Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.
Three banking trojans are currently active threats: Manic, which incorporates spyware capabilities; Grandoreiro, which maintains persistent campaigns targeting victims in Latin America and Europe; and ToxicPanda 2.0, an expanded variant of the ToxicPanda malware. Security professionals should monitor these banking trojans as they demonstrate ongoing development and geographic targeting sophistication.
Researchers at KnowBe4 have identified a new variant of Agent Tesla malware employing innovative emoji-based code obfuscation techniques to bypass security detection systems. This v4 iteration represents an advancement in the malware's evasion capabilities, demonstrating attackers' ongoing efforts to stay ahead of traditional threat detection methods.
Threat actors are leveraging the popularity of AI tools by impersonating well-known brands like Perplexity, Claude, ChatGPT, and Copilot to distribute malware including information stealers, backdoors, and malicious browser extensions. According to Sophs' analysis of 12 months of managed detection and response cases, 34 confirmed instances of malicious AI-related activity were identified, demonstrating the effectiveness of AI brand impersonation as a social engineering vector.
Kaspersky researchers have identified Android malware distributed via legitimate software for DoFun head units that operates as an invisible threat to connected vehicles. The malware performs dual functions: serving advertisements to users and enrolling compromised devices into a proxy botnet for unauthorized network traffic relay. This discovery highlights how legitimate automotive software channels can be exploited to deliver persistent mobile threats.
The Grandoreiro banking Trojan has resurfaced following law enforcement action against its operators, now equipped with enhanced anti-detection and anti-analysis capabilities. The malware is actively targeting Mexico in its latest campaign, suggesting the threat actors have adapted their infrastructure and are resuming operations despite prior disruption efforts.
A spoonful of encryption helps the malware go down
Researchers have disclosed a pair of denial-of-service attacks called "CDN Tsunami" that exploit HTTP/3 to HTTP/1.1 translation in major CDNs, achieving amplification factors of up to 350x against origin servers. The vulnerability stems from how content delivery networks convert client-facing HTTP/3 traffic into backend HTTP/1.1 requests, allowing attackers to magnify relatively modest bandwidth into devastating attacks on protected websites. The attacks were evaluated against multiple major CDN providers.
A new Android threat codenamed Manic has been observed actively targeting Ukrainian banks, government and identity services, and messaging applications, as well as Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications. "Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud
Attackers used a fake Google Gemini installer to deliver the Vidar infostealer onto a company network in the EMEA region, leveraging Google Colab—a legitimate cloud-based development platform—as part of the distribution chain. Darktrace researchers discovered the campaign, which exploited search results pointing to malicious files hosted on Google's own infrastructure to enhance credibility and evade detection.
Researchers have discovered ToxicPanda 2.0, an updated Android banking malware featuring 167 remote commands and expanded global targeting capabilities. The malware includes a PIN harvesting workflow designed to compromise over 140 banking and cryptocurrency applications, demonstrating significant functional enhancements in its attack infrastructure.
Zimperium lifts the lid on the ToxicPanda 2.0 Android banking Trojan
A campaign tracked as Offside Wallet Theft Factory has distributed 40 malicious Firefox extensions impersonating legitimate Web3 wallet applications including OKX, Rabby Wallet, and TronLink to steal cryptocurrency credentials. The Socket Threat Research team identified the malicious add-ons as part of a larger infrastructure of 77 browser extensions sharing common code and infrastructure, indicating a coordinated theft operation.
Fortunately, the company had a policy of checking source code on GitHub first
'It is an active threat'
U.S. agencies are warning that AI-fueled attacks represent an active threat to water utilities and other critical sectors. Hackers are reportedly targeting Siemens S7 Series programmable logic controllers in attacks that agencies characterize as potentially unprecedented in their use of AI techniques.
A legitimate-looking link or valid digital signature can offer false reassurance. Here’s why familiar download safety checks aren’t always enough.
With the new Advanced Flow for sideloading being rolled out, it's time to discuss what sideloading is and how to do it more safely.
eSentire has identified a coordinated malware campaign that leverages ClickFix social engineering lures alongside the ErrTraffic and Cruciferra malware families. The combination of these attack components suggests a sophisticated malware-as-a-service operation designed to increase infection rates and evasion capabilities. This integrated approach demonstrates an evolution in threat delivery tactics where multiple malware families are deployed together to maximize impact.
Grandoreiro malware has resumed operations following its disruption earlier in 2024, demonstrating continued viability despite law enforcement action. The campaign shows a geographic shift with Mexico representing a disproportionate 40% of current detections, suggesting a targeted focus on the region.