oneplus

Cybersecurity researchers have discovered half-a-dozen new Android malware families that come with capabilities to steal data from compromised devices and conduct financial fraud. The Android malware range from traditional banking trojans like PixRevolution, TaxiSpy RAT, BeatBanker, Mirax, and Oblivion RAT to full-fledged remote administration tools such as SURXRAT. PixRevolution, according to Zimperium, targets Brazil's Pix instant payment platform, hijacking victims' money transfers in real-time to route them to the threat actors instead of the intended payee. "This new strain of malware operates stealthily within the device until the moment the victim initiates a Pix transfer," security researcher Aazim Yaswant said. "What distinguishes this threat from conventional banking trojans is its fundamental design: a human or AI agent operator is actively engaged on the remote end, observing the victim's phone screen instantaneously, poised to act at the precise moment of transaction." The Android malware propagates via fake Google Play Store app listing pages for apps like Expedia, Sicredi, and Correios to trick users into installing the malicious dropper APK files. Once installed, the apps urge users to enable accessibility services to realize their goals. It also connects to an external server over TCP on port 9000 to send periodic heartbeat messages containing device information and activate real-time screen capture using Android's MediaProjection API. The main functionality of PixRevolution, though, is the monitoring of the victim's screen and serving a fake overlay as soon as a victim enters the desired amount and the Pix key of the recipient to initiate the payment. At that point, the trojan shows a fake WebView overlay that says "Aguarde..." (meaning "wait" in Portuguese/Spanish), while, in the background, it edits the Pix key with that of the attacker's to complete the funds transfer. In the final stage, the overlay is removed, and the victim is displayed a "transfer complete" confirmation screen in the Pix app. "From the victim's perspective, nothing unusual happened," Yaswant said. "The app briefly showed a loading indicator, something that occurs routinely during legitimate banking operations. The transfer was confirmed successfully. The amount they intended to send was deducted from their account." "It is only later, sometimes much later, that the victim discovers the money went to the wrong account. And because Pix transfers are instant and final, recovery is extraordinarily difficult." Brazilian users have also become the target of another Android‑based malware campaign called BeatBanker, which spreads primarily through phishing attacks via a website disguised as the Google Play Store. BeatBanker gets its name from the use of an unusual persistence mechanism that involves playing an almost inaudible audio file, a 5-second recording featuring Chinese words, on a loop to prevent it from being terminated. Besides incorporating runtime checks for emulated or analysis environments, the malware monitors battery temperature and percentage, and verifies whether the user is using the device to start or stop the Monero miner as required. It uses Google's Firebase Cloud Messaging (FCM) for command‑and‑control (C2). "To achieve their goals, the malicious APKs carry multiple components, including a cryptocurrency miner and a banking trojan capable of completely hijacking the device and spoofing screens, among other things," Kaspersky said. "When the user tries to make a USDT transaction, BeatBanker creates overlay pages for Binance and Trust Wallet, covertly replacing the destination address with the threat actor's transfer address." The banking module also monitors web browsers like Chrome, Edge, Firefox, Brave, Opera, DuckDuckGo, Dolphin Browser, and sBrowser to URLs accessed by the victim. In addition, it supports the ability to receive a long list of commands from the server to collect personal information and gain complete control of the device. Recent iterations of the campaign have been found to drop BTMOB RAT instead of the banking module. It provides operators with comprehensive remote control, persistent access, and surveillance over compromised devices. BTMOB is assessed to be an evolution of CraxsRAT, CypherRAT, and SpySolr families, all of which have been linked to a Syrian threat actor who goes by the online alias EVLF. "We also saw the distribution and sale of leaked BTMOB source code on some dark web forums," the Russian security vendor said. "This may suggest that the creator of BeatBanker acquired BTMOB from its original author or the source of the leak and is utilizing it as the final payload." TaxiSpy RAT, similar to PixRevolution, abuses Android's accessibility service and MediaProjection APIs to collect SMS messages, contacts, call logs, clipboard contents, installed apps list, notifications, lock screen PINs, and keystrokes, as well as target Russian banking, cryptocurrency, and government apps by serving overlays to conduct credential theft. The malware combines traditional banking trojan functionality with full RAT capabilities, enabling threat actors to gather sensitive data and execute commands sent via Firebase push messages. Several TaxiSpy samples have been discovered by both CYFIRMA and Zimperium, indicating active efforts on the part of attackers to evade signature-based detection and blacklist defenses. "The malware leverages advanced evasion techniques, such as native library encryption, rolling XOR string obfuscation, and real-time VNC-like remote control via WebSocket," CYFIRMA said. "Its design allows comprehensive device surveillance, including SMS, call logs, contacts, notifications, and banking app monitoring, highlighting its financially motivated and region-specific focus." Another Android banking trojan of note is Mirax, which has been advertised by a threat actor named Mirax Bot as a private malware-as-a-service (MaaS) offering for a monthly price of $2,500 for a full version or $1,750 for a light variant. Mirax claims to offer banking overlays, information gathering (e.g., keystrokes, SMS, lock patterns), and a SOCKS5 proxy to route malicious traffic through compromised devices. Mirax is not the only Android MaaS offering detected in recent months. A new Android remote access trojan called Oblivion is being sold for around $300 per month (or $1,900 per year and $2,200 for lifetime access) and claims to bypass detection and security features on devices from major manufacturers. Once installed, the malware employs an automated permission-granting mechanism that requires no interaction from the victim. This approach, per the seller, works across MIUI / HyperOS (Xiaomi), One UI (Samsung), ColorOS (OPPO), MagicOS (Honor), and OxygenOS (OnePlus). "What sets it apart isn't any single feature. It's the combination: automated permission bypass, hidden remote control, deep persistence, and a point-and-click builder that puts all of it within reach of would-be hackers with even the most minimal level of technical skill," Certos said. "Google has made progressive restrictions on accessibility service abuse a priority across successive Android versions. A tool that credibly bypasses those protections on the latest release – and does so across devices from Samsung, Xiaomi, OPPO, and others – represents a genuine challenge to platform-level defenses." Also commercially distributed through a Telegram-based MaaS ecosystem is an Android malware family called SURXRAT, which is assessed to be an improved version of Arsink. The malware abuses accessibility permissions for persistent control and communicates with a Firebase-based C2 infrastructure to commandeer infected devices. The malware is marketed on a Telegram channel managed by an Indonesian threat actor. What's notable about some of the new samples is the presence of a large language model (LLM) component, indicating that the threat actors behind the malware are experimenting with artificial intelligence (AI) capabilities, along with traditional surveillance. That said, the download of the LLM module is triggered only when specific gaming applications are active on the victim's device, or when it receives alternative target package names dynamically from the server - Free Fire MAX x JUJUTSU KAISEN (com.dts.freefiremax) Free Fire x JUJUTSU KAISEN (com.dts.freefireth) Select SURXRAT samples also incorporate a ransomware-style screen locker module that makes it possible for a remote operator to hijack control of a victim's device and deny access by displaying a full-screen lock message until a payment is made. "This evolution highlights how existing Android RAT frameworks continue to be repurposed and expanded by threat actors, accelerating malware development cycles and enabling rapid introduction of new surveillance and control functionalities," Cyble said. "The observed experimentation with large AI model integration further indicates that threat actors are actively exploring emerging technologies to enhance operational effectiveness and evade detection."

Kali Linux 2025.4: New tools and “quality-of-life” improvements OffSec has released Kali Linux 2025.4, a new version of its widely used penetration testing and digital forensics platform. Most of the changes are related to appearance and usability: Kali’s GNOME desktop environment now organizes Kali tools into folders via the app grid, and there’s a shortcut for opening a terminal window Its KDE Plasma desktop enviroment now comes with a new screenshot tool with added editing features, offers quick access to pinned clipboard items, and its search/launch tool now correctly identifies which app you wanted to open even if you misspell its name Its Xfce desktop environment gets supports for color themes As per usual, new versions of Kali come with new tools. In v2025.4, those are: bpf-linker, a tool for statically linking multiple BPF object files together and perform optimizations needed to target older kernels evil-winrm-py, a Python-based tool for executing commands on remote Windows machines using the Windows Remote Management protocol, and hexstrike-ai, an MCP server that lets AI agents autonomously run tools Kali NetHunter – the mobile mobile penetration testing platform – now supports: Samsung Galaxy S10, S10e, S10 Plus, and S10 5G running LineageOS 23 OnePlus Nord running Android 16 Xiaomi Mi 9 running Android 15 Finally, like the Kali Everything image (which contains all Kali tools), the Kali Live image – a bootable version of Kali Linux that lets you run the operating system directly from a USB drive or DVD without installing it on your computer – is now downloadable only via BitTorrent, because of its increased size. Other Kali Linux 2025.4 images can be downloaded here. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

SecurityWeek’s cybersecurity news roundup provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape. Each week, we curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports. Here are this week’s stories: US Department of War unveils new cybersecurity framework The Department of War has announced a new Cybersecurity Risk Management Construct (CSRMC) to modernize its cyber defenses. The CSRMC is a five-phase, ten-tenet framework that replaces manual processes with a dynamic, automated approach to ensure continuous monitoring and real-time defense. The goal is to embed cybersecurity into every stage of system development and operations for the technological superiority of warfighters against evolving threats. Dragos unveils major platform update ICS/OT cybersecurity firm Dragos has announced Dragos Platform 3.0, a major update that delivers new capabilities to empower defenders to act faster and more confidently. The updated platform brings a new Insights Hub for consolidating alerts, streamlined workflows, AI-enhanced vulnerability processes, and smaller footprint deployment options. 3 million impacted by hack at South Korean credit card company South Korean credit card company Lotte Card was recently targeted in a hacker attack that resulted in the information of nearly three million people being compromised. The stolen data includes information such as resident registration numbers, virtual payment codes and, in the case of 280,000 customers, highly sensitive card information that can be used for fraud. LockBit 5.0 Following a law enforcement crackdown on the LockBit ransomware operation, cybercriminals recently announced the release of LockBit 5.0. Trend Micro researchers have analyzed LockBit 5.0, including the Windows, Linux and ESXi variants of the ransomware. The security firm noted that the new variants use randomized 16-character file extensions, are configured to avoid Russian-language systems, and clear event logs after encryption. Maryland Transit Administration targeted by ransomware group The Maryland Transit Administration (MTA) has disclosed a cybersecurity incident that involved unauthorized access to some of its systems. The incident resulted in some online services being disrupted and the MTA confirmed that some data was stolen in the attack. The Rhysida ransomware group took credit for the attack. Vulnerability affecting OnePlus smartphones disclosed without patch Rapid7 has disclosed the technical details of a vulnerability affecting OnePlus smartphones after it was not able to responsibly report its findings to the vendor. The security hole (CVE-2025-10184) impacts OxygenOS and it can allow a malicious app to read SMS/MMS data and metadata without any user interaction, potentially exposing MFA codes. After Rapid7 published a blog post describing its findings, OnePlus told the security firm that it’s investigating the issue. Microsoft says AI detected AI-aided phishing campaign Microsoft says its AI-powered security systems were able to detect and block a phishing campaign that leveraged AI to obfuscate a payload in an effort to evade defenses. An analysis of the malicious code by Microsoft’s Security Copilot revealed that the code was “not something a human would typically write from scratch due to its complexity, verbosity, and lack of practical utility.” Over 270,000 Indian bank transfer records exposed Researchers at UpGuard discovered an unprotected Amazon S3 storage bucket containing more than 270,000 documents, each detailing a money transfer pertaining to one of 38 Indian banks. The exposed information included bank account numbers, transaction amounts, names, phone numbers, and email addresses. UpGuard has not been able to determine the source of the leak. Co-op lost £206 million in sales due to cyberattack Co-op reported this week that the recent cyberattack has cost it £206 million ($275 million) in lost sales. The cyberattack resulted in a data breach impacting the information of 6.5 million members. The disruptions caused by the incident led to digital payment issues and empty store shelves. Marks & Spencer, which was targeted in the same attack, estimated in May that the incident would cost it £300 million (roughly $400 million).

Welcome to this week’s Threatsday Bulletin—your Thursday check-in on the latest twists and turns in cybersecurity and hacking. The digital threat landscape never stands still. One week it’s a critical zero-day, the next it’s a wave of phishing lures or a state-backed disinformation push. Each headline is a reminder that the rules keep changing and that defenders—whether you’re protecting a global enterprise or your own personal data—need to keep moving just as fast. In this edition we unpack fresh exploits, high-profile arrests, and the newest tactics cybercriminals are testing right now. Grab a coffee, take five minutes, and get the key insights that help you stay a step ahead of the next breach. Firmware fights backSonicWall has released a firmware update that it said will help customers remove rootkit malware deployed in attacks targeting SMA 100 series devices. "SonicWall SMA 100 10.2.2.2-92sv build has been released with additional file checking, providing the capability to remove known rootkit malware present on the SMA devices," the company said. "SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the 10.2.2.2-92sv version." The update comes after a report from Google that found a threat actor tracked as UNC6148 deploying OVERSTEP malware on end-of-life (EoL) SonicWall SMA 100 devices. SonicWall has also disclosed that expediting the end-of-support (EoS) date for all SMA 100 devices to October 31, 2025, citing "significant vulnerabilities presented by legacy VPN appliances." Texts laid bareA permission bypass vulnerability (CVE-2025-10184, CVSS score: 8.2) has been discovered in multiple versions of OnePlus OxygenOS installed on its Android devices. The shortcoming has to do with the fact that sensitive internal content providers are accessible without permission, and are vulnerable to SQL injection. "When leveraged, the vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider (the package com.android.providers.telephony) without permission, user interaction, or consent," Rapid7 said. "The user is also not notified that SMS data is being accessed." Successful exploitation of the flaw could lead to the theft of sensitive information, such as multi-factor authentication (MFA) codes sent as SMS messages. The issue appears to have been introduced as part of OxygenOS 12, released in 2021. The vulnerability remains unpatched as of writing, but OnePlus has acknowledged it's investigating the issue. Stop Guessing, Start SecuringJoin this session to discover why code-to-cloud visibility is fast becoming the cornerstone of modern Application Security Posture Management (ASPM). You’ll see how mapping risks from where they originate in code to where they surface in the cloud unites development, DevOps, and security teams, enabling sharper prioritization, tighter feedback loops, and faster remediation—before attackers can exploit the weak link. GeoServer hole exploitedThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a comprehensive cybersecurity advisory detailing how threat actors successfully compromised a U.S. federal civilian executive branch agency's network on July 11, 2024, by exploiting CVE-2024-36401, a critical remote code execution vulnerability in GeoServer. "Over the three-week period, the cyber threat actors gained separate initial access to a second GeoServer via the same vulnerability and moved laterally to two other servers," the agency said. Once compromised, the attackers uploaded (or attempted to upload) web shells such as China Chopper, along with scripts designed for remote access, persistence, command execution, and privilege escalation. The cyber threat actors also used living-off-the-land (LotL) techniques for user, service, filesystem, and network discovery, while relying on tools like fscan, dirtycow, and RingQ for network reconnaissance, privilege escalation, and defense evasion, respectively. SIM-swapping secrets spillLast week, three members of the notorious cybercrime group Scattered Spider were arrested. The arrests came close on the heels of the crew announcing that it was shuttering its operations. The group, composed of primarily English-speaking teenagers, are known to carry out hacking sprees using advanced social engineering tactics to breach high-profile companies, steal data, and extort them. Earlier this year, Noah Urban, a 20-year-old linked to the notorious group, pled guilty to his cybercrime charges and agreed to pay millions in restitution. In a report published last week, Bloomberg revealed his critical role as a caller, talking people into unwittingly giving them access to sensitive computer systems by installing remote access tools. He also said he found a SIM-swapping group through Minecraft, the leader of which paid him $50 each time a call resulted in a cryptocurrency theft. Urban also said one of the collaborators, Daniel Junk, figured out a way to access T-Mobile's customer service portal by registering his personal computer to its corporate network and using remote access software to get into the company's SIM activation tool. Junk is said to have paid Urban to call T-Mobile stores and deceive staff into handing over their logins by claiming to be from the internal security management. Soon Urban graduated to employing his own callers to conduct SIM swapping and used fake Okta login pages masquerading to trick a Twilio employee into sending their credentials. But when that account didn't have the data he wanted, he logged into the employee's Slack account and messaged a senior employee he'd identified on LinkedIn, asking them to send customer data belonging to 209 companies for auditing purposes. The information was subsequently used to hack more companies. In December 2022, the group also stole the personal information of 5.7 million customers of Gemini Trust and put it up for sale. This activity cluster came to be known as 0ktapus. The threat group would eventually join hands with other entities like LAPSUS$ and Scattered Spider to breach Crypto.com and exploit a United Parcel Service Inc. system to gather the personal data of would-be victims. Urban's home was raided by U.S. authorities in March 2023, and he was eventually arrested in January 2024. Last month, he was sentenced to ten years in prison. "I'm not saying what I did was a good thing, it's a horrible community, and what I did was bad," he told Bloomberg. "But I loved my life. I like who I am. I'm glad I was able to live life as I lived it." Stealthy SVG stingsThreat actors are using booby-trapped SVG files in an email phishing campaign targeting users in Colombia, Mexico, and Peru as a delivery vector to stealthily deliver malware like AsyncRAT by means of a password-protected ZIP archive. The oversized SVG files contain the "full package," eliminating the need for external connections to a remote server in order to send commands to compromised devices or download additional malicious payloads. "Attackers also appear to rely at least partly on artificial intelligence (AI) tools to help them generate customized files for every target," ESET said. "The ability of SVG lures to carry scripts, embedded links and interactive elements makes them ripe for abuse, all while increasing the odds of evading detection by some traditional security tools." Right-to-left ruseA decade-old vulnerability can open the door to URL spoofing by exploiting how browsers handle Right-to-Left (RTL) and Left-to-Right (LTR) scripts, thereby allowing attackers to craft URLs that appear trustworthy but actually lead to a different destination. The attack has been codenamed BiDi Swap by Varonis. While punycode homograph attacks and RTL override (RLO) exploits have long been abused to deceive users and browsers into displaying deceptive text or URLs, BiDi Swap entails crafting domains that have LTR sub-domain with some RTL parameters to spoof legitimate sites. Self-replicating supply-chain menaceCISA has published an advisory on the recent widespread supply chain compromise targeting the npm ecosystem that involved the use of a self-replicating worm named Shai-Hulud to steal credentials and propagate the malware to other packages. The malware "leveraged an automated process to rapidly spread by authenticating to the npm registry as the compromised developer, injecting code into other packages, and publishing compromised versions to the registry," CISA said. The agency is urging organizations to conduct a dependency review, pin npm package dependency versions to known safe releases, rotate all developer credentials, mandate phishing-resistant multi-factor authentication (MFA) on all developer accounts, monitor for anomalous network behavior, harden GitHub security by removing unnecessary GitHub Apps and OAuth applications, and enable branch protection rules. "The Shai-Hulud worm represents a significant escalation in the ongoing series of NPM attacks targeting the open-source community," Palo Alto Networks Unit 42 said. "Its self-replicating design is particularly notable, effectively combining credential harvesting with an automated dissemination mechanism that exploits maintainers' existing publishing rights to proliferate across the ecosystem." Game patch turns thiefA 2D platformer game called BlockBlasters has begun to exhibit signs of malicious activity after a patch release on August 30, 2025, that silently captures system information, a list of installed security products, and cryptocurrency wallet browser extensions, and drops the StealC information stealer while the user is playing the game. This patch affects hundreds of players who currently have the game installed on their systems, G DATA said. The game has since been pulled from Steam. Database door unlockedThreat actors have been observed exploiting an exposed Oracle DBS database server to execute commands remotely and create an encrypted tunnel with a command-and-control (C2) server to ultimately deploy Elons, a likely variant of the Proxima/Blackshadow ransomware that appeared in early 2024. It's suspected that the attackers used an encrypted tunnel with a C2 server for network communication, Yarix said. Remote tool turned spyTrojanized ScreenConnect installers are being used to distribute AsyncRAT and a custom PowerShell RAT as part of an ongoing campaign designed to facilitate data theft and long-term access. An analysis of the various IP addresses associated with AsyncRAT activity has revealed a "resilient, evasive AsyncRAT malicious infrastructure maintained for long-term operations rather than opportunistic attacks," Hunt.io said. Basic ransomware, big chaosA man in his forties from West Sussex has been arrested in connection with a cyber attack that disrupted day-to-day operations at several European airports including Heathrow. The U.K. National Crime Agency (NCA) said he has been released on conditional bail. "Although this arrest is a positive step, the investigation into this incident is in its early stages and remains ongoing," Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit, said. The agency did not name the suspect or say whether he acted alone or as part of a wider cybercriminal group. The incident caused hundreds of flight delays after Collins Aerospace baggage and check-in software used by several airlines failed. RTX Corporation, the owner of Collins Aerospace, said ransomware had been deployed in the attack. Although the company did not share any other details regarding the incident, cybersecurity researcher Kevin Beaumont said the attackers used an "incredibly basic" ransomware variant called HardBit. Fake mirrors hook devsThe maintainers of the Python Package Index (PyPI) have warned of continued phishing attacks that employ domain-confusion and legitimate-looking emails to trick accountholders into parting with their credentials by tricking them to click on fake links ("pypi-mirror.org") under the pretext of verifying their email address for "account maintenance and security procedures" or risk getting their accounts suspended. Package maintainers are advised to change their passwords with immediate effect if they have already clicked on the link and provided their login information. It's also advised to check the account's Security History for any suspicious activity. French dark market fallsLaw enforcement authorities in French have shut down a dark web marketplace catering to French-speaking users. The Dark French Anti System, or DFAS, was established in 2017 and had more than 12,000 registered users, emerging as a major hub for peddling drugs, arms, hacking tools, money-laundering schemes, and other criminal services. Authorities took control of servers and arrested two suspects, one who is alleged to be the site's chief administrator and an accomplice who helped in the testing of its services. Global sting hauls millionsAn INTERPOL-coordinated operation spanning 40 countries and territories led to the recovery of USD 342 million in government-backed currencies, along with USD 97 million in physical and virtual assets. The operation, dubbed HAECHI-VI, took place between April and August 2025, and targeted seven types of cyber-enabled financial crimes: voice phishing, romance scams, online sextortion, investment fraud, money laundering associated with illegal online gambling, business email compromise and e-commerce fraud. As part of the ongoing effort, authorities blocked over 68,000 associated bank accounts, froze close to 400 cryptocurrency wallets, and recovered around $16 million in suspected illicit profits from cryptocurrency wallets. In addition, Portuguese law enforcement broke up a syndicate that diverted funds meant to support vulnerable families, leading to the arrest of 45 suspects who illegally accessed social security accounts and altered bank details that resulted in $270,000 stolen from 531 victims. Thai officials also seized $6.6 million in stolen assets in connection with a sophisticated business email compromise scam conducted by a transnational organized crime group comprising Thai and West African nationals. "The gang deceived a major Japanese corporation into transferring funds to a fictitious business partner based in Bangkok," INTERPOL said. Kids’ data under spotlightThe popular social media app TikTok has been collecting sensitive information from hundreds of thousands of Canadians under 13 years old, according to a joint investigation by privacy authorities. However, "as a result of TikTok's inadequate age-assurance measures, the company collected the personal information of a large number of Canadian children, including information that the offices consider to be sensitive," the report said. The probe also found TikTok failed to adequately explain its collection and use of biometric information, such as facial and voice data, for video, image and audio analysis. The privacy commissioners said TikTok agreed to enhance its age verification and provide up-front notices about its wide-ranging collection of data. The company also agreed to "effectively stop" allowing advertisers to target users under the age of 18, except based on broad categories such as language and approximate location. AI turbocharges vulnerabilitiesA new report from Apiiro has found that software development teams using artificial intelligence (AI)-powered coding assistants have introduced "over 10,000 new security findings per month across repositories," a 10× spike from December 2024. "These flaws span every category of application risk — from open-source dependencies to insecure coding patterns, exposed secrets, and cloud misconfigurations," Apiiro said. "AI is multiplying not one kind of vulnerability, but all of them at once." The study also found that while syntax errors in AI-written code dropped by 76% and logic bugs declined by more than 60%, privilege escalation paths jumped 322%, and architectural design flaws increased 153%. In addition, AI-assisted developers exposed cloud-related API keys and service principals nearly twice as often as their non-AI peers. Shortcut to bypass securityIn September 2024, Microsoft issued patches for a Windows Mark-of-the-Web (MotW) security feature bypass vulnerability tracked as CVE-2024-38217. Also called LNK Stomping, the flaw exploits the manner Windows shortcut (LNK) files are handled to remove the MotW tag and bypass security protections. According to Elastic, there are indications that the issue has been exploited as far back as February 2018, long before it was publicly documented. "LNK Stomping is an attack that manipulates the actual execution program path of a Windows shortcut file (.lnk) with an abnormal target path or internal structure," South Korean cybersecurity company ASEC said. "It then prompts explorer.exe to remove the MoTW metadata during the 'normalization (Canonicalization)' process, thereby bypassing security checks." BankBot strikes Southeast AsiaDomainTools revealed that Indonesian and Vietnamese Android users have been targeted by banking trojans disguised as legitimate payment and government identity applications since August 2024. "The operators exhibit distinct domain registration patterns, often reusing TLS certificates and grouping domains to resolve to the same IP addresses, with a strong operational focus during Eastern Asia's daytime hours," the company said. It's suspected that the threat actors are using spoofed websites imitating the Google Play Store to trick users into installing fraudulent APK files that drop a banking trojan named BankBot, which had its source code leaked on Russian-language forums in 2016. Over 100 domains have been identified as being used for malware distribution. Russian influence playbookA state-backed threat actor with ties to Russian is targeting the upcoming 2025 Moldovan elections with a disinformation campaign, setting up fake news sites to publish articles that amplify narratives attempting to dissuade Moldova from further aligning with the European Union and exhibit bias against the current leadership. The multi-year activity is tracked under the name Storm-1679 (aka Matryoshka). Silent Push said it identified "technical fingerprints" linking the efforts to a Russian news site named Absatz. It also found commonalities between multiple disinformation websites, suggesting "infrastructure reuse and common ownership across this campaign." This includes the use of two IP addresses -- 95.181.226[.]135 and 91.218.228[.]51 -- which have been used to host domains in connection with a Russian disinformation effort dating back to 2022. "When searching for the Russian word for Moldova ('Молдова') on Absatz (absatz[.]media/search), there are dozens of clear disinformation articles," Silent Push said. Sabotage by algorithmIn new research published by CrowdStrike, it has been found that Chinese artificial intelligence engine DeepSeek either often refuses to help programmers or gives them low-quality code or code containing major security flaws when they say they are working for the banned spiritual movement Falun Gong or other groups considered sensitive by the Chinese government. "Deliberately producing flawed code can be less noticeable than inserting back doors – secret means of access for unauthorized users, including governments — while producing the same result: making targets easy to hack," The Washington Post reported. That wraps up this week’s Threatsday Bulletin. Use these stories as a prompt to double-check your own defenses: apply the urgent updates, tighten access controls, and talk with colleagues about what these incidents mean for your environment. Every small action today helps prevent a big incident tomorrow. 👉 Stay in the loop: Sign up for our newsletter for real-time updates and next week’s highlights.

A vulnerability in multiple versions of OxygenOS, the Android-based operating system from OnePlus, allows any installed app to access SMS data and metadata without requiring permission or user interaction. OnePlus, a subsidiary of Oppo, is a Shenzhen-based consumer electronics maker known for developing high-end smartphones at competitive pricing. While other major Chinese brands like Huawei and Xiaomi aren’t available in the U.S., OnePlus devices are officially available in the country. The flaw, tracked as CVE-2025-10184, and discovered by Rapid7 researchers, is currently unpatched and exploitable. The Chinese OEM failed to respond to Rapid7’s disclosures to this day, and the cybersecurity company published the technical details along with a proof-of-concept (PoC) exploit. Source of the problem The problem arises from OnePlus changing the stock Android Telephony package to introduce additional exported content providers like PushMessageProvider, PushShopProvider, and ServiceNumberProvider. The manifest for these providers does not declare a write permission for ‘READ_SMS,’ leaving it open to any app by default, even those that don’t have SMS permissions. To make matters worse, client-supplied inputs aren’t sanitized, allowing “blind SQL injection” that could reconstruct SMS content from the device database, bruteforcing it one character at a time. “By using an algorithm to repeat this process for each character in each row returned by the sub query, it’s possible to exfiltrate the database content, using the return value from the update method as an indicator of true/false,” describes Rapid7 in the report. So, while the read permission for SMS is correctly set, the write permission isn’t, allowing the inference of SMS content when certain prerequisites are met: Exposed table must already contain at least one row, so update() can return a non-zero “rows changed” result. The provider must allow insert() so an attacker can create a dummy row to operate on if the table is empty. The sms table must be in the same SQLite database file because the injected subquery must be able to reference it. Impact and response The issue impacts all versions of OxygenOS from 12 to the latest one, which is 15, which is the latest, built on top of Android 15. Rapid7 researchers tested and confirmed vulnerability on OnePlus 8T and 10 Pro, running various OxygenOS versions and Telephony package numbers, but noted that their list is almost definitely non-exhaustive. “While the build numbers above [on the table] are specific to the test devices, as the issue affects a core component of Android, we expect this vulnerability to affect other OnePlus devices running the above versions of OxygenOS, i.e., it does not seem to be a hardware-specific issue,” explained Rapid7. The researchers tried to contact OnePlus to share their findings on May 1 and followed up on alternative email addresses multiple times until August 16. After receiving no response to seven separate communication attempts, the security firm publicly disclosed the details for CVE-2025-10184. Shortly after publication of Rapid7's report, OnePlus acknowledged the disclosure and said they have launched an investigation into the problem. BleepingComputer has contacted OnePlus to request a comment, but we are still awaiting a response. Until a patch is made available, it is recommended to keep the number of installed apps on your OnePlus device to a minimum, only trust reputable publishers, and switch from SMS-based two-factor authentication to OTP apps like Google Authenticator. Since SMS isn’t properly isolated on OnePlus devices, sensitive communications should only occur on end-to-end encrypted apps. Update 9/25 - OnePlus sent BleepingComputer the following statement: "We acknowledge the recent disclosure of CVE-2025-10184 and have implemented a fix. This will be rolled out globally via software update starting from mid-October. OnePlus remains committed to protecting customer data and will continue to prioritize security improvements." - OnePlus spokesperson Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration ai and ml Anthropic says text watermarking scheme relies on inconsequential words'Shall I compare thee to a summer's afternoon' is the sort of thing this will make, and others look likely to adopt it AI and ML DeepSeek's innovative harness treats everything as a plug-inChinese AI labs keep moving forward while US labs play defense Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

The flaws and vulnerabilities of cellular networks are regularly exploited to attack subscribers. Malicious actors use devices with catchy names like IMSI Catcher (Stingray) or SMS blaster to track people’s movements and send them spam and malware. These attacks were easiest to carry out on 2G networks, becoming more difficult on 3G and 4G networks through the introduction of security features. But even 4G networks had implementation flaws that made it possible to track subscriber movements and cause other information leaks. Can we breathe a sigh of relief when we upgrade to 5G? Unfortunately not… An upgrade in reverse Many practical attacks, such as the aforementioned SMS blaster, rely on a downgrade: forcing the victim’s smartphone to switch to an older communication standard. Legacy standards allow attackers more leeway — from discovering the subscriber’s unique identifier (IMSI), to sending fake text messages under the guise of real companies. A downgrade typically uses a device that jams the signal of the legitimate carrier’s base station, and broadcasts its own. However, this method can be detected by the carrier, and it will become less effective in the future as smartphones increasingly incorporate built-in protection against these attacks, which prevents the switch to 2G and sometimes even 3G networks. Researchers at Singapore University of Technology and Design have demonstrated a SNI5GECT attack, which works on the latest 5G networks without requiring easy-to-detect actions like jamming legitimate base station signals. An attacker within a 20-meter radius of the victim can make the target device’s modem reboot and then force-switch it to a 4G network, where the subscriber is easier to identify and track. So how does this attack work? Before a device and a 5G base station connect to each other, they exchange some information — and the initial stages of this process aren’t encrypted. Once they establish a secure, encrypted connection, the base station and the smartphone exchange handshakes, but coordinate the session parameters in a plain, unencrypted format. The attacker’s device monitors this process and selects the precise moment to inject its own information block before the legitimate base station does. As a result, the victim’s modem processes malicious data. Depending on the modem and the contents of the data packet, this either causes the modem to switch to a 4G network and refuse to reconnect to said 5G base station, or to crash and reboot. The latter is only good for temporarily disconnecting the victim, while the former brings all known 4G-based surveillance attacks into play. The attack was demonstrated on the OnePlus Nord CE 2, Samsung Galaxy S22, Google Pixel 7, and Huawei P40 Pro smartphones. These devices use completely different cellular modems (MediaTek, Qualcomm, Samsung, Huawei, respectively), but the problem lies in the characteristics of the standard itself — not in the particular smartphones. The differences are subtle: some modems can be rebooted while others can’t; on some modems, inserting a malicious packet has a 50% success rate, while on others it’s 90%. The practicality of SNI5GECT In its current form, the attack is unlikely to become widespread since it has two major limitations. First, the distance between the attacker and the victim can’t be over 20 meters under ideal conditions — even less in a real urban environment. Second, if the smartphone and the 5G base station have already established a connection, the attack cannot proceed. The attacker has to wait for a moment when the victim’s movement or changes in the radio environment require the smartphone to re-register with the base station. This happens regularly, but not every minute, so the attacker has to literally shadow the victim. Still, such conditions may exist in certain situations, like when targeting people attending a specific meeting, or in an airport business lounge, or similar scenarios. The attacker would also need to combine SNI5GECT with legacy 4G/3G/2G attacks to achieve any practical results, which means making some radio noise. SNI5GECT plays a significant role as a stepping stone toward more complex and dangerous future attacks. As 5G becomes more popular and older generations of connectivity are phased out, researchers will increasingly work with the new radio protocol, and apply their findings to the next stages of the mobile arms race. Currently, there is no defense against 5G attacks. Disabling 5G for protection is pointless, as the smartphone just switches to a 4G network, which is exactly what hypothetical attackers want. Therefore, we have three pieces of advice: Regularly patch and update your smartphone’s OS — this usually also updates the modem firmware to fix bugs and vulnerabilities. Turn on airplane mode before confidential meetings; to be super-safe — leave your device at home. Consider disabling legacy communication standards (2G/3G) on your smartphone — we discussed the pros and cons of this solution in our post on SMS blasters.

To reduce the number of harmful apps targeting Android users, Google has announced that certified Android devices will require all apps to be registered by verified developers in order to be installed. But this new measure is not just about malware that’s found on the Google Play Store, it’s mainly about sideloaded apps (apps downloaded from outside the official Google Play Store). Since August 31, 2023, apps on the Play Store already were subject to a D-U-N-S (Data Universal Numbering System) number requirement. Google says this has helped reduce the number of cybercriminals exploiting anonymity to distribute malware, commit financial fraud, and steal sensitive data. To broaden this success, Google intends to start sending out invitations gradually starting October 2025, before opening it up to all developers in March 2026. In September 2026, the requirements go into effect in Brazil, Indonesia, Singapore, and Thailand. At this point, any app installed on a certified Android device in these regions must be registered by a verified developer. The requirements will then be rolled out globally. This initiative, branded as ‘Developer verification,’ aims to combat the widespread problem of malware from sideloaded apps. Google says its research shows that 50 times more malware comes from sideloaded sources than from Google Play itself. So, the new rules extend to everyone distributing Android apps, including those hosting them on third-party app stores or offering APK downloads directly. For developers who distribute their apps solely through the Google Play Store there will not be much of a change. Yet, while legitimate developers will tell you how hard it is to get their apps accepted into the Google Play Store, cybercriminals manage to sneak in their malicious apps anyway. For a full understanding of the new requirement, we’ll need to explain what “certified Android devices” are. A definition for a certified Android device is: an Android product—such as a smartphone, tablet, smart TV, or streaming box—that has passed a rigorous series of Google security, compatibility, and performance tests, and is officially approved by Google. Certified devices run an official version of Android and have access to Google apps and the Play Store. Uncertified devices often lack these and may not receive updates or proper security support. This is important to know because not all Android malware is limited to phones. Take for example, the BadBox botnet which also affects devices like TV streaming boxes, tablets, and smart TVs. In practice, a certified device encompasses all mainstream devices from Samsung, Xiaomi, Motorola, OnePlus, Oppo, Vivo, and the Google Pixel line. Reportedly, non-certified devices are those from Huawei, Amazon Fire tablets, and a set of Chinese TV boxes and smartphones that use heavily modified OS images. Google encourages all developers to sign up for early access as the best way to prepare and stay informed. “Early participants will also get: An invitation to an exclusive community discussion forum. Priority support for these new requirements. The chance to provide feedback and help us shape the experience.” Whether these controls will be effective largely depends on enforcement and public awareness, but Google feels it marks real progress toward a safer mobile ecosystem. Let us know how you feel about this in the comments. Scammers know more about you than you think. Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.