ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “WebRTC”

37 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 49Malware 37Exploit / PoC 30Data breach 13Ransomware 9Threat actor 4Policy & legal 3Phishing & fraud 2Industry 2Research 1Advisory 1AI safety & security 1
SeverityAllcritical 57high 34medium 53low 8info 0

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.

Ontinue's Cyber Defense Center identified TWINLOOT during a July 2026 campaign investigation: a modular, PyArmor-hardened Python implant (a 39 MB bootstrap-fat.pyc loader) whose entire C2 infrastructure lives inside trusted Microsoft services. Tasking flows through SharePoint Online file dead drops polled every 15 seconds via the Microsoft Graph API, while interactive operator access uses WebRTC DataChannels relayed by Microsoft Teams TURN servers; Graph traffic is driven by the victim's own headless Edge browser. The implant harvests Windows credentials with fake lock screens, offers a reverse SOCKS5 pivot for lateral movement to SMB, RDP, WinRM, and MSSQL, executes commands, and persists on hosts. Initial access is assessed to be Teams social engineering masquerading as IT support, prompting a PowerShell command to download the payload.

The Hacker News · 29d agoMalware

GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

Arctic Wolf links new Go-based GoCaracal malware with Ethereum smart-contract C2 fallback to Dark Caracal, targeting a Venezuelan communications organization.

Arctic Wolf assessed with medium confidence that a June 2026 intrusion at an unnamed Venezuelan communications organization used GoCaracal, a previously undocumented Go-based malware framework linked to Dark Caracal. The lightweight profile provides encrypted C2, interactive shell access, and shellcode injection; the extended profile adds browser data theft, keylogging, WebRTC remote desktop, and SOCKS5 proxying. When the primary C2 server is unreachable, the malware queries an Ethereum smart contract via eth_getStorageAt at public JSON-RPC endpoints to fetch a replacement C2 address. Bandook was deployed in parallel, and Arctic Wolf published a YARA rule and indicators of compromise.

The Hacker News · 20d agoMalware in the wild1

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

ThreatFabric identified Manic, an Android banking malware and spyware targeting Ukrainian and European financial apps with novel offline Wi-Fi mesh data exfiltration via nearby infected devices.

ThreatFabric reported a new Android malware family called Manic combining banking fraud and surveillance capabilities, targeting 169 package IDs across Ukrainian banks, government and identity services, messaging apps, and Russian and European financial institutions. The malware uses phishing sites and dropper apps impersonating utilities for distribution and relies on accessibility services and notification permissions for keylogging, overlays, and remote control. It introduces a store-and-forward relay mechanism that stages encrypted data locally and relays it through nearby infected devices via Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting up to four hops when the primary device lacks internet access. Activity dates back to February 2026, with active development through late July.

The Hacker News · 26d agoMalware in the wild

Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline

ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.

ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.

Security Affairs · 27d agoMalware in the wild