|
📺 Google kills 1.3M-device Android botnet
LINK
|
- Google led a takedown that cut off the servers behind a botnet of more than 1.3 million Android devices, mostly TV set-top boxes, which were used for ad fraud and routing strangers' internet traffic.
- Google says Shenzhen maker Videostrong intentionally hid a firmware backdoor called x.cpe that turned off Play Protect, installed apps silently, captured screens and opened remote shells across 206 models in countries led by Malaysia and Brazil.
- Because the backdoor runs as a signed system app, it reinstalls on reboot, so experts tell owners to throw the boxes out; Google banned Videostrong from building certified Android devices and is tightening firmware checks.
|
🇧🇷 Brazil crypto exchange hacked for $46M
LINK
|
- Mercado Bitcoin, a Brazilian crypto exchange, stopped withdrawals and deposits today after hackers stole an estimated $46 million in crypto, calling the pause a precautionary move while it investigates alongside authorities.
- The exchange says customers were unharmed and no data was breached, and it has shared the wallet addresses where stolen funds went so analysts can trace the money as thieves sell off memecoins and altcoins.
- The $46 million loss is small next to last week's Binance hack of over $6 billion, which the US Secret Service is investigating and is believed tied to the North Korea-linked group Trader Traitor.
|
🇨🇳 Chinese hackers used AI in cyberattacks
LINK
|
- Chinese hackers known as Vapor Panda ran an AI tool called ARTEX against more than 200 organizations in 14 countries, hitting government, telecom, pharmaceutical, semiconductor, defense, nuclear, and financial targets since October 17.
- CrowdStrike says the AI agents did reconnaissance, exploited flaws, deployed web shells, and stole credentials, with human operators giving orders in Chinese and telling the agents to skip machines protected by its Falcon endpoint software.
- The attackers used DeepSeek and a second commercial language model to run several break-ins at once, compromising at least nine organizations and burning over 1.4 billion input tokens in one intrusion alone.
|
⚙️ Industrial software flaw spreads Linux malware
LINK
|
- Attackers are abusing a top-severity flaw in Node-RED, a workflow tool used in industrial control systems, to plant a Linux bot by sending a malicious automation flow that runs shell commands automatically once deployed.
- Tracked as CVE-2026-58115 and rated a perfect 10, the bug lets unauthenticated users reach programming nodes on affected Siemens SIMATIC IoT2050 devices; VulnCheck saw active exploitation from a single Brazil-linked IP starting on Friday.
- The scan-and-infect activity hit the Node-RED flaw 16 times and pummeled eight separate CVEs, suggesting opportunistic mass scanning; VulnCheck urges checking internet exposure and applying updates, and added it to its own exploited-bug list.
|
🛒 Magento flaw lets hackers hijack servers
LINK
|
- Attackers are exploiting a Magento and Adobe Commerce flaw called StyleSmuggler (CVE-2026-75650) to run code on online stores, dropping a shell script, a Go remote access trojan called PSK Agent, and a PHP webshell for lasting control.
- The flaw is actively exploited across Europe, North America, and Asia-Pacific through the /paypal/transparent/response/ endpoint, and the dropper script had a 0% detection rate on VirusTotal, letting it slip past file-reputation checks entirely.
- Adobe's VULN-39341 hotfix closes the entry point but won't remove malware planted before patching, so admins should hunt for the dropper, webshell, and fake process names, then rotate all exposed Magento credentials and keys.
|
|
