Cyber Attacks
Hirudo RAT Replaces Eight Indonesian Banking Apps With Malicious Clones
The Android trojan tricks users into uninstalling legitimate financial apps to install modified versions that bypass security checks and steal credentials.
Firewall Scoop Adversary Desk
The Firewall Scoop Adversary Desk is the part of the Firewall Scoop newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware, Threat Intelligence. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 22 articles so far. See the editorial policy or report an error.
Cyber Attacks
DHS Mandates Removal of DeepSeek AI and Affiliates From Civilian Federal IT
Homeland Security orders civilian agencies to purge DeepSeek tools and halt purchases, citing national security risks and data tracking concerns.
Cyber Attacks
Tech Giants Block eMudhra Certificates Linked to 8 Compromised Keys
Major technology companies have blocked certificates from Indian CA eMudhra after discovering eight private keys were compromised, according to Dark Reading.
Cyber Attacks
2 Phishing Domains Mimic Google Meet to Steal 2FA Codes; Exposed DB Passwords Aid Attackers
Threat intelligence reveals two domains hosting phishing pages that mimic Google Meet to harvest login details and two-factor authentication codes from users.
Malware & Ransomware
Six IPs Host ROMULUS Platform for ClickFix Malware Delivery
Researchers identified six servers hosting the ROMULUS platform, which tricks users into running commands that install LegionLoader and other malicious software.
Cyber Attacks
65 Whitepapers Detail Pentagon's ECHOTRIBBLE AI Plan to Neutralize Threats in Air-Gapped Networks
Public documents reveal a Pentagon plan to develop an agentic AI framework designed to navigate infrastructure and neutralize threats across connected and isolated networks.
Cyber Attacks
3 Tampering Windows: Malwarebytes Identifies AOMEI Backdoor Push via Compromised Updates
Compromised update infrastructure pushed malware to AOMEI Backupper users during brief tampering windows in April through July.
Cyber Attacks
33% of Q3 phishing targets Microsoft: Credentials unlock corporate environments
Check Point data shows Microsoft accounted for nearly a third of all brand impersonation attempts in the third quarter, far outpacing Apple and Google.
Cyber Attacks
2 Credential Stealings: Fake WatchGuard Site Forces Re-Entry Before Serving Signed VPN Installer
Huntress found a phishing domain that harvested VPN login details twice before delivering the genuine, signed installer to unsuspecting users.
Cyber Attacks
SideCopy Group Uses LNK Shortcuts to Install ReverseRAT on Windows Systems
Indian authorities warn that the SideCopy hacker group targets organizations with phishing emails that deploy a medium-severity remote access tool via malicious shortcuts.
Cyber Attacks
143 Devices Compromised in Global Proxyjacking Campaign Using Legitimate App
Attackers installed Pawns.app on edge devices across 34 countries to monetize stolen bandwidth through a commercial residential proxy network.
Cyber Attacks
European Bank Breach Exposed by Third-Party VPN Gaps and Brute-Force Attacks
Palo Alto Unit 42 reports how an opportunistic attacker used weak identity controls and noisy scanning to compromise a European bank's internal systems before being contained.
Cyber Attacks
Law enforcement disrupts network behind 1 billion phishing messages
Global takedown hits infrastructure supplying phishing kits and compromised cloud accounts to criminals targeting organizations worldwide.
Cyber Attacks
$30M Crypto Target: GTA 6 Leaker Threatens Full Build, Take-Two Seeks Subpoenas for ID
The hacker behind recent Grand Theft Auto 6 leaks has threatened to release a full playable build if their cryptocurrency reaches a specific valuation.
Cyber Attacks
GhostProfile macOS Malware Clones Browser Profiles for Remote Access
A new macOS implant creates hidden browser clones to steal live sessions, bypassing screen mirroring to control accounts covertly.
Cyber Attacks
The Gentlemen Claims Breach of MoneyGram, Cites 46 Financial Targets This Year
Ransomware group The Gentlemen asserts it accessed MoneyGram systems, though the payment firm has not confirmed the incident or released any stolen data samples for verification.
Cyber Attacks
US Agencies Warn of 58-Page Threat Report Linking ITG to China-Backed Attacks
Federal agencies issued a detailed advisory warning that Chinese-linked actors use Integrity Technology Group to target critical infrastructure and steal data.
Cyber Attacks
Cloudflare Drives 54% of Top Sites to Use Post-Quantum Cryptography
F5 Labs research shows CDN providers are enabling post-quantum key exchange for most major websites, masking lower internal enterprise adoption rates.
Cyber Attacks
Late 2026: Attackers Use ARTEX AI and LLMs to Steal Data From South Korean Banks
CrowdStrike details how attackers abused the ARTEX AI pentesting tool to breach South Korean banks and exfiltrate sensitive data in late 2026.
Cyber Attacks
1 FBI Agent Arrested: ShinyHunters Targeted in Latest Cybercrime Enforcement Move
Federal agents arrested a suspected operative of the ShinyHunters threat group, marking a significant enforcement step against the criminal organization according to Dark Reading.
Malware & Ransomware
Pennsylvania Man Arrested by FBI for Negotiating ShinyHunters Ransom Payments
Federal agents detained a Pennsylvania resident linked to a Canadian firm that negotiated ransom payments, marking a significant step in the ShinyHunters probe.
Cyber Attacks
Microsoft Reveals 3 Lessons on AI-Driven Vulnerability Discovery Expansion From Windows to Linux Kernel
Microsoft Security outlines three key lessons from expanding AI-driven vulnerability discovery from Windows systems to the Linux kernel.