A supply-chain attack against Android-based car head units is spreading malware through a legitimate DoFun update app, turning compromised devices into proxy botnet nodes and tools for ad fraud. Kaspersky linked the campaign to the MoYu group and identified JarService, which downloads additional payloads, reports device details, and supports commands used for monetization. #MoYu #DoFun #JarService #TWCore #BadBox #zhima
Category: Cyber Security News
The Hospital for Sick Children (SickKids) disclosed a data theft incident tied to a third-party software application that may have exposed personal information belonging to current and former employees, job applicants, and employees of related organizations. The hospital said no clinical systems or patient information were affected and has offered impacted…
TikTok, owned by ByteDance, agreed to pay $400 million to settle a U.S. lawsuit over alleged violations of child privacy laws, including claims it allowed children under 13 to create accounts and mishandled data collected through Kids Mode. The settlement follows regulatory scrutiny in the U.S. and Europe, where TikTok has…
U.S. Bancorp says LockBit’s recent data-theft claims stem from a contractor-related incident involving a third-party, not from any compromise of its own systems or network. The bank says it has informed law enforcement and is monitoring the situation while LockBit continues to threaten a leak without providing proof. #U.S.Bancorp #LockBit #RecordedFutureNews…
Members of Congress have asked the Government Accountability Office to review how staffing cuts at CISA have affected its ability to protect critical infrastructure and respond to growing threats. The letter raises concerns about lost expertise, reduced responsiveness, and proposed budget cuts that could further weaken the agency’s mission, especially amid…
ThreatFabric, Acronis, and Zimperium reported new activity from banking trojans including Manic, Grandoreiro, and ToxicPanda 2.0, all designed to steal credentials, siphon data, and take control of infected devices. The campaigns are targeting banks, fintech services, and users across Ukraine, Latin America, Europe, and multiple other countries, with improved evasion and…
Researchers uncovered a new Android malware family that targets DoFun vehicle head unit firmware by abusing legitimate software update mechanisms to install hidden payloads. The campaign, linked to the MoYu Group and BADBOX activity, supports ad fraud and proxy botnet operations while stealing device details and fetching additional modules like zhima….
Check Point Research revealed that Microsoft Defender’s legitimately signed BTR.sys boot-time remediation driver can be abused for arbitrary kernel-level file and registry operations on Windows from Windows 7 through Windows 11 25H2. The technique, demonstrated with the BTR_CLI proof-of-concept, can remove security binaries in a “golden window” after reboot, while Check…
Researchers found trojanized npm packages that pretend to be calendar and streak utilities while secretly deploying RedC2 4.0’s AI-powered Linux implant, RedShell. The campaign uses a simple import to trigger execution and is linked to a broader, evolving C2 framework promoted by the threat actor MarlboroMan via Red Offsec. #RedC2 #RedShell…
Microsoft is rolling out a Classic Outlook theme for Outlook on the web and New Outlook for Windows to give users a more familiar interface while preserving the new app’s capabilities. The feature is being phased in from mid-August through late October and will not force any migration or override administrator settings. #Microsoft #Outlook #NewOutlook #OutlookOnTheWeb
The internet’s default business model encourages surveillance capitalism, where data brokers and AI systems combine your accounts, browsing, and purchases into detailed profiles. A practical way to improve privacy and security is compartmentalization: using separate personas with different email addresses, phone numbers, payment methods, and browsing contexts to limit how much of your identity can be linked together. #SurveillanceCapitalism #DataBrokers #AI #MySudo #AnonyomeLabs
Microsoft says the August 2026 Windows updates may be causing some games to crash, freeze, fail to launch, or trigger system restarts on Windows 11 24H2 and 25H2 devices. The issue appears to be linked to RGB-equipped peripherals or internal components that install drivers such as inpoutx64, affecting titles like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals. #Microsoft #Windows11 #ARCRaiders #MARVELTokonFightingSouls #TheFinals #inpoutx64
More than 9,300 AWS access keys exposed over a four-year period are still active, with hundreds tied to companies, root accounts, and AdministratorAccess users. Truffle Security warns that some of these leaked credentials could give attackers full control of AWS environments, including data theft, account takeover, and cryptomining, with Hugging Face being the largest source of exposed keys. #AWS #HuggingFace #TruffleSecurity
Researchers at Adversa AI discovered a new attack method called Cryptographic Context Injection, which uses encryption to bypass AI input and output guardrails. They reported the issue to xAI and found it could affect Grok and Gemini, with the attack still posing a serious risk despite reduced success against Gemini. #AdversaAI…
This week’s roundup covers active exploitation of the Ray vulnerability, a GitHub Actions flaw discovered by a Wiz autonomous agent, sustained DDoS pressure on Threema, and new botnet activity from Evooo1Bot. It also highlights major incidents involving Salt Typhoon, TeamPCP, Sakura Internet, and Medusa ransomware, alongside a notable post-quantum hardware certification…