Grandoreiro on DanSec Daily

Cybersecurity Brief – 2026-08-23

Sun, 23 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

A supply-chain attack has compromised Android-based car head units by leveraging a legitimate device-update application to distribute malware. The infected devices are conscripted into a proxy botnet or used for ad fraud operations ^[2].

Newly Discovered Vulnerabilities

Weak access controls on Windows named pipes have been highlighted as a security risk, with the potential for untrusted processes to access privileged services if proper endpoint verification and command authentication are not enforced ^[3].

Notable Threat Actor Activity

Active campaigns involving banking trojans have been observed, including the spyware-equipped Manic trojan, a persistent Grandoreiro campaign targeting Latin America and Europe, and an expanded deployment of ToxicPanda 2.0 malware ^[5].

Regulatory or Policy Developments Affecting the Security Industry

TikTok has agreed to pay a $400 million settlement to resolve a US Department of Justice lawsuit alleging violations of child privacy laws in the United States ^[1].

Sources

Hackers infect Android car head units with proxy botnet malware - bleepingcomputer.com
Named Pipes Under Attack: Securing Windows Interprocess Communication - bleepingcomputer.com
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight - securityweek.com
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit - thehackernews.com

Cybersecurity Brief – 2026-08-21

Fri, 21 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

A database belonging to the people finder service ClarityCheck was found exposed, leaking 9 million images of individuals’ faces ^[57].
Operation CameraSwarm compromised 14,000 Dahua IP cameras across Ukraine and Russia, with a focus on Russian and CIS telecom networks ^[46].
The Grandoreiro banking trojan has resurfaced in a new campaign targeting Mexico, following a previous law enforcement takedown ^[36].
A new Android malware named Manic is actively targeting Ukrainian banks, government, and identity services, as well as Russian and European financial institutions. It can exfiltrate data from offline devices by leveraging nearby infected devices ^[19]^[28].
A critical vulnerability in the Elementor Pro WordPress plugin enables attackers to upload executable files for remote code execution on affected servers ^[24].
A set of 40 malicious Mozilla Firefox extensions, posing as Web3 wallet products, have been identified stealing cryptocurrency wallet secrets ^[22].
A researcher discovered new Android malware distributed via legitimate DoFun head unit software, serving ads and building a proxy botnet ^[1].
A new report indicates that one in four data breaches now involve AI-enabled attacks, marking a 56 percent increase from the previous year ^[3].

Newly Discovered Vulnerabilities

GitLab vulnerability CVE-2026-19478 (CVSS 9.4) is under active exploitation, allowing attackers to exploit affected instances shortly after disclosure ^[6].
Microsoft Entra ID is affected by a critical remote code execution vulnerability (CVSS 10.0) that has been exploited in the wild ^[7].
Malicious versions of three Rust crates, including arrayref, were published after a maintainer account compromise, introducing build-time malware that executed on developers’ systems ^[8]^[23].
A critical vulnerability in the MLflow open-source AI engineering platform is being exploited to steal cloud credentials by allowing HTTP requests to internal endpoints ^[27]^[48].
Citrix NetScaler ADC and NetScaler Gateway are affected by two security flaws, including a critical authentication bypass. Exploitation is expected and admins are urged to patch immediately ^[14]^[26]^[52].
Zimbra Collaboration Suite (ZCS) is being actively exploited via a now-patched critical remote code execution vulnerability ^[15]^[29]^[44].
Atlassian and Splunk have issued patches for dozens of critical and high-severity vulnerabilities that could enable arbitrary code execution, privilege escalation, and data access ^[47].
Cisco has patched critical vulnerabilities in Crosswork and Secure Workload products, which could result in remote code execution, authentication bypass, and path traversal ^[49].
A critical flaw in the isolated-vm open-source JavaScript sandbox allows attackers to escape the sandbox and potentially achieve remote code execution ^[13].
NASA’s AIT-GUI operator console contains a chain of flaws allowing unauthenticated attackers to issue spacecraft commands ^[20].

Notable Threat Actor Activity

Suspected Russian cyber espionage groups have been observed abusing legitimate authentication flows, including Google OAuth and WhatsApp linking, to hijack accounts of individuals in academia, aerospace and defense, government, and NGOs ^[9].
The Head Mare hacktivist group has exploited vulnerabilities in TrueConf software to deploy PhantomCore malware ^[43].
Pakistan-linked threat actor Transparent Tribe has refreshed its toolset for cyberattacks targeting Afghan organizations, with limited success against Indian government agencies ^[35].

Trends, Tools, or Tactics of Interest

AI-generated exploit scripts are being used in active threats targeting US critical infrastructure, specifically Siemens S7 PLCs ^[11].
Attackers are exploiting trusted components, such as signed drivers and legitimate applications, to evade detection and blend malware into environments ^[10]^[53].
The Manic Android malware introduces a fallback data exfiltration mechanism using proximity to other infected devices, enabling data theft even from offline phones ^[19]^[28].
The ToxicPanda 2.0 and GoldDigger Android banking malware families have expanded their capabilities to include on-device fraud and a broader set of remote commands ^[21].
Researchers have demonstrated a “Zombie Card” attack that revives expired Visa contactless cards for in-store purchases by rewriting expiration data at the point of sale ^[16].
Two new denial-of-service (DoS) attacks exploit how major CDNs translate HTTP/3 to HTTP/1.1, resulting in amplification up to 350 times ^[18].
AI is increasingly being leveraged to personalize phishing attacks, making them harder for traditional email filters to detect ^[25].
The CUSTODY framework has been released to constrain AI agents in enterprise networks, following OpenAI-related incidents ^[31].
OpenAI has overhauled model security with new features such as sandboxing, 30-minute alerting, and training pauses in response to recent security incidents ^[51].

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued warnings and urged immediate patching for actively exploited vulnerabilities in MLflow and TrueConf ^[27]^[43].
Twitch has introduced an opt-out option for users who do not want their content used for Amazon AI training ^[55].

Sources

9 million images of people’s faces exposed by reverse lookup service - malwarebytes.com
Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia - securityweek.com
'Grandoreiro' Malware Resurfaces With Mexico Campaign - darkreading.com
Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices - thehackernews.com
New Manic Android malware can exfiltrate data through nearby devices - bleepingcomputer.com
Critical Elementor Pro bug exposes WordPress sites to RCE attacks - bleepingcomputer.com
40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets - thehackernews.com
The invisible passenger in your car - securelist.com
Report: One-Quarter of Breaches Are Enabled by AI-Driven Attacks - blog.knowbe4.com
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure - thehackernews.com
Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution - thehackernews.com
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads - thehackernews.com
Hackers poison arrayref Rust crate to push infostealer malware - bleepingcomputer.com
CISA warns of hackers exploiting critical MLflow vulnerability - bleepingcomputer.com
MLflow Vulnerability Exploited for Cloud Credential Theft - securityweek.com
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers - thehackernews.com
Citrix urges admins to patch new NetScaler flaws as soon as possible - bleepingcomputer.com
Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler - securityweek.com
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution - thehackernews.com
Critical Zimbra RCE flaw now actively exploited in attacks - bleepingcomputer.com
Hackers Target Zimbra Servers in Active Exploitation Campaign - securityweek.com
Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities - securityweek.com
Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities - securityweek.com
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE - thehackernews.com
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands - thehackernews.com
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts - thehackernews.com
CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities - securityweek.com
Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks - darkreading.com
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure - thehackernews.com
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More - thehackernews.com
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - research.checkpoint.com
ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud - thehackernews.com
Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments - thehackernews.com
CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification - thehackernews.com
How MSPs can catch phishing attacks email filters miss - bleepingcomputer.com
New CUSTODY Framework Constrains AI Agents Inside the Network - darkreading.com
OpenAI Overhauls Model Security With Sandboxing, 30-Minute Alerts, and Training Pauses - securityweek.com
Twitch wants your content for Amazon AI training. Here’s how to opt out - malwarebytes.com

Cybersecurity Brief – 2026-05-28

Thu, 28 May 2026 00:00:00 +0000

Major Incidents or Breaches

The GlassWorm malware botnet, which targeted developers via software supply-chain attacks and relied on resilient command-and-control infrastructure using the Solana blockchain, has been disrupted through a coordinated takedown by CrowdStrike, Google, and the Shadowserver Foundation. All C2 channels associated with GlassWorm were taken down^[11]^[16]^[37].
The FBI has issued a warning that the Silent Ransom Group (SRG) extortion gang is targeting US-based law firms with in-person data theft attacks, involving physical intrusion and social engineering to gain access to sensitive data^[17]^[21].
A 35-year-old suspect was arrested by Dutch police in connection with the hacking of the professional football club Ajax Amsterdam earlier this year^[19].
A data breach in Uruguay has reportedly exposed 5.8 million records of citizens, attributed to cybercriminals targeting government agencies to monetize citizen data^[22].
The LA Metro cyberattack has been linked to Iranian state-sponsored hackers, despite claims of responsibility by a hacktivist group. Forensic analysis showed the use of infrastructure tied to the Iranian government^[38].

Newly Discovered Vulnerabilities

A security flaw in Gitea, an open-source version control platform, allows unauthenticated remote attackers to pull private container images, exposing sensitive data from self-hosted repositories^[13].
Researchers discovered an account takeover vulnerability in the open source CFP management tool Pretalx, which enabled attackers to guarantee acceptance of all submitted talks^[30].
A malicious npm package named “mouse5212-super-web” was found to steal files from directories associated with Claude AI users via GitHub, indicating a supply chain risk in the npm registry^[9].
CISA has mandated US federal agencies to patch a critical vulnerability in the LiteSpeed cPanel user-end plugin within four days, due to evidence of active exploitation^[18].

Notable Threat Actor Activity

Cybercrime groups have continued to exploit fans of pirated books, movies, and TV shows by infecting popular piracy sites with malware, including miners and remote access trojans, affecting tens of millions of users^[1].
The ShinyHunters and BlackFile extortion groups are utilizing automated phishing kits, with over 400 domains linked to their attacks, enabling large-scale, efficient credential harvesting and extortion operations^[6].
Two banking trojan campaigns, Grandoreiro and BTMOB RAT, are actively targeting Windows and Android users in Latin America and Europe, aiming to steal credentials and perform remote access attacks^[8].
Threat actors are distributing GPU mining malware through coordinated SEO poisoning campaigns and by manipulating AI chatbot recommendations, targeting systems with high-performance computing resources for cryptojacking^[14].
Phishing campaigns are abusing Adobe Target to track victims and steal LinkedIn credentials by redirecting users to legitimate LinkedIn pages after harvesting their information^[41].
The Kali365 phishing kit is being used by attackers to bypass multi-factor authentication and steal Microsoft Outlook, Teams, and OneDrive credentials, enabling persistent access to victim accounts^[39].
A new attack technique dubbed “SymJack” leverages malicious repositories and disguised symlinks to trick AI coding agents into installing attacker-controlled servers, compromising CI pipelines and stealing secrets in supply chain attacks^[36].

Trends, Tools, or Tactics of Interest

Attackers are increasingly using AI to accelerate exploit development, reducing the time required to weaponize vulnerabilities and outpacing the detection capabilities of traditional scanners^[23].
There is a documented rise in the use of deepfakes and sophisticated deception techniques in social engineering attacks, making it harder for individuals to discern legitimate communications^[2].
Geopolitical events, such as tensions involving Iran, are being leveraged to fuel social engineering campaigns, with attackers exploiting global conflict narratives to increase the success of their lures^[4].
The use of phishing kits to automate attacks, including adversary-in-the-middle (AiTM) techniques, is enabling extortion groups to efficiently bypass authentication mechanisms and harvest credentials at scale^[6]^[39].
Credential theft remains a critical threat, with AI-driven phishing, session hijacking, and abuse of stolen credentials undermining modern security controls^[35].
AI chatbots are being manipulated both for distributing malware and as vectors for social engineering, including recommending malicious downloads and providing inaccurate or dangerous health advice, raising privacy and security concerns^[7]^[14].
The cybersecurity industry is witnessing a shift from traditional perimeter defense to AI-native security approaches, adapting to new challenges posed by AI-driven threats^[24].
Security researchers are using AI models, such as BinNet, to hunt for vulnerabilities and backdoors in software binaries, reflecting the growing adoption of AI in both offensive and defensive security operations^[32].

Regulatory or Policy Developments Affecting the Security Industry

The UK’s cyberspying chief has warned that AI is becoming an unstoppable force and highlighted increased hostile activity from Russia in the cyber “gray zone” below the threshold of open conflict^[29].
CISA’s directive requiring rapid patching of actively exploited vulnerabilities in federal systems underscores the regulatory focus on timely remediation of critical security flaws^[18].

Sources

GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure - thehackernews.com
Glassworm botnet disrupted after resilient C2 infrastructure takedown - bleepingcomputer.com
GlassWorm Botnet Disrupted - securityweek.com
FBI warns of in-person data theft attacks from extortion gang - bleepingcomputer.com
Ransomware Actors Show Up In Person to Steal Law Firm Data - darkreading.com
Dutch police arrests suspect linked to Ajax football club hack - bleepingcomputer.com
Latin American Cybercriminals Hoover Up Government Data - darkreading.com
LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers - securityweek.com
Gitea Vulnerability Exposes Private Container Images without Authentication - thehackernews.com
Vulnerability in Popular Conference Software Granted Attackers a 100% Talk Acceptance Rate - securityweek.com
Malicious npm Package Stole Files From Claude AI User Directory via GitHub - thehackernews.com
CISA gives feds 4 days to patch actively exploited cPanel plugin flaw - bleepingcomputer.com
Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years - securelist.com
Alert: Extortion Groups Are Using Phishing Kits to Automate Their Attacks - blog.knowbe4.com
Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users - thehackernews.com
GPU mining malware spreads via SEO poisoning, AI chatbots - bleepingcomputer.com
Fake LinkedIn emails abuse Adobe to track victims - malwarebytes.com
Kali365 phishing kit bypasses MFA and steals Microsoft logins - malwarebytes.com
‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems - securityweek.com
AI-Assisted Exploit Development Outpaces Scanner Detection - darkreading.com
Perry Carpenter KB4-CON 2026 Q&A: Deepfakes & Deception - blog.knowbe4.com
When Global Conflict Becomes a Cyber Weapon: How Iran Tensions and Other Stressful Events Fuel Social Engineering Attacks - blog.knowbe4.com
The Credential Crisis: How Stolen Credentials Defeat Modern Security - securityweek.com
What to consider before asking an AI chatbot for health advice - welivesecurity.com
Cybersecurity Evolution: How We Went From Perimeter Defense to AI-Native Security - darkreading.com
RevEng.AI Raises $15 Million to Hunt for Flaws and Backdoors in Software Binaries - securityweek.com
UK Cyberspying Chief Calls AI ‘an Unstoppable Force’ and Warns About Russia - securityweek.com