The FBI has seized hundreds of domains associated with NetNut, a residential proxy service operated by publicly-traded Israeli firm Alarum Technologies, following evidence linking the platform to the Popa botnet. The action was coordinated with industry partners and comes weeks after security researchers connected NetNut to Popa, which comprises at least two million compromised devices operated largely without victim consent.
Read full article at Krebs on Security ↗Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.
Three banking trojans are currently active threats: Manic, which incorporates spyware capabilities; Grandoreiro, which maintains persistent campaigns targeting victims in Latin America and Europe; and ToxicPanda 2.0, an expanded variant of the ToxicPanda malware. Security professionals should monitor these banking trojans as they demonstrate ongoing development and geographic targeting sophistication.
Researchers at KnowBe4 have identified a new variant of Agent Tesla malware employing innovative emoji-based code obfuscation techniques to bypass security detection systems. This v4 iteration represents an advancement in the malware's evasion capabilities, demonstrating attackers' ongoing efforts to stay ahead of traditional threat detection methods.
Threat actors are leveraging the popularity of AI tools by impersonating well-known brands like Perplexity, Claude, ChatGPT, and Copilot to distribute malware including information stealers, backdoors, and malicious browser extensions. According to Sophs' analysis of 12 months of managed detection and response cases, 34 confirmed instances of malicious AI-related activity were identified, demonstrating the effectiveness of AI brand impersonation as a social engineering vector.