Search: “ToxicPanda 2.0”

ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries

Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.

Zimperium's zLabs documented ToxicPanda 2.0, an Android banking trojan expanding from 16 targeted apps to 349 financial institutions across 16 countries, with 167 remote commands. It poses as a dropper, abuses VPN permissions to block Google Play Protect while installing a hidden payload, then uses the Accessibility Service for screen monitoring and overlay-based credential theft. It automates enabling Android Wireless Debugging and completes the pairing handshake to gain ADB shell access for privilege escalation, and overlays fake lock screens to steal device PINs. Previously unfinished commands are now operational and samples are served from AWS-hosted storage buckets.

Security Affairs·Aug 22, 16:50 UTC · 25d agoMalware in the wild

Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps

Zimperium reports ToxicPanda 2.0, an updated Android banking trojan now targeting more than 140 banking and cryptocurrency apps.

Zimperium has published analysis of ToxicPanda 2.0, an updated Android banking trojan variant. The new variant expands its target list to over 140 banking and cryptocurrency applications. The report lifts the lid on the updated capabilities of the mobile malware family.

Infosecurity Magazine·Aug 20, 10:00 UTC · 27d agoMalware

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On

Zimperium and IBM Trusteer report expanded ToxicPanda 2.0 and GoldDigger Android banking trojan campaigns now targeting 349 financial institutions across 16 countries.

Zimperium zLabs reports ToxicPanda 2.0 (TgToxic) now carries 167 remote commands, targets 349 financial institutions across 16 countries via more than 140 banking and cryptocurrency apps, and abuses Android Wireless Debugging via ADB for privilege escalation and shell access. It harvests lock screen PINs with fake overlays, steals UI elements via accessibility services, sets Device Administrator privileges, and is distributed through Amazon AWS-hosted buckets. IBM Trusteer documents a GoldDigger campaign impersonating airline companies and shopping retailers, causing massive infections in South Africa and the U.K., obfuscated with the dpt-shell packer that detects Frida and resists debugging. GoldDigger performs on-device fraud by injecting input into banking apps and is attributed to the Chinese-speaking GoldFactory actor.

The Hacker News·Aug 24, 06:44 UTC · 23d agoMalware in the wild

Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks

SAILS learns to select poison sets for LLM backdoor attacks, showing attack success ranges 3% to 80% at fixed poison counts across LLaMA-3-8B settings.

The paper shows existing backdoor evaluations that randomly sample a fixed number of poisoned examples severely underestimate worst-case vulnerability: across three LLaMA-3-8B settings, attack success ranges from 3% to 80% depending only on which poison set is chosen. SAILS formalizes poison selection as oracle-budgeted set optimization, learning a set scorer from a few hundred finetune-and-evaluate runs to rank millions of candidate sets and audit a small shortlist. It improves held-out attack success by 30 percentage points over the strongest influence baselines and transfers from small-scale to full-scale finetuning, extending to code-generation, agentic, and API-only backdoors.

arXiv cs.CR·Sep 14, 04:44 UTC · 2d agoAI safety & security 2 sources1

USN-8571-2: Apache HTTP Server regression

Ubuntu issues USN-8571-2 fixing an Apache HTTP Server regression that prevented startup when HTTP/2 proxying was enabled.

Ubuntu released USN-8571-2 to fix a regression introduced by USN-8571-1 in Apache HTTP Server. The earlier fix was incomplete due to a missing library symbol, causing Apache to fail to start when HTTP/2 proxying was enabled. The original advisory addressed CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, and an HTTP response splitting vulnerability affecting multiple modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab, and Dawit Jeong.

Ubuntu Security Notices·updated 14:37 UTC · 6h ago·first Sep 10, 19:36 UTC · 6d agoAdvisory 13 sourcesCVE-2026-33007

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 26d agoResearch2

ToxicPanda Banking Trojan Matures Into Enterprise Threat

The ToxicPanda Android banking trojan has matured with new features that expand its global reach beyond users' financial apps.

Researchers report that the latest version of the ToxicPanda Android banking trojan includes new capabilities that broaden its global distribution and increase its threat to enterprises, not just individual users' financial applications. The trojan's evolution signals it is operating at a more professional, enterprise-targeting level. The report outlines expanded features and reach rather than a single incident.

Dark Reading·Aug 24, 14:34 UTC · 23d agoMalware

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers·Sep 11, 12:24 UTC · 5d agoMalware in the wild2

Hackers Abuse YouTube Gaming Channels and SEO Poisoning to Deploy RATs and Chrome Hijacker

Unit 42 exposed CL-CRI-1171, a pay-per-install operation using YouTube gaming channels and SEO poisoning to deliver RATs and a Chrome hijacker.

Palo Alto Networks Unit 42 identified over 10,000 OfferLoader samples and 11 YouTube channels pushing trojanized installers via gaming lures and SEO-poisoned searches for tools like WinDirStat and Bluetooth drivers. Trojanized Inno Setup installers spawn three payload branches: Insomnia RAT (dual Node.js/Python backdoor that disables Microsoft Defender), ARKTunnel (undocumented RAT hiding its payload in a bitmap image and tunneling TCP/UDP), and Docro Hijacker (alters Chrome protected preferences to hijack search and affiliate links). The pay-per-install model sells each infection to multiple buyers, reaching gamers as well as corporate and government endpoints.

Cyber Security News·Sep 14, 08:01 UTC · 2d agoMalware in the wild1

Homebrew 7.0.0 gets built-in GUI, better security controls

Homebrew 7.0.0 adds a built-in vulnerability scanner (brew vulns), a Homebrew advisory database, stronger sandboxing, and the BrewUI GUI.

Homebrew 7.0.0 ships a native BrewUI graphical interface for macOS 26 Tahoe and later, plus a new 'brew vulns' command that queries OSV.dev in batch to flag vulnerabilities in installed formulae, specific packages, or Brewfile dependencies. The release also introduces a Homebrew-specific OSV-format advisory database distinguishing outstanding vulnerabilities from backported fixes. Sandbox improvements block home directory access by default and separate network-enabled dependency downloads from offline installs.

BleepingComputer·Sep 14, 19:51 UTC · 2d agoTools1

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.

Palo Alto Unit 42·Sep 9, 10:00 UTC · 7d agoMalware in the wild1

ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks

ToxicRAG shows a single narrative-form poisoned document can steer RAG answers, achieving 0.61-0.91 attack success rates across four LLMs.

The attack injects one document per target question written as a coherent knowledge-update narrative that acknowledges the previously accepted answer, introduces fabricated events that appear to invalidate it, and attributes the attacker-chosen answer to purported authorities. An optional answer-focused self-validation loop revises candidates when a surrogate LLM fails to reproduce the target answer. Across 100 target questions each from Natural Questions, HotpotQA, and MS-MARCO, with four victim LLMs and four dense retrievers, ToxicRAG achieves attack success rates of 0.61-0.91 and matches or exceeds the strongest baseline by 0 to 11 percentage points.

arXiv cs.CR·Sep 10, 04:42 UTC · 6d agoAI safety & security1

"Shut Up and Let Me Enjoy My Otome": Understanding and Measuring the Toxicity in Otome Game Communities

First large-scale study finds 22.20% of Weibo otome game posts toxic versus 3.71% on Reddit, with LLM detectors reaching 0.82 F1.

Researchers present the first large-scale measurement of toxicity in otome game communities, introducing OtomeSCAN, which collected and analyzed 620,045 posts from Weibo and Reddit over 18 months. They manually annotated 4,308 posts, identified eight target groups, and evaluated seven toxicity detectors, with their best LLM-based model reaching F1-scores of 0.82 on Weibo and 0.78 on Reddit. The study found 22.20% of Weibo posts were toxic versus 3.71% on Reddit, and toxicity rose to 37.09% within 72 hours during an external attack on Weibo. The authors also flagged 191 potential-coordination clusters, 64.40% of which targeted game developers.

arXiv cs.CR·Sep 7, 21:44 UTC · 8d agoResearch

Homebrew 7.0.0 Adds Built-In Vulnerability Scanner and Stronger Package Sandboxing

Homebrew 7.0.0 ships a native brew vulns scanner, OSV-backed advisory database, stronger sandboxing, and fixes a sandbox-escape issue.

Homebrew 7.0.0 introduces a built-in 'brew vulns' command that scans installed formulae, dependencies, and Brewfiles against a new Homebrew-specific advisory database and OSV.dev data, distinguishing backported fixes from outdated versions. The release hardens sandboxing by blocking home-directory reads during builds, disabling network access at install time, and replacing Bubblewrap with Landlock on Linux. It also fixes moderate-severity GHSA-5263-whxq-77hp, where a malicious cask could execute code outside the macOS sandbox via LaunchServices, and drops macOS Catalina while moving Intel Macs to Tier 3.

Cyber Security News·Sep 15, 13:55 UTC · 1d agoTools

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackers·updated Sep 11, 14:17 UTC · 5d ago·first Sep 11, 09:07 UTC · 5d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

Apache OpenNLP CVE-2026-82617: built-in EMAIL and URL regex name-finder patterns enable regular expression denial-of-service and stack exhaustion in affected releases.

CVE-2026-82617 affects Apache OpenNLP opennlp-core 3.0.0-M1 before 3.0.0-M6 and opennlp-tools 2.0.0 before 2.5.12. The DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL patterns in RegexNameFinderFactory contain ambiguous nested quantifiers. Applications using these built-in finders on attacker-controlled input can be forced into regular expression denial of service or stack exhaustion. Fixes shipped in opennlp-tools 2.5.12 and 3.0.0-M6.

oss-security·Sep 11, 19:24 UTC · 5d agoVulnerability 2 sourcesCVE-2026-826171

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Check Point links Gambling Goblin, a Chinese-speaking cluster, to malicious Apache modules hijacking Brazilian government servers to promote betting sites.

Check Point Research tracks Gambling Goblin, a Chinese-speaking cluster, installing malicious Apache reverse-proxy modules on compromised Brazilian government and education web servers since mid-2025. The modules divert visitors to gambling and fake app-store pages while stripping the site's security headers, likely for large-scale SEO manipulation. The group's Linux arsenal includes DownPro, AlphaAgent, oRAT, a 3snake-based credential stealer, and SSH brute-forcing tools, and it is tied to Trend Micro's Earth Berberoka. Related SEO-fraud campaigns on .gov.br domains were documented by ESET (GhostRedirector), Palo Alto Networks Unit 42, and Hunt.io.

The Hacker News·Sep 2, 13:44 UTC · 14d agoThreat actor in the wild

BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

DFIR Report exposes BengalSEO, an India-based SEO-poisoning operation running since 2015, delivering MayaBot malware and tech support scams via Bing results.

The DFIR Report details BengalSEO, a financially motivated cluster operating from Rajasthan, India, since at least 2015, run through two IT service providers: WeConnect Solutions LLC and Garage2Global. The group uses black-hat SEO techniques—backlinks, DOM injection, DOM shuffling, keyword stuffing—to push lure pages to the top of Microsoft Bing results, routing victims through a traffic distribution system to either the custom MayaBot malware (which delivers an XMRig cryptominer and enables C2) or tech support scam call centers. A Vizio decoy page had 2,000 backlinks from 167 unique external domains, and Matomo analytics is used for victim fingerprinting, with the tracking domain appearing in 1,112 urlscan.io results.

The Hacker News·Sep 8, 08:43 UTC · 8d agoThreat actor in the wild

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

Sophos details PoisonedRefresh, a fileless Linux rootkit that injects a memory-resident PHP web shell into F5 BIG-IP APM after exploitation of CVE-2025-53521.

On September 8, 2026, SophosLabs published an analysis of Linux/Agnt-IC (dubbed PoisonedRefresh by ESET) found in compromised F5 BIG-IP Access Policy Manager environments. Initial access leverages CVE-2025-53521, an unauthenticated RCE in BIG-IP APM when an access policy is configured on a virtual server; F5 confirmed exploitation and links the activity to cluster c05d5254, while Shadowserver observed 795 exposed vulnerable endpoints. A first stage hidden in a modified umount binary modifies /usr/sbin/httpd and SELinux configuration and embeds itself in BIG-IP upgrade images for persistence. The second-stage ELF intercepts __libc_start_main, hooks apr_dso_load, and injects a PHP web shell into libphp memory via mmap manipulation, leaving no disk artifacts, and exposes a /bin/bash shell via a local UNIX domain socket instead of a TCP port.

Security Affairs·Sep 9, 08:50 UTC · 7d agoMalware in the wildCVE-2025-53521

ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

ZDI disclosed a server-side request forgery in Fabric.js loadFromJSON (CVE-2026-19504) that can leak sensitive information from affected implementations.

Zero Day Initiative advisory ZDI-26-588 describes a server-side request forgery vulnerability in the Fabric.js canvas library's loadFromJSON function. Exploitation requires interaction with the library and attack vectors vary by implementation, potentially exposing sensitive information. The issue is rated 4.0 on the CVSS scale and tracked as CVE-2026-19504. The advisory does not report exploitation in the wild.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoVulnerabilityCVE-2026-19504

CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.

CVE-2026-82441 (severity: moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Topology submissions carry dependency_jars and dependency_artifacts blobstore key lists that Nimbus never validated on the submission path, yet acted on during cleanup of finished topologies. A malicious submitter could reference arbitrary blobstore keys, causing cross-tenant blob deletion and cluster-wide denial of service.

oss-security·Sep 13, 14:42 UTC · 3d agoVulnerabilityCVE-2026-824411

GitHub Dependabot malware alerts now cover eight ecosystems

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Malware

Grandoreiro Resurfaces in Mexico With New DLL Sideloading Campaign

Banking trojan Grandoreiro resurfaces in Mexico using DLL sideloading, now accounting for 40% of detections after its 2024 disruption.

Grandoreiro, a banking trojan disrupted in 2024, is active again with a new DLL sideloading technique. Mexico now accounts for 40% of the malware's detections. The resurgence signals renewed targeting of banking customers in Latin America.

Infosecurity Magazine·Aug 19, 14:00 UTC · 28d agoMalware

Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown

McAfee says WeedHack infostealer MaaS still spreads via ten fake Minecraft client sites and SEO poisoning despite C2 takedown, with 116,464 infections logged.

McAfee Labs' follow-up on the WeedHack Malware-as-a-Service operation, first documented in June 2026, found ten active fake Minecraft client sites and multiple file-hosting accounts still distributing the infostealer even after its C2 server went dark; over 6,300 user attempts were blocked in the past month. The campaign, running since January with 116,464 infected systems and 2,000-3,000 daily new victims, offered a free Discord-gated tier and a $5/month premium tier with webcam surveillance, and stole session cookies, passwords, browser data, and cryptocurrency wallets. Distribution relies on SEO poisoning that ranked fake sites such as nova-client.com above genuine GitHub repositories, with most malicious links coming via Discord (49.6%) and MediaFire (23.4%), and one fake site built with the AI website builder lovable.app.

Security Affairs·Aug 25, 07:15 UTC · 22d agoMalware

Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw

A networking flaw in Nvidia tooling lets attackers reach OpenClaw's local model server unauthenticated via the Ollama API, enabling persistent LLM poisoning.

Dark Reading reports that a networking issue in Nvidia's tooling can give attackers unauthenticated access to the local model server through the Ollama API. From there, attackers can poison the model used by the OpenClaw agent, creating persistent corruption of agent behavior. The finding highlights exposed local model servers as a security risk for self-hosted AI agent stacks.

Dark Reading·Aug 25, 19:50 UTC · 22d agoAI safety & security

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42·Aug 17, 12:45 UTC · Aug 17, 2026Research

USN-8732-1: Minetest vulnerability

Ubuntu issued USN-8732-1 fixing a Minetest LuaJIT sandbox escape that let malicious mods execute arbitrary code on servers.

Ubuntu Security Notice USN-8732-1 addresses a flaw in Minetest where the Lua sandbox environment was not properly sanitized when using LuaJIT. A malicious mod could escape the sandbox, execute arbitrary code, and gain full file system access on the server. Administrators should update to the patched packages.

Ubuntu Security Notices·Sep 7, 10:31 UTC · 9d agoAdvisory

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42·Aug 19, 12:04 UTC · 28d agoMalware in the wild

Critical Langflow Vulnerability Exploited as Attacks on AI Platform Rise

Attacks exploiting CVE-2026-0768, a critical vulnerability in the Langflow low-code AI platform, are rising amid growing adversary attention this year.

CVE-2026-0768 is a critical vulnerability in Langflow, a low-code AI development platform, with exploitation attacks now rising. Dark Reading notes the platform has drawn increasing adversary attention in 2026. Organizations running exposed Langflow instances face elevated risk and should patch promptly and review instances for compromise.

Dark Reading·Sep 1, 20:48 UTC · 15d agoExploit / PoC in the wildCVE-2026-07681