Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Researchers uncovered a new Android malware family that targets DoFun vehicle head unit firmware by abusing legitimate software update mechanisms to install hidden payloads. The campaign, linked to the MoYu Group and BADBOX activity, supports ad fraud and proxy botnet operations while stealing device details and fetching additional modules like zhima….

Read More
Microsoft Defender’s Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research revealed that Microsoft Defender’s legitimately signed BTR.sys boot-time remediation driver can be abused for arbitrary kernel-level file and registry operations on Windows from Windows 7 through Windows 11 25H2. The technique, demonstrated with the BTR_CLI proof-of-concept, can remove security binaries in a “golden window” after reboot, while Check…

Read More
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Researchers found trojanized npm packages that pretend to be calendar and streak utilities while secretly deploying RedC2 4.0’s AI-powered Linux implant, RedShell. The campaign uses a simple import to trigger execution and is linked to a broader, evolving C2 framework promoted by the threat actor MarlboroMan via Red Offsec. #RedC2 #RedShell…

Read More
Introducing EchoBench: A Human Calibrated Benchmark for Autonomous Pentesting

EchoBench is a human-calibrated benchmark for autonomous web application pentesting that scores model-and-harness systems against associate pentesters from NetSPI University. It uses four geometric-mean components—finding fidelity, difficulty-reach, OWASP breadth, and repeatability—while publishing cohort, configuration, provenance, and repeatability details alongside every score. #EchoBench #NetSPIUniversity #OWASP2025

Read More