173 casos · pág. 8/9
Check Point Exposure Management researchers uncovered a large, multi-region phishing infrastructure that conceals active campaigns behind domains that look inactive. Root domains return blank or generic "Not Found" pages, while the phishing content is served only through concealed regional paths (for example /it, /de, /pa) and under speci…
Kaspersky found the first documented Android malware targeting automotive head units, discovered in June 2026. It is a multi-stage downloader whose ultimate purpose is ad fraud and a residential proxy botnet. It spread through the built-in updater (TWCore, package com.tw.core) of DoFun head unit firmware, which installs APKs pushed over a…
Kaspersky's Q2 2026 vulnerability landscape report records an unprecedented number of registered CVEs, including critical ones. It attributes the surge mainly to AI-assisted vulnerability discovery and AI-generated code. Researchers are also publishing exploits for unpatched flaws more often. One example is Nightmare Eclipse (Chaotic Ecli…
Kaspersky ICS CERT reports that in Q2 2026 malicious objects were blocked on 19.15% of ICS computers, the lowest level since 2022. Regional rates ranged from 8.1% in Northern Europe to 27.9% in Africa. East Asia saw the largest increase (+2.0 pp). The biometrics sector (26.44%) again led all industries. Kaspersky products blocked malware …
Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attacke…
Kaspersky researchers report that the APT group Mirage Kitten has moved from native C/C++/Go malware to Node.js and JavaScript implants, NodeRabbit and PollCat. Both are cross-platform RATs delivered through spear-phishing by fake recruiters on LinkedIn and other job platforms, using trojanized coding-challenge archives hosted on Amazon S…
Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025, was observed in early July 2026 using a custom backdoor for the first time. Kaspersky GERT identified two versions, mqtt-bird-agent 0.1.0 (C2 over the public HiveMQ MQTT broker) and matrix-bird-agent 0.1.0 (C2 over a…
Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from Europea…
Kaspersky identified MovieReaper, a previously unknown modular, multi-stage crimeware framework distributed since mid-August 2026 through movie-themed torrents, including fake "The Odyssey (2026)" releases. Rather than compromising individual trackers, the actor modified the public torrent file repository itorrents.org, so trackers relyin…
In April 2026, Kaspersky GERT responded to an incident at a Middle East manufacturing organization where the actor gained domain admin-equivalent control of Active Directory. The actor created and linked a malicious GPO named PAYLOAD at the domain root. It pushed ransom notes, a wallpaper and lock screen, a logon banner and a local admini…
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
Unit 42 published research showing that an attacker with root access on a compromised Kubernetes node can misuse SPIFFE/SPIRE workload attestation to impersonate co-located workloads and harvest their SVIDs. The attacker spoofs the Linux cgroup information the SPIRE agent uses to identify callers, so the agent issues a victim workload's i…
Unit 42 (Palo Alto Networks) published research on a behavioral clustering model that maps cloud identities to functional roles from audit log activity. The model covered more than 40,000 identities across 125 cloud environments over two months. It groups identities such as administrators, backup services, security tooling and DevOps by t…
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). Tha…
Unit 42 analyzed how AWS neutralizes publicly exposed IAM access keys by automatically attaching the AWSCompromisedKeyQuarantine managed policy, and how that policy has changed since its release on Aug. 11, 2020. The mechanism relies on the GitHub secret scanning partner program, which alerts AWS when long-term keys appear in public repos…
Unit 42 (Palo Alto Networks) released OperTraitor, an open-source, LLM-powered tool that ingests RBAC configurations from installed Kubernetes operators and the OperatorHub catalog. It compares an operator's documented function with its granted privileges and assigns a 1-10 risk score. The research found abandoned, overly permissive opera…
Unit 42 reports that threat actors are moving supply chain malware C2 from hardcoded endpoints to Web3 mechanisms, so an entire botnet or worm infrastructure can be re-pointed with a single blockchain transaction. The ChainDrop npm worm (Shai-Hulud family, 400+ npm packages) and the PolinRider campaign (npm, Go modules, Packagist) target …
In mid-2026, user records allegedly taken from Golf Canada began circulating on Telegram, and Have I Been Pwned added them to its database on 22 Aug 2026. The dataset covers 569k unique email addresses with names, usernames, dates of birth, genders and approximate locations (city, province, postcode). The breach is dated May 2026. It is u…
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including roughly 118k unique email addresses. Have I Been Pwned added the dataset on 18 Oct 2026, with 117.6k affected addresses. The article do…
