ZeroDayRAT: Commercial spyware kit offers comprehensive remote control of Android and iOS devices
Read Our Expert Analysis
Create an account or login for free to unlock our expert analysis and key takeaways for this development.
By continuing, you agree to receive marketing communications and our weekly newsletter. You can opt-out at any time.
Recommended for you
Malware Campaign Used Hugging Face to Host Android RAT Payloads
Security researchers discovered an Android remote-access Trojan distributed via a dropper that redirected victims to Hugging Face-hosted payloads. The campaign used short-lived repositories and frequent payload updates to evade takedowns while abusing a popular model-sharing platform as a file host.
Coruna Toolkit: iPhone Zero-days Move into Criminal Markets
The Coruna exploit toolkit — a polished WebKit chain targeting iOS 13–17.2.1 — has appeared beyond government channels in a criminalized, modular form and likely reached tens of thousands of devices. Evidence suggests operators bought or re-hosted turnkey control panels and distribution builders (messaging/phishing), increasing resilience to takedown and raising urgency for emergency patches, telemetry hunts, and procurement controls for offensive tooling.
APT37 expands toolkit to pierce air gaps using removable media and cloud C2
Zscaler observed a December 2025 APT37 campaign that combined five newly identified modules — including a memory‑resident loader, a backdoored interpreter runtime, a USB relay spreader and an Android surveillance app — to pierce air‑gapped enclaves while using a mainstream cloud storage service for command-and-control. Defenders should couple stricter removable‑media controls with identity‑first telemetry and cross‑service signal fusion; platform takedowns help but do not eliminate the underlying tradecraft.
CrashFix: Chrome extension that forces browser crashes to deliver ModeloRAT targets corporate networks
A malicious Chrome add-on masquerading as an ad blocker deliberately destabilizes the browser to trick users into running clipboard-pasted commands that install a Python-based remote access trojan. The campaign, attributed to an actor tracked as KongTuke and active since early 2025, focuses on domain-joined machines in corporate environments and uses a timed denial-of-service loop to sustain the social-engineering lure.
CrowdStrike: AI-Driven Attacks Surge and Collapse Detection Windows
CrowdStrike reports an 89% rise in AI-enabled attacks and an average breakout time of 29 minutes (fastest observed: 27 seconds). Independent industry reporting (IBM, Amazon, vendor incident timelines) shows related but differently scoped increases — compressed exploit windows, automated reconnaissance campaigns that commandeered hundreds of perimeter devices, and rapid moves from disclosure to active targeting — underscoring an urgent need for cross-source telemetry, identity-first controls, and faster containment playbooks.
North Korea-linked hackers deploy AI deepfakes and new malware against crypto and fintech firms
Security researchers attribute a recent surge of tailored intrusions against cryptocurrency, fintech and venture firms to a North Korea-linked cluster that combined AI-generated deepfakes with social engineering to deliver seven distinct malware families. The campaign introduced multiple novel data-harvesting tools, leveraged automated reconnaissance and trusted collaboration channels, and highlights parallel risks from exposed AI endpoints and unvetted plugin ecosystems that amplify attacker scale.
Dutch intelligence warns Russian campaign targeting Signal and WhatsApp
Dutch intelligence agencies alert that Russian-linked actors are employing support-chat impersonation to harvest recovery codes and PINs for Signal and WhatsApp , while separate Russian notices and provider actions underline a broader pattern: adversaries exploit both account-recovery flows and metadata, and defensive throttling or authentication measures can themselves produce short-term operational disruptions.
Massive 149M credential trove exposes risks from infostealer malware to crypto and government accounts
A researcher found a publicly accessible collection of roughly 149 million stolen logins harvested by credential-stealing malware, including hundreds of thousands tied to major crypto platforms and numerous government-related accounts. The exposure stems from infected end-user devices rather than platform breaches, but it raises urgent questions about account hygiene, phishing risk, and detection across the crypto and social-media ecosystems.