ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “routing”

219 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 719Malware 602Ransomware 589Industry 434Policy & legal 431Threat actor 419Exploit / PoC 305Data breach 285Phishing & fraud 252AI safety & security 99AI tools & infra 95Research 73AI research 58AI industry 48
SeverityAllcritical 1521high 1058medium 783low 817info 353

737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One

Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.

Socket and researcher Kush Pandya identified 737 Chrome VPN and proxy extensions, published across at least 40 developer accounts with 75,486 installs, that route entire browser sessions through one provider's SOCKS5 proxies on port 1082. Of these, 274 impersonate 66 established brands including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare 1.1.1.1. The proxy bypass list only excludes loopback addresses, exposing visited destinations, source IPs, TLS SNI values, and plain-HTTP request bodies to the operator. 221 extensions have been removed from the Chrome Web Store while 516 remain listed as active.

The Hacker News · Aug 12, 2026Malware

Free streaming boxes may be routing criminal traffic through your home

Researchers found SuperBox streaming boxes and the CyberFlix TV app enroll home connections into the Popanet residential proxy network, routing criminal traffic.

Researchers found that SuperBox devices and the CyberFlix TV app, distributed through SuperBox's custom app store, contain Popanet proxy functionality that registers the device with servers controlled by the proxy operator, enrolling household connections into residential proxy networks. The reported configuration weakens Android safeguards with exposed ADB access, root-level privileges without authentication, and removal of app-install protections. Plume's research warns these proxy networks can also function as malware-delivery platforms, and the FBI notes foreign entities use residential proxies to conceal activity such as credential stuffing and account abuse. Malwarebytes advises disconnecting and replacing affected SuperBox/CyberFlix devices rather than factory-resetting them.

Malwarebytes Labs · 12d agoMalware in the wild

Hackers infecting Android car systems to build proxy botnet

Kaspersky reports MoYu Group-linked malware infecting DoFun Android car head units, enrolling them in a BadBox-linked proxy botnet for ad fraud and traffic routing.

Kaspersky discovered malware on Android-based head units made by Chinese automotive supplier DoFun, the first documented case of a car head unit being infected through an attack purpose-built for such devices. Attackers abused TWCore, a legitimate DoFun system application that handles updates and can install new apps, to silently push a malicious app called JarService that displays ads, generates fraudulent ad clicks and downloads additional malware. One malware module turns infected head units into reverse proxies so other users' internet traffic can be routed through the car's connection. Kaspersky attributes the campaign with high confidence to MoYu Group, linked to the BadBox operation, which previously infected over 70,000 Android devices and resurfaced as BadBox 2.0 after German authorities disrupted the original botnet in December 2024.

The Record · 23d agoMalware in the wild

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare Blog · 7h agoMalware in the wild

BambooToken: The Malware That Speaks MQTT to Stay Under the Radar

Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.

Lumen Black Lotus Labs identified BambooToken, a multiplatform malware family that exchanges commands through MQTT brokers so infected hosts never contact the C2 server directly, active from at least February 2023 through July 2026. The Windows variant sideloads via Tendyron's OnKey hardware-token software used in Chinese banking and government, or impersonates Kingsoft Office, without either vendor's signing certificate being compromised; a Linux build appeared by December 2025 with shell, file transfer, and system information commands. Victims include MikroTik and DrayTek routers in Singapore, Cambodia, and Vietnam reached after internet-wide SNMP scanning, and Lumen cannot attribute the family to any known actor.

Security Affairs · 7h agoMalware in the wild

Malicious Twitch Extension Exposes 31,000 Users' OAuth Tokens

Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' forwarded live OAuth session tokens of roughly 31,000 users to Russian JeetBot proxy servers.

Socket research found the cross-store extension Twitch Enhanced Viewer | JeetBot (about 30,000 Chrome users and 552 Firefox users) routing Twitch video requests through JeetBot proxy servers with the account-scoped OAuth bearer token appended in cleartext as a URL query parameter. Version 4.x builds, including 4.8 from January 2026, posted captured tokens to dedicated set-token endpoints on JeetBot infrastructure with backups on two Deno services. Token holders can read and send whispers, post in chat, and spend channel points without a password or 2FA; listings were still live at publication and users are advised to remove the extension and re-authenticate.

Infosecurity Magazine · 2d agoMalware in the wild 2 sources

Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens from nearly 31,000 users to Russian bot-service proxy servers.

Socket researchers found the 'Twitch Enhanced Viewer | JeetBot' browser extension forwarded users' live Twitch OAuth tokens as an &auth= query parameter to operator-controlled proxy servers, affecting about 30,000 Chrome users and 604 Firefox users. The tokens, written in cleartext to proxy logs, are bearer credentials granting access to chat, whispers, and account settings without password or 2FA. The operator is a Russian commercial Twitch/Kick/VK-Live bot SaaS linked to Cyprus-based developer Aleksandr Popov; earlier v4.x builds also POSTed tokens to a set-token endpoint. Firefox add-on version 85.8.7 stops the token forwarding, but previously transmitted tokens remain valid until revoked.

The Hacker News · 2d agoMalware in the wild

Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

ThreatFabric details StreamRat, a new Android banking trojan spread via Meta malvertising in Spain that reached about 571,000 EU accounts.

ThreatFabric reported that a fake TV-streaming malvertising campaign on Meta promoted StreamRat, a technically sophisticated Android banking trojan, targeting Spanish-speaking users; the ads reached an estimated 570,950 Meta accounts in the EU between June 11 and July 3, 2026. Once installed via sideloaded APKs, the trojan abuses Accessibility to log keystrokes, show credential-stealing overlays, capture screens, and remotely control devices, and was also promoted through TikTok. Its dropper requests default Home app and VPN permissions and was hosted via GitHub releases, closely resembling one used in the earlier Mirax campaign. C2 infrastructure includes IPs 45.147.28.59 and 193.32.2.245, and no named threat actor was attributed.

The Hacker News · 14d agoMalware in the wild

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.

Palo Alto Networks Unit 42 discovered Kimwolf v7, an evolution of the Kimwolf/AISURU Android and IoT botnet first tracked in February 2026. The new version performs HTTP/2 floods mimicking Chrome browser fingerprints and uses Ethereum Name Service, Tor hidden services, and a local proxy for resilient C2. The botnet targets Android TV boxes via ADB on port 5555 and offloads propagation to an external loader.

The Hacker News · Aug 15, 2026Malware in the wildCVE-2024-36401

Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum

Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.

Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.

Security Affairs · Aug 12, 2026Malware in the wild