35
35
30
35
Skullcandy Dime 3 earbuds expose users to Bluetooth hijacking
CERT/CC warns Skullcandy Dime 3 earbuds accept silent Bluetooth pairings via CVE-2025-20701, letting nearby attackers hijack audio and microphone.
CERT/CC reports the Skullcandy Dime 3 (model S2DCW) running firmware 1.0.0.28 is affected by CVE-2025-20701, a high-severity missing-authentication flaw in the Airoha Bluetooth Audio SDK. An attacker in close range can pair without user interaction, then hijack audio playback, access the headset profile, and capture live microphone audio. Skullcandy fixed the issue in firmware 1.0.0.30, but existing units have no consumer-accessible update path via the app. The flaw was discovered by ERNW researchers and affects earbud and headphone products from multiple vendors; Apple patched it for Beats Studio Buds in June.
45
WindRelay Malware Pairs With SpyNote RAT in Live-Call Scam
New WindRelay Android NFC-relay malware paired with SpyNote RAT enables real-time card cloning during live scam calls.
Infosecurity Magazine reports on WindRelay, a new Android NFC relay malware that was used together with the SpyNote RAT. The malware let a fraudster relay a victim's contactless card data in real time during a live social-engineering call, enabling the card to be cloned mid-call. The attack combines mobile RAT infection with near-field-communication relaying to defeat contactless payment protections.
58
THost9 Android RAT Pairs Packed Loader With ADB Worm
Dark Atlas details THost9, a packed Android RAT paired with an ADB worm that installs itself on devices with exposed Android Debug Bridge services.
Dark Atlas researchers described the Hagaseca cluster, whose THost9 packed loader hides executable code in an embedded asset decoded with single-byte XOR and gzip before loading a tc9.dex second stage. The second stage adds shell execution, file transfer, tunneling, reverse shells, downloadable modules and a self-propagating ADB worm that expands single addresses into 65,025-host scan ranges. Newer builds include anti-analysis checks for Frida, and incident reports connect THost9 and THost4 to Android phones and Redroid containers with exposed ADB from October 2024 through 2026.
55
30
35
30
Nintendo Switch QR Code Vulnerability Lets Nearby Attackers Execute Unauthorized Code
Nintendo patched CVE-2026-82079 (CVSS 8.4), a stack buffer overflow in Switch local wireless pairing enabling nearby attackers to execute code.
Nintendo Switch system update 23.0.0 fixes CVE-2026-82079, a stack-based buffer overflow in local wireless networking abused via the QR code sharing process, including Album's 'Send to Smartphone' and Mario Kart Live pairing. A nearby attacker who scans the displayed QR code can send crafted traffic and use return-oriented programming to achieve arbitrary code execution. CVSS scores are 8.4 (v3.1) and 7.0 (v4.0), both rated High. No in-the-wild exploitation is reported and Switch 2 systems are not affected.
35
45
50
30
30
30
30
30
30
30
35
30
35
30
30
Researchers Uncover Thousands of Leaked AWS Keys
Truffle Security researchers discovered more than 9,000 publicly accessible and active AWS key pairs, creating credential exposure and account-takeover risks.
Truffle Security reported finding over 9,000 AWS key pairs that are simultaneously publicly accessible and active. Anyone retrieving such keys could potentially access the associated cloud resources without authentication. The finding underscores widespread secrets-hygiene failures in cloud environments and the risks of long-lived static credentials.
46
ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI details a network-adjacent stack buffer overflow in BlueZ's A2DP stack (CVE-2026-19774, CVSS 7.1) allowing remote code execution after pairing a malicious Bluetooth device.
The Zero Day Initiative published advisory ZDI-26-589 for a stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack. A network-adjacent attacker who can pair a malicious Bluetooth device with the target can execute arbitrary code on the affected installation. The flaw carries a CVSS 7.1 rating and is tracked as CVE-2026-19774.
25
TuxBot v3: Inside an IoT Botnet Framework With LLM
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.
45
New Android malware relays bank cards to fraudsters while victims still hold them
Group-IB discovered WindRelay Android malware that streams NFC card data in real time, paired with SpyNote RAT, targeting Czechia, Slovakia, and Slovenia.
Group-IB identified WindRelay, an Android malware that uses NFC to communicate with victims' payment cards and relays the exchange live to attacker-controlled terminals. Fraudsters impersonate bank staff by phone, trick victims into installing a personalized SpyNote RAT, then silently deploy WindRelay to cash out using the victim-entered PIN. Researchers traced 23 samples on VirusTotal from November 2025 to July 2026, four C2 IPs, and campaigns against Czechia, Slovakia, and Slovenia. No affected apps were found on Google Play, and Google Play Protect detects known versions.
65
30
30
30
35
30
35
30
30
45
35
30