Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns.
Public sector CISOs need to grapple with challenges brought about by AI threats: up to 3,600 AI CVEs in 2026, autonomous ransomware, and critical infrastructure risk.
Three questions can help reveal your AI security maturity. Hear expert perspectives and explore the pathway to governance in a series of short video conversations.
ShinyHunters is once again exploiting a previously patched vulnerability in PeopleSoft, which we analyzed in June 2026.
Quais táticas os hackers de contas do Instagram usam? O que esses cibercriminosos fazem com contas roubadas? Como os usuários podem proteger suas contas? Analisamos incidentes de hacking de contas do Instagram do ponto de vista de um pesquisador de segurança e compartilhamos recomendações para usuários do Instagram e de outras plataformas de mídia social.
We discovered vulnerabilities in the SHAREit application. These vulnerabilities can be abused to leak a user’s sensitive data, execute arbitrary code, and possibly lead to remote code execution. The app has over 1 billion downloads.
Further investigation led us to a developer’s Xcode project that contained XCSSET source malware, which leads to a rabbit hole of malicious payloads. Most notable in our investigation is the discovery of two zero-day exploits.
Descobrimos um malware Bashlite atualizado, projetado para adicionar dispositivos infectados da internet das coisas a uma botnet de negação de serviço distribuída (DDoS). Com base no módulo Metasploit que explora, o malware tem como alvo dispositivos com a API WeMo UPnP.
We discovered several beauty camera apps (detected as AndroidOS_BadCamera.HRX) on Google Play that are capable of accessing remote ad configuration servers that can be used for malicious purposes. Some of these have been downloaded millions of times.
BLADABINDI’s customizability and seeming availability in the underground make it a prevalent threat. Last week, we came across a worm (Worm.Win32.BLADABINDI.AA) that propagates through removable drives and installs a fileless version of BLADABINDI.
Conforme os usuários começam a procurar por aplicativos e outros serviços de seus bancos, as oportunidades para golpistas também aumentam. Um exemplo recente disso é o aplicativo Movil Secure, parte de um esquema de SMiShing que tem como alvo usuários de língua espanhola.
A new variant of Android Remote Access Tool can inject root exploits to perform malicious tasks such as silent installation, shell command execution, WiFi password collection, and more. It targets CVE-2015-1805, a vulnerability disclosed in 2016.
On January 24, 2018, we observed that the number of Coinhive web miner detections tripled due to a malvertising campaign. Attackers seem to have abused Google’s DoubleClick, which provides internet ad serving services, for traffic distribution.
A new cryptocurrency-mining bot is spreading through Facebook Messenger. We named this Digmine based on the moniker (비트코인 채굴기 bot) it was referred to in a report of recent related incidents in South Korea.
5 de outubro de 2026
5 min read
