Google has announced a new security measure that limits access to Android’s accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. Since then, attacks linked to the intrusion set have expanded to target 16 entities across eight Asian countries. The threat actor was first detected in September 2025 in connection with a spear-phishing campaign directed against Taiwan’s academic, think tank, and civil society policy community.
- The cybersecurity company said it found the operation through an unauthenticated Docker registry that’s been publicly accessible since May 2026.
- Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers.
- An analysis of the malware sample has found it to embed exploit logic for various command injectio…
- A new ClickFix campaign is tricking users with a fake Windows update that runs in their browser.
- They are hosted on the legitimate ChatGPT website with the Custom GPT name at the top.
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. Originally marketed as a legitimate remote administration tool, Remcos has evolved into a favored espionage and credential-theft platform for both cybercriminals and initial access brokers. Betting site DraftKings has been accused of using AI to target gamblers likely to lose more after receiving promotions. A list of topics we covered in the week of September 28 to October 4 of 2026 Google has frozen its OSS VRP product vulnerability submissions to stop the flood of AI generated vulnerability reports.
Facebook ads spread fake Windows 11 downloads that steal passwords and crypto wallets Close behind, Stealc posted the single largest weekly jump of the https://www.cocoe.info/category/personal-product-services/page/6/ entire list, up 67 samples to reach 159 total uploads, followed by Vidar at 157 with a smaller rise of six. Xworm followed closely with 183 uploads and a gain of 16, continuing its reputation as a highly adaptable, modular RAT sold through malware-as-a-service channels.
Scaling SOC Capabilities: How Threat Intelligence Cuts Triage Time and Burnout
Black Kite has found that manufacturing remained the most targeted sector for ransomware attacks, and saw a big jump in incidents in H1 2026 CloudSyncD uses a fake Zoom installer to phish Mac passwords and launch a two-stage backdoor Global malware activity climbed sharply over the past week,…
Faster tools are changing the pace, but basic mistakes are still doing plenty of the work. They can hide commands in public infrastructure, reuse old flaws, abuse weak defaults, or let automation stitch together a rough path that still works. Get the 2026 checklist for defending against AI phishing, compromised accounts, and human error.
Revolut phishing texts appear days after data breach
Sucuri has described the malware as a “self-healing mesh” that’s blockchain-controlled. The backdoor has been codenamed SC after the “SC_” markers present in the injected content. So the interesting question this week is not “what broke?
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Prior campaigns have weaponized shared conversations with AI chatbots and malicious Claude Artifacts to distribute stealer malware and remote access trojans (RATs). Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. “Antino is a Rust-compiled Windows backdoor that supports host https://www.seomastering.com/audit/kaspersky.it/ reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading and persistence,” security researcher Ashley Shen said .
More than 70 fake crypto sites promise extra rewards for casting a vote, then prompt https://www.montsec.info/how-to-achieve-maximum-success-with-6/ visitors to connect their wallets. Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.
