60
60
60
60
New Android malware relays bank cards to fraudsters while victims still hold them
Group-IB discovered WindRelay Android malware that streams NFC card data in real time, paired with SpyNote RAT, targeting Czechia, Slovakia, and Slovenia.
Group-IB identified WindRelay, an Android malware that uses NFC to communicate with victims' payment cards and relays the exchange live to attacker-controlled terminals. Fraudsters impersonate bank staff by phone, trick victims into installing a personalized SpyNote RAT, then silently deploy WindRelay to cash out using the victim-entered PIN. Researchers traced 23 samples on VirusTotal from November 2025 to July 2026, four C2 IPs, and campaigns against Czechia, Slovakia, and Slovenia. No affected apps were found on Google Play, and Google Play Protect detects known versions.
65
60
Persistent backdoors injected on Adobe Commerce via new CosmicSting attack
60
60
60
60
60
60
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
60
60
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Elastic Security Labs details KREMLIN, Brazilian banking malware using malicious Chrome/Edge extensions and Ethereum smart contracts to steal credentials and session tokens.
Elastic Security Labs documents KREMLIN (tracked as REF9334), a Brazilian banking malware toolkit active since at least May 2025 that impersonates a dozen Brazilian banks. It uses multi-stage JavaScript loaders, a C++ installer that DLL-sideloads via a legitimate SentinelOne binary, and a malicious Chrome/Edge extension named 'AVSync System Inc.' Ethereum smart contracts act as dead-drop resolvers for C2 endpoints, a shift that occurred May 19, 2026, making infrastructure hard to disrupt. The extension harvests cookies, sessionStorage/localStorage, browsing history, screenshots, and full page HTML via WebSocket plus CSS-disguised polling endpoints. The group has run seven distinct campaigns and also distributes Pulsar RAT and Remcos RAT.
65
60
60
60
60