60
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs
New Android banking trojan RatHat abuses Wireless Debugging to gain shell access and steals banking PINs and OTPs via raw touch capture.
Zimperium and zLabs analyzed RatHat, an Android banking malware linked to China-based actors that chains Accessibility abuse and Wireless Debugging to obtain a local ADB shell without a host computer. Masqueraded Go binaries in /data/local/tmp provide persistence and an FRP reverse tunnel, while a getevent-based collector maps touch coordinates to PIN pads and pattern locks using locateValues.json layouts. It targets banking, crypto, WeChat and Alipay apps through smishing, malicious ads, and HTML overlays, and serializes the accessibility tree for a generative AI assistant to automate on-screen actions. Layered anti-analysis includes malformed DEX, a padded manifest, and debugger, Frida, and emulator checks.
72
60
60
60
60
60
60
60
Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning
Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.
Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.
70
60
60
60