Security News

Researchers uncovered a new Android malware family that targets DoFun vehicle head unit firmware by abusing legitimate software update mechanisms to install hidden payloads. The campaign, linked to the MoYu Group and BADBOX activity, supports ad fraud and proxy botnet operations while stealing device details and fetching additional modules like zhima….

Check Point Research revealed that Microsoft Defender’s legitimately signed BTR.sys boot-time remediation driver can be abused for arbitrary kernel-level file and registry operations on Windows from Windows 7 through Windows 11 25H2. The technique, demonstrated with the BTR_CLI proof-of-concept, can remove security binaries in a “golden window” after reboot, while Check…

Researchers found trojanized npm packages that pretend to be calendar and streak utilities while secretly deploying RedC2 4.0’s AI-powered Linux implant, RedShell. The campaign uses a simple import to trigger execution and is linked to a broader, evolving C2 framework promoted by the threat actor MarlboroMan via Red Offsec. #RedC2 #RedShell…

Microsoft is rolling out a Classic Outlook theme for Outlook on the web and New Outlook for Windows to give users a more familiar interface while preserving the new app’s capabilities. The feature is being phased in from mid-August through late October and will not force any migration or override administrator settings. #Microsoft #Outlook #NewOutlook #OutlookOnTheWeb

The internet’s default business model encourages surveillance capitalism, where data brokers and AI systems combine your accounts, browsing, and purchases into detailed profiles. A practical way to improve privacy and security is compartmentalization: using separate personas with different email addresses, phone numbers, payment methods, and browsing contexts to limit how much of your identity can be linked together. #SurveillanceCapitalism #DataBrokers #AI #MySudo #AnonyomeLabs

Microsoft says the August 2026 Windows updates may be causing some games to crash, freeze, fail to launch, or trigger system restarts on Windows 11 24H2 and 25H2 devices. The issue appears to be linked to RGB-equipped peripherals or internal components that install drivers such as inpoutx64, affecting titles like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals. #Microsoft #Windows11 #ARCRaiders #MARVELTokonFightingSouls #TheFinals #inpoutx64

More than 9,300 AWS access keys exposed over a four-year period are still active, with hundreds tied to companies, root accounts, and AdministratorAccess users. Truffle Security warns that some of these leaked credentials could give attackers full control of AWS environments, including data theft, account takeover, and cryptomining, with Hugging Face being the largest source of exposed keys. #AWS #HuggingFace #TruffleSecurity

Researchers at Adversa AI discovered a new attack method called Cryptographic Context Injection, which uses encryption to bypass AI input and output guardrails. They reported the issue to xAI and found it could affect Grok and Gemini, with the attack still posing a serious risk despite reduced success against Gemini. #AdversaAI…

This week’s roundup covers active exploitation of the Ray vulnerability, a GitHub Actions flaw discovered by a Wiz autonomous agent, sustained DDoS pressure on Threema, and new botnet activity from Evooo1Bot. It also highlights major incidents involving Salt Typhoon, TeamPCP, Sakura Internet, and Medusa ransomware, alongside a notable post-quantum hardware certification…

Former U.S. Army General Paul M. Nakasone has launched the Nakasone Group, a boutique advisory firm focused on national security, cybersecurity, geopolitical, and personal protection services for governments, corporations, and private clients. The firm offers private cyber defense, fraud and impersonation protection, travel security, and threat intelligence, drawing on a team…

Apollo Global Management confirmed that attackers used social engineering to gain unauthorized access to some of its cloud platforms between July 6 and July 10, exposing personal data including names, dates of birth, contact information, home addresses, and Social Security numbers. Google has attributed the broader campaign to BlackFile, a threat group linked to The Com and its extortion brands Redact, Pink, Helix, and Falcon. #ApolloGlobalManagement #BlackFile #TheCom #Redact #Pink #Helix #Falcon

SynkLoader is a newly identified malware family spread through Microsoft Teams phishing campaigns that impersonate a company’s IT help desk and trick victims into installing a fake “PowerShell Cleaner” MSI from Microsoft Azure. It uses a fake Windows lock screen to steal credentials and can deploy modules for persistence, traffic redirection, remote shell access, and desktop control, with activity suggesting possible ransomware preparation. #SynkLoader #MicrosoftTeams #PhishLocker #PowerShellCleaner #Expel #MarcusHutchins

Sen. Ron Wyden and Rep. Greg Casar are urging the Government Accountability Office to investigate how U.S. federal agencies use hacking tools and spyware against Americans, and to publish the findings. Their request focuses on the scope of government hacking, safeguards against abuse, and cases involving firms like Paragon and tools tied to Rule 41 requests. #RonWyden #GregCasar #GAO #Paragon #Rule41

North Korean hackers conducted a supply chain attack against the Rust ecosystem by poisoning the popular arrayref crate and related packages on crates.io. Wiz linked the operation to Sapphire Sleet, noting infrastructure overlaps with earlier Axios and Mastra NPM campaigns and a malicious dependency impersonating proc-macro2. #SapphireSleet #arrayref #proc-macro2 #crates.io…

A critical type confusion flaw in the isolated-vm Node.js library could let attackers achieve remote code execution on the host by abusing the ExternalCopy transfer process across V8 isolates. The issue affects embedders running untrusted JavaScript with shared References and was fixed in isolated-vm versions 6.2.0 and 7.0.1. #isolated-vm #ExternalCopy #V8…

iAuthFlow V2 is a high-end phishing toolkit sold on a Russian-language cybercrime forum that can maintain access to a victim’s account even after a password reset. Abnormal’s analysis suggests the toolkit silently registers an attacker-controlled passkey during a phishing flow, making traditional recovery steps insufficient. #iAuthFlowV2 #Abnormal #Google #Gmail #passkeys…

SickKids said a cybersecurity incident exposed personal information belonging to some current and former employees, as well as job applicants, due to a flaw in third-party software. The hospital says clinical systems and patient records were not affected, and it has restored the Careers website while continuing its investigation with outside experts. #SickKids #Boomerang #SickKidsFoundation #MOVEitTransfer #LockBit

Threat actors are abusing FTP server banners as dead-drop resolvers to deliver commands that install two previously undocumented remote access trojans, E4del and PINHOLE. The campaign likely begins with phishing-delivered ZIP and LNK files, while PINHOLE and E4del use unusual C2 and execution techniques to maintain access and evade detection. #E4del #PINHOLE #SOCRadar #MalwareHunterTeam

Microsoft has patched CVE-2026-69836, a maximum-severity flaw in Entra ID that allowed unauthenticated attackers to execute code over the network in low-complexity attacks. Microsoft says the issue has been fully mitigated and no user action is required, while also addressing several other critical flaws across Azure Arc, Exchange Online, and Azure Managed Instance for Apache Cassandra. #EntraID #CVE-2026-69836 #AzureArc #ExchangeOnline #AzureManagedInstanceforApacheCassandra