Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns.
Public sector CISOs need to grapple with challenges brought about by AI threats: up to 3,600 AI CVEs in 2026, autonomous ransomware, and critical infrastructure risk.
Three questions can help reveal your AI security maturity. Hear expert perspectives and explore the pathway to governance in a series of short video conversations.
ShinyHunters is once again exploiting a previously patched vulnerability in PeopleSoft, which we analyzed in June 2026.
¿Qué tácticas utilizan los hackers de cuentas de Instagram? ¿Qué hacen estos ciberdelincuentes con las cuentas robadas? ¿Cómo pueden los usuarios proteger sus cuentas? Analizamos los incidentes de hackeo de cuentas de Instagram desde la perspectiva de un investigador de seguridad y compartimos recomendaciones para los usuarios de Instagram y otras plataformas de redes sociales.
We discovered vulnerabilities in the SHAREit application. These vulnerabilities can be abused to leak a user’s sensitive data, execute arbitrary code, and possibly lead to remote code execution. The app has over 1 billion downloads.
Further investigation led us to a developer’s Xcode project that contained XCSSET source malware, which leads to a rabbit hole of malicious payloads. Most notable in our investigation is the discovery of two zero-day exploits.
Descubrimos un malware Bashlite actualizado diseñado para agregar dispositivos de internet de las cosas infectados a una botnet de denegación de servicio distribuido (DDoS). Basado en el módulo Metasploit que explota, el malware apunta a dispositivos con la API UPnP de WeMo.
We discovered several beauty camera apps (detected as AndroidOS_BadCamera.HRX) on Google Play that are capable of accessing remote ad configuration servers that can be used for malicious purposes. Some of these have been downloaded millions of times.
BLADABINDI’s customizability and seeming availability in the underground make it a prevalent threat. Last week, we came across a worm (Worm.Win32.BLADABINDI.AA) that propagates through removable drives and installs a fileless version of BLADABINDI.
A medida que los usuarios comienzan a buscar aplicaciones y otros servicios de sus bancos, también aumentan las oportunidades para los estafadores. Un ejemplo reciente de esto es la aplicación Movil Secure, parte de un esquema de SMiShing dirigido a usuarios de habla hispana.
A new variant of Android Remote Access Tool can inject root exploits to perform malicious tasks such as silent installation, shell command execution, WiFi password collection, and more. It targets CVE-2015-1805, a vulnerability disclosed in 2016.
On January 24, 2018, we observed that the number of Coinhive web miner detections tripled due to a malvertising campaign. Attackers seem to have abused Google’s DoubleClick, which provides internet ad serving services, for traffic distribution.
A new cryptocurrency-mining bot is spreading through Facebook Messenger. We named this Digmine based on the moniker (비트코인 채굴기 bot) it was referred to in a report of recent related incidents in South Korea.
5 de octubre de 2026
5 min read
