Find what you’re looking for
Browse everything
6,844 results in Threat Reports
RemControl Android Banking Malware: New MaaS Platform Targets Europe and Canada
In September 2026, cybersecurity researchers discovered RemControl, a new Android malware-as-a-service (MaaS) platform targeting banking users across Europe and Canada through sophisticated phishing campaigns. The malware impersonates the popular TVTap IPTV application via fake Google Play pages and malvertising campaigns, deploying over 30 banking overlays to steal credentials from financial institutions across Italy, France, Spain, Poland, Portugal, and Canada. RemControl employs advanced evasion techniques including VPN services to block Google Play Protect scans, accessibility service abuse for remote device control, and dynamic C2 infrastructure rotation via Telegram channels. This incident highlights the continued evolution of mobile banking trojans, particularly the integration of AI-assisted development and sophisticated anti-detection mechanisms. The malware's ability to dynamically receive new targets and perform real-time device manipulation represents a significant escalation in mobile banking threats, coinciding with increased regulatory focus on mobile security frameworks.
MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication
In September 2026, attackers exploited the MikroTrick vulnerability chain (CVE-2026-67279 and CVE-2026-86060) to gain full administrative control of internet-exposed MikroTik routers without passwords or SSH keys. The attack combined an SSH state-machine flaw that bypassed authentication with an argument-injection vulnerability in RouterOS login process. Evidence shows active exploitation began September 2, 2026, one day before patches were released, with attackers creating privileged accounts and exfiltrating configuration data from compromised devices. This incident highlights the growing threat to network infrastructure devices as nation-state actors and cybercriminals increasingly target routers and edge devices for persistent access and lateral movement capabilities.
First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware
In September 2026, cybersecurity researchers discovered North Korean threat actors using HashiCorp's Terraform Registry to distribute Go-based malware for the first time. The attackers published four malicious packages across Terraform providers and Go modules, accumulating over 1,600 downloads before detection. The malware employed sophisticated dual command-and-control channels using blockchain dead drops and Slack APIs, with execution triggered only during specific cryptographic operations to avoid detection. This campaign represents an expansion of the previously identified Graphalgo operation, demonstrating DPRK actors' continued evolution of supply chain attack vectors beyond traditional npm and PyPI repositories. This incident highlights the growing sophistication of state-sponsored supply chain attacks as threat actors diversify their distribution channels to target infrastructure-as-code and cloud-native development workflows, making detection and prevention increasingly challenging for organizations.
GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise
In September 2026, Aikido Security disclosed a critical vulnerability in GitLab's email-based issue creation feature that allows attackers to impersonate users and execute unauthorized code commits. The flaw stems from GitLab's private email addresses for filing issues, which contain non-expiring tokens that can be exploited by anyone who obtains them. Attackers can use these leaked addresses to commit code patches to any branch the user has access to, including main branches, and trigger CI/CD jobs that execute with the victim's permissions. The attack bypasses IP restrictions and two-factor authentication, potentially compromising entire development pipelines and supply chains. This incident highlights the growing sophistication of supply chain attacks targeting developer infrastructure and CI/CD environments. As organizations increasingly rely on automated development workflows and DevOps practices, vulnerabilities in platforms like GitLab pose significant risks to software integrity and organizational security posture.
ClickFix Attack Analysis: When Your Logo Becomes the Weapon
ClickFix represents a sophisticated social engineering technique that leverages trusted brand logos and familiar verification prompts to deceive victims into executing malicious commands on their own systems. Unlike traditional malware campaigns, ClickFix attacks require no code injection or exploit delivery - instead, they manipulate users into becoming the attack vector themselves by mimicking legitimate CAPTCHA screens, brand verification pages, and system prompts. These campaigns adapt dynamically to victim operating systems, delivering tailored instructions for Windows or macOS environments, making detection through traditional signature-based methods ineffective. This attack method exemplifies the current shift toward human-centric attack vectors that bypass traditional security controls by exploiting psychological manipulation rather than technical vulnerabilities. As organizations increasingly deploy sophisticated endpoint protection and network security tools, threat actors are pivoting to techniques that leverage the weakest link in most security architectures - human trust and recognition patterns.
Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security
In September 2026, Microsoft successfully disrupted EvilTokens, a sophisticated phishing-as-a-service (PhaaS) platform operated by threat actor Storm-2992. The AI-powered cybercrime service facilitated device code phishing attacks targeting Microsoft 365 accounts, compromising over 12,000 inboxes across 10,000+ organizations worldwide. Microsoft seized 50 websites and disabled 150+ domains, while UK authorities arrested two suspects. EvilTokens distinguished itself by automating device code authentication abuse at scale, using AI to craft tailored phishing lures, analyze compromised inboxes for high-value targets, and streamline business email compromise campaigns sold for $1,500 upfront plus $500 monthly via Telegram. This incident highlights the alarming evolution of phishing-as-a-service platforms leveraging AI to democratize sophisticated attacks. As threat actors increasingly weaponize legitimate authentication mechanisms and AI capabilities, organizations face unprecedented challenges in defending against automated, scalable identity-based attacks that bypass traditional security controls.
Massive Chinese Relay Network Exposed Circumventing US AI Model Controls
In September 2026, Team Cymru researchers discovered a vast network of over 80,000 AI relay servers enabling Chinese users to access frontier AI models from US companies including OpenAI, Anthropic, Google, and xAI while masking their identities and locations. The relay infrastructure allows systematic circumvention of geographic restrictions and terms of service, with evidence suggesting large-scale model distillation attempts. Over an eight-day period, Chinese IP addresses transmitted 14TB of data through relay stations, with particularly suspicious traffic to Anthropic showing a 58:1 upload-to-download ratio consistent with AI model cloning operations. This campaign leverages open-source software packages like Claude Relay Service and sub2api, distributed through GitHub and Telegram channels with thousands of subscribers, pointing to widespread adoption of these circumvention techniques. This incident highlights the growing sophistication of AI intellectual property theft operations and the urgent need for enhanced detection capabilities as nation-state actors increasingly target frontier AI models for competitive advantage.
Dark Sourcery Campaign Exposes Critical Vulnerabilities in Enterprise AI Security
In September 2026, cybersecurity researchers from Vigilance Security uncovered a sophisticated social engineering campaign dubbed 'Dark Sourcery' targeting major AI chatbots including ChatGPT, Google Gemini, and Google AI Overview. Threat actors poisoned these AI systems by flooding the web with carefully crafted malicious content, fake support pages, and fraudulent contact information, tricking the AI into presenting this misinformation as factual responses to users. The campaign compromised at least 374 major companies including Fortune 100 organizations, airlines like Delta and Lufthansa, and financial institutions such as Chase and Bank of America, causing significant reputational damage and enabling widespread phishing attacks. This incident represents a critical evolution in AI-targeted attacks as organizations increasingly integrate AI chatbots and agents into their business operations. With 91% of users blindly trusting AI responses without verification, this attack vector poses an unprecedented threat to enterprise security and user trust in AI systems.
Gulf Cyber Crisis: UAE and Saudi Arabia Under AI-Powered Attack Siege
The United Arab Emirates and Saudi Arabia absorbed 50% of all cyberattacks recorded across the Gulf region in the first half of 2026, with organizations experiencing nearly 2,700 attacks per week compared to the global average of 2,300. The attacks have shifted from highly visible DDoS and website defacements to sophisticated, targeted intrusions focusing on vulnerability exploitation (38% of initial access vectors), stealthy infiltration of critical infrastructure, and data gathering operations. These financially-motivated cybercriminals are leveraging AI tools to accelerate exploit development and target the expanded attack surfaces created by aggressive digital transformation initiatives in both nations. This incident reflects the broader evolution of cyber threats in 2026, where AI-assisted attackers are demonstrating near-autonomous capabilities that can progress faster than traditional defense mechanisms. The emergence of autonomous sandbox breakouts and AI-accelerated vulnerability discovery represents a fundamental shift in the threat landscape, forcing organizations to rethink their cybersecurity strategies beyond conventional perimeter defenses.
ShinyHunters Claims FBI Breach: Zero-Day Attack on Law Enforcement
In September 2026, the ShinyHunters cybercrime group claimed to have breached the FBI's systems using a zero-day vulnerability in Oracle PeopleSoft, allegedly stealing sensitive data on current and former FBI employees and job applicants. The attackers defaced the FBI jobs website and claimed access to Criminal Justice, HR, and Medlink services. This attack was reportedly conducted in retaliation for an FBI public service announcement warning against paying the group's ransom demands following their Canvas LMS attacks in May 2026. This incident highlights the escalating boldness of cybercriminal groups directly targeting law enforcement agencies and exploiting enterprise software vulnerabilities. The targeting represents a significant shift in threat actor behavior, moving beyond traditional corporate victims to challenge government authority directly.
UTA0565 Exploits Chrome-Windows Zero-Day Chain in Sophisticated Campaign Against Asian Governments
In September 2026, Chinese threat actor UTA0565 exploited a zero-day exploit chain targeting Google Chrome and Microsoft Windows vulnerabilities (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) to deploy CLEANGULP malware. The attackers used fake websites masquerading as legitimate media organizations and NGOs to target Asian government entities, particularly through phishing campaigns related to Hong Kong activist Chow Hang-tung. The exploit chain allowed attackers to break out of Chrome's sandbox and achieve remote code execution, demonstrating sophisticated coordinated efforts within the Chinese cyber espionage community. This incident highlights the growing sophistication of state-sponsored actors utilizing coordinated zero-day exploit chains and the increasing targeting of government entities through social engineering campaigns tied to geopolitical events.
F5 BIG-IP OAuth Servers Under Attack: CVE-2026-94127 Zero-Day Analysis
In September 2026, F5 disclosed CVE-2026-94127, a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. The flaw affects systems where APM functions as an OAuth authorization server, with attackers exploiting malicious traffic sent to virtual servers to gain complete system control. F5 released emergency hotfixes after discovering active exploitation, while CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days. This incident highlights the growing threat to network infrastructure components that serve dual roles in authentication and traffic management. As organizations increasingly rely on OAuth-based authentication for cloud and hybrid environments, vulnerabilities in these critical junction points create significant attack surfaces that bypass traditional perimeter defenses.