Researchers have discovered ToxicPanda 2.0, an updated Android banking malware featuring 167 remote commands and expanded global targeting capabilities. The malware includes a PIN harvesting workflow designed to compromise over 140 banking and cryptocurrency applications, demonstrating significant functional enhancements in its attack infrastructure.
Read full article at The Hacker News ↗Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.
Three banking trojans are currently active threats: Manic, which incorporates spyware capabilities; Grandoreiro, which maintains persistent campaigns targeting victims in Latin America and Europe; and ToxicPanda 2.0, an expanded variant of the ToxicPanda malware. Security professionals should monitor these banking trojans as they demonstrate ongoing development and geographic targeting sophistication.
Researchers at KnowBe4 have identified a new variant of Agent Tesla malware employing innovative emoji-based code obfuscation techniques to bypass security detection systems. This v4 iteration represents an advancement in the malware's evasion capabilities, demonstrating attackers' ongoing efforts to stay ahead of traditional threat detection methods.
Threat actors are leveraging the popularity of AI tools by impersonating well-known brands like Perplexity, Claude, ChatGPT, and Copilot to distribute malware including information stealers, backdoors, and malicious browser extensions. According to Sophs' analysis of 12 months of managed detection and response cases, 34 confirmed instances of malicious AI-related activity were identified, demonstrating the effectiveness of AI brand impersonation as a social engineering vector.