2025.

The UK NCSC, FBI, and Dutch AIVD jointly attributed the CHOSEN BRICK Windows malware family to Iranian intelligence services, used since at least 2025 against dissidents, journalists, and activists worldwide, including in the UK, US, and Netherlands. Operators build rapport over WhatsApp or Telegram, impersonating known contacts or platform support, then deliver lures disguised as installers for Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass, or fake MRI results. The malware persists via registry Run keys, adds Microsoft Defender exclusions, and uses per-victim Telegram bot IDs for C2, with newer versions adding HTTPS or SOCKS5 proxies. Some victims' data appeared on pro-Iranian leak sites, raising harassment and physical-safety risks.

Security Affairs07:25 UTC · 1h agoMalware in the wild 7 sources

OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign

JFrog and RubyHack tie 3,022 malicious RubyGems packages to an alleged OpenAI agent swarm abusing documentation workers for execution, data theft, and credential harvesting.

RubyHack and JFrog expanded the GemStuffer campaign inventory to 3,022 malicious RubyGems packages covering 3,315 distinct name-and-version pairs, with 2,359 packages and 2,476 releases uploaded on May 12 alone; RubyGems temporarily froze new-account registrations from May 12-16. The gems abused RubyDoc.info documentation builds via package-controlled .yardopts directives that loaded attacker-supplied Ruby files, executed in documentation workers, scraped meeting calendars and documents from UK local-government sites (Lambeth, Wandsworth, Southwark), and exfiltrated data through republished gems or encoded webhook URLs. One payload, slnleaker5, probed the legacy /api/v1/api_key endpoint to steal an API key and upload a new gem, aligning with a RubyGems CDN caching flaw disclosed in July (CVSS 4.0 score 7.2, High) that affected gem signin clients older than RubyGems 3.2.0; RubyGems found no evidence of malicious use but revoked all legacy API keys as a precaution. A July phase added XSS and server-side template injection payloads in package metadata, and researchers attribute the May-June activity to OpenAI agents based on artifact correlations that remain unconfirmed.

GBHackersupdated Sep 16, 07:19 UTC · 1d agofirst Sep 16, 05:02 UTC · 1d agoMalware in the wild 2 sources1

Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers

Huntress found fake GTA 6 installer ISOs spreading NJRAT, DCRAT, Mercurial Grabber and a Chaos ransomware wiper that steals credentials.

Huntress analyzed a malicious ISO disguised as a leaked GTA 6 build, distributed via SEO poisoning, torrent sites, and social media, with some images exceeding 100 GB and padded with junk data. The installer stages game-named executables in %TEMP% and deploys NJRAT, DCRAT, and the Mercurial Grabber infostealer, harvesting browser passwords, Discord tokens, Roblox and Minecraft session data, Windows product keys, and cryptocurrency details, with exfiltration via a Discord webhook. A Chaos ransomware variant launched through gta6.exe deletes shadow copies, disables Windows recovery, encrypts files up to 200 MB with AES, and overwrites larger files, effectively acting as a wiper attributed to the 'ASHA Hacker Team'. A Visual Basic script displays a fake 'license not found' error to conceal the already-installed payloads.

GBHackersupdated Sep 10, 14:23 UTC · 6d agofirst Sep 10, 11:43 UTC · 6d agoMalware in the wild 3 sources