phonepe

Brinqa acquires PlexTrac to bring validated remediation to exposure management Brinqa has announced its acquisition of PlexTra, adding the ability to verify that remediation efforts have actually worked. The combined capabilities uniquely position Brinqa to identify and prioritize the exposures that matter most, drive remediation, and validate that fixes hold, closing the CTEM loop. “We’ve spent over a decade building the platform enterprise security teams trust to prioritize what to fix first,” said Dan Pagel, CEO at Brinqa. “PlexTrac brings real offensive security depth, from practitioners who have spent years proving exactly how attackers get in. Pairing that expertise with our exposure assessment platform gives customers proof they can defend to a board, an auditor, or any AI system acting on that data.” A decade of momentum in exposure management Brinqa has spent more than a decade solving exposure management challenges for the world’s largest and most complex organizations, including Nestlé, PhonePe, Cambia Health Solutions, Guidewire, and SAP. That focus paid off in 2025 with 164% year-over-year growth in new bookings, a 32% increase in new-logo average selling price, and inclusion in the inaugural Gartner Magic Quadrant for Exposure Assessment Platforms. Momentum accelerated further in 2026, with new logo bookings more than doubling year-over-year and existing customers expanding their deployments as Brinqa shipped new AI capabilities, including new MCP interfaces, the AI Attribution Agent, and the AI Deduplication Agent. The PlexTrac acquisition builds directly on that trajectory, adding the capability enterprise security teams kept asking for: proof that a fix actually worked. Combined with a robust data foundation, MCP, and Bring Your Own AI, customers can connect that same validated exposure data to the AI models and tools they already use, making high-value exposure intelligence available across teams. “Exposure management only matters if teams can prove the fix worked, and that’s the gap Brinqa now closes. We’ve watched this team build category-defining technology, and this acquisition sharpens their lead at a moment when security organizations are demanding validated, AI-ready data,” said Thomas Krane, Managing Director at Insight Partners and member of Brinqa’s board of directors. Acquisition highlights Brinqa now serves 3,000+ customers across 57 countries, giving PlexTrac’s offensive security community direct access to Brinqa’s data foundation and AI agents. Brinqa now fully closes the CTEM loop, from discovery and prioritization through validated proof that a fix worked. The combined company is now the largest standalone vendor in Unified Exposure Management, bringing together two companies independently recognized in the Gartner Magic Quadrant for Exposure Assessment Platforms. Every confirmed exploit and fix from PlexTrac flows into Brinqa’s data layer, strengthening the Cyber Risk Graph and sharpening every AI agent, whether Brinqa’s own or one a customer runs via Brinqa’s Bring Your Own AI program. Dan DeCloss, founder and Chief Customer Brand Officer of PlexTrac, joins Brinqa’s executive leadership team and board of directors to lead the combined offensive security practice. What this means for customers For Brinqa’s customers, it means faster confirmation that a fix worked, and evidence to back up what security teams report to auditors, insurers, and the board. A vulnerability marked “closed” in a ticketing system is a status update. A vulnerability confirmed closed through validated retesting is proof. For PlexTrac’s customers, it means pentest teams and workflows now plug directly into a CTEM program instead of sitting next to one. Brinqa’s prioritization engine focuses pentest resources on the exposures that matter most to the business, and validation now covers both ends of remediation: pre-remediation testing to confirm an exposure is exploitable, and post-remediation retesting to confirm the fix held. Security, IT, and offensive security teams work from one prioritized list. The PlexTrac solutions will continue operating as standalone offerings, giving existing customers the same experience they have today, with the option to extend into Brinqa’s broader platform as their programs evolve. “PlexTrac was built by offensive security practitioners, for offensive security practitioners, and that’s not changing. Joining Brinqa gives our team a bigger platform to prove that hands-on offensive security expertise still matters, even as more of this work gets automated,” said DeCloss. With PlexTrac, Brinqa becomes the operating system for enterprise exposure management: the layer where every decision, every fix, and every proof point comes together. Brinqa was represented by Covington & Burling in the transaction.

Nika: Open-source code analysis tool Many serious security bugs in web applications sit across several files at once. Request data enters through a controller, moves through data objects and service layers, and turns dangerous only when it reaches a sensitive operation such as a database query or a file action. A scanner that reads one file at a time can miss that path entirely. Nika, an open-source tool from the payments company PhonePe, works on that problem for Java microservices. It performs cross-file taint analysis, tracing attacker-controlled input across application layers to find out whether that input reaches a security-sensitive sink. Many exploitable issues stay invisible inside a single file. The danger appears only along the route the data travels, so a reviewer needs to see the whole route. Nika traces that data flow across files and functions, which lets a security engineer judge whether a suspect path is reachable in practice. How the analysis works The tool reads a target repository and builds an analysis representation that captures code structure, control flow, and data flow. From there it locates the sources where attacker-controlled input enters an application, then locates the sinks where security-sensitive operations happen. A sink might be a database query, a file operation, a template engine, a reflection call, or an outbound network request. Cross-file and inter-procedural analysis traces whether input can travel from a source to a sink. The output is a HTML of JSON report that shows the vulnerable path, the affected code locations, and remediation context. What it detects Nika covers eleven vulnerability categories. These include SQL injection, server-side request forgery, path traversal, command injection, code injection, template injection, deserialization flaws, XML external entity issues, cryptographic failures, and unsafe reflection. The tool also checks for security-critical call-order violations in sensitive execution flows and validation chains. Teams can broaden the coverage with custom sources, OpenGrep sinks, and vulnerability plugins, and they can run branch-aware scans as part of secure code review. An optional AI review step After the core analysis runs, Nika can pass its findings to an AI agent for a second look aimed at reducing false positives. This step stays off by default and switches on through a configuration setting. The sample configuration points the review at a hosted large language model and includes values for token cost, iteration counts, and call limits. Keeping the step optional lets a team run the static engine on its own and add the language-model pass for cases where triage time runs short. The tool aims at secure code review work. Branch-aware scanning lets a reviewer point Nika at the changes under review, and the HTML report lays out the source-to-sink path together with the lines involved. The remediation context in the report gives a starting point for a fix. Benchmarking and language support The team behind Nika has measured the tool against a public test set. Praveen Kanniah, a maintainer of the project, described the method: “We have used OWASP Java benchmark project to benchmark our tool. The codebase has intentionally vulnerable files and its gauged against parameters like True Positives, False Positives, recall (the overall true positives identified amongst what exists in the code) etc.” The OWASP benchmark supplies code with planted flaws, which lets a scanner’s results get scored on how many real issues it catches and how many of its alerts hold up. Recall, in that setting, measures the share of existing vulnerabilities the tool manages to surface. Java is the only supported language at this stage, and coverage for more languages sits on the roadmap. Nika ships as a Docker image and as a local build, and its documentation lives on a dedicated project site. Nika is available for free on GitHub. Must read: 25 open-source cybersecurity tools that don’t care about your budget GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillance on Android and iOS devices. "The developer runs dedicated channels for sales, customer support, and regular updates, giving buyers a single point of access to a fully operational spyware panel," Daniel Kelley, security researcher at iVerify, said. "The platform goes beyond typical data collection into real-time surveillance and direct financial theft." ZeroDayRAT is designed to support Android versions 5 through 16 and iOS versions up to 26. It's assessed that the malware is distributed via social engineering or fake app marketplaces. The malicious binaries are generated through a builder that's provided to buyers along with an online panel that they can set up on their own server. Once the malware infects a device, the operator gets to see all the details, including model, location, operating system, battery status, SIM, carrier details, app usage, notifications, and a preview of recent SMS messages, through a self-hosted panel. This information allows the threat actor to profile the victim and glean more about who they talk to and the apps they use the most. The panel also extracts their current GPS coordinates and plots them on Google Maps, along with the history of all locations they have been to over time, effectively turning it into spyware. "One of the more problematic panels is the accounts tab," Kelley added. "Every account registered on the device is enumerated: Google, WhatsApp, Instagram, Facebook, Telegram, Amazon, Flipkart, PhonePe, Paytm, Spotify, and more, each with its associated username or email." Some of the other capabilities of ZeroDayRAT include logging keystrokes, gathering SMS messages -- including one-time passwords (OTPs) to defeat two-factor authentication, as well as allowing hands-on operations, such as activating real-time surveillance via live camera streaming and a microphone feed that allows the adversary to remotely monitor a victim. To enable financial theft, the malware incorporates a stealer component that scans for wallet apps like MetaMask, Trust Wallet, Binance, and Coinbase, and substitutes wallet addresses copied to the clipboard to reroute transactions to a wallet under the attacker's control. There also exists a bank stealer module to target online mobile wallet platforms like Apple Pay, Google Pay, PayPal, along with PhonePe, an Indian digital payments application that allows instant money transfers with the Unified Payments Interface (UPI), a protocol to facilitate inter-bank peer-to-peer and person-to-merchant transactions. "Taken together, this is a complete mobile compromise toolkit, the kind that used to require nation-state investment or bespoke exploit development, now sold on Telegram," Kelley said. "A single buyer gets full access to a target's location, messages, finances, camera, microphone, and keystrokes from a browser tab. Cross-platform support and active development make it a growing threat to both individuals and organizations." The ZeroDayRAT malware is similar to numerous others that have targeted mobile device users, either via phishing or by infiltrating official app marketplaces. Over the past few years, bad actors have repeatedly managed to find various ways to bypass security protections put in place by Apple and Google to trick users into installing malicious apps. Attacks targeting Apple's iOS have typically leveraged an enterprise provisioning capability that allows organizations to install apps without the need for publishing them to the App Store. By marketing tools that combine spyware, surveillance, and information-stealing capabilities, they further lower the barrier of entry for less skilled hackers. They also highlight the evolving sophistication and persistence of mobile-focused cyber threats. News of the commercial spyware platform coincides with the emergence of various mobile malware and scam campaigns that have come to light in recent weeks - An Android remote access trojan (RAT) campaign has used Hugging Face to host and distribute malicious APK files. The infection chain begins when users download a seemingly harmless dropper app (e.g., TrustBastion) that, when opened, prompts users to install an update, which causes the app to download the APK file hosted on Hugging Face. The malware then requests accessibility permissions and access to other sensitive controls to enable surveillance and credential theft. An Android RAT called Arsink has been found to use Google Apps Script for media and file exfiltration to Google Drive, in addition to relying on Firebase and Telegram for C2. The malware, which allows data theft and complete remote control, is distributed via Telegram, Discord, and MediaFire links, while impersonating various popular brands. Arsink infections have been concentrated in Egypt, Indonesia, Iraq, Yemen, and Türkiye. A document reader app named All Document Reader (package name: com.recursivestd.highlogic.stellargrid) uploaded to the Google Play Store has been flagged for acting as an installer for the Anatsa (aka TeaBot and Toddler) banking trojan. The app attracted over 50,000 downloads before it was taken down. An Android banking trojan called deVixor has been actively targeting Iranian users through phishing websites that impersonate legitimate automotive businesses since October 2025. Besides harvesting sensitive information, the malware includes a remotely triggered ransomware module capable of locking devices and demanding cryptocurrency payments. It uses Google Firebase for command delivery and Telegram-based bot infrastructure for administration. A malicious campaign codenamed ShadowRemit has exploited fake Android apps and pages mimicking Google Play app listings to enable unlicensed cross-border money transfers. These bogus pages have been found to promote unauthorized APKs as trusted remittance services with zero fees and improved exchange rates. "Victims are instructed to send payments to beneficiary accounts/eWallet endpoints and provide transaction screenshots as proof for verification," CTM360 said. "This approach can bypass regulated remittance corridors and aligns with mule-account collection patterns." An Android malware campaign targeting users in India has abused the trust associated with government services and official digital platforms to distribute malicious APK files through WhatsApp, leading to the deployment of malware that can steal data, establish persistent control, and run a cryptocurrency miner. The operators of an Android trojan and cybercrime tool called Triada have been observed using phishing landing pages disguised as Chrome browser updates to trick users into downloading malicious APK files hosted on GitHub. According to an analysis by Alex, attackers are "actively taking over long-standing, fully verified advertiser accounts to distribute malicious redirects." A WhatApp-oriented scam campaign has leveraged video calls, in which the threat actor poses as a bank representative or a Meta support and instructs them to share their phone's screen to address a purported unauthorized charge on their credit card, and install a legitimate remote access app, such as AnyDesk or TeamViewer, to steal sensitive data. An Android spyware campaign has leveraged romance scam tactics to target individuals in Pakistan to distribute a malicious dating chat app dubbed GhostChat to exfiltrate victims' data. It's currently not known how the malware is distributed. The threat actors behind the operation are also suspected to be running a ClickFix attack that infects victims' computers with a DLL payload that can gather system metadata and run commands issued by an external server, as well as a WhatsApp device-linking attack called GhostPairing to gain access to their WhatsApp accounts. A new family of Android click fraud trojans called Phantom has been found to leverage TensorFlow.js, a JavaScript machine learning library, to automatically detect and interact with specific advertisement elements on a site loaded in a hidden WebView. An alternative "signaling" mode uses WebRTC to stream a live video feed of the virtual browser screen to the attackers' server and allow them to click, scroll, or enter text. The malware is distributed via mobile games published to Xiaomi's GetApps store and other unofficial, third-party app stores. An Android malware family called NFCShare has been distributed via a Deutsche Bank phishing campaign to deceive users into installing a malicious APK file ("deutsche.apk") under the pretext of an update, which reads NFC card data and exfiltrates it to a remote WebSocket endpoint. The malware shares similarities with NFC relay malware families like NGate, ZNFC, SuperCard X, PhantomCard, and RelayNFC, with its command-and-control (C2) server previously flagged as associated with SuperCard X activity in November 2025. In a report published last month, Group-IB said it has witnessed a surge in NFC-enabled Android tap-to-pay malware, most of which is advertised within Chinese cybercrime communities on Telegram. The NFC-based relay technique is also referred to as Ghost Tap. "At least $355,000 in illegitimate transactions have been recorded from one POS vendor alone throughout November 2024 – August 2025," the Singapore-headquartered cybersecurity company said. "In another observed scenario, mobile wallets preloaded with compromised cards are used by mules across the globe to make purchases." Group-IB also said it identified three major vendors of Android NFC relay apps, including TX-NFC, X-NFC, and NFU Pay, with TX-NFC amassing over 25,000 subscribers on Telegram since commencing operations in early January 2025. X-NFC and NFU Pay have more than 5,000 and 600 subscribers on the messaging platform, respectively. The end goal of these attacks is to trick victims into installing NFC-enabled malware and tapping their physical payment cards on their smartphone, causing the transaction data to be captured and relayed to the cybercriminal's device through an attacker-controlled server. Once the card details are exfiltrated, a dedicated app installed on the money mule's device is used to complete payments or cash-out as though the victims' cards were physically present. Calling tap-to-pay scams a growing concern, Group-IB said it observed a steady increase in the detection of malware artifacts between May 2024 and December 2025. "At the same time, different families and variants are also appearing, while the old ones remain active," it added. "This indicates the spread of this technology among fraudsters."

A new mobile spyware operation known as ZeroDayRAT has been documented targeting both Android and iOS devices. The cross-platform tool provides attackers with persistent access to personal communications, precise location data and banking activity. According to a new advisory published by iVerify, what's new is the breadth of control offered to operators and how easily infections can be initiated. To compromise a device, an attacker must simply persuade a victim to install a malicious binary, typically an Android APK or an iOS payload. Smishing remains the most common lure, with text messages pushing links to fake but convincing apps. Phishing emails, counterfeit app stores and links shared through WhatsApp or Telegram have also been observed. Device Overview, User Profiling and Financial Theft Once infected, the first screen presented to an operator is an extensive overview of the device via a dedicated web-based dashboard. Hardware details, operating system version, battery status, country, SIM and carrier information and lock status are displayed alongside app usage broken down by time. Recent SMS messages and a live activity timeline appear in the same view, allowing rapid profiling of the user's habits and contacts. Scrolling through the overview reveals intercepted messages from banks, mobile carriers and personal contacts. This single panel can show who the user communicates with most, when the device is active and which networks it connects to. From there, operators can pivot into more detailed data streams. Separate tabs expose additional surveillance capabilities. GPS data is plotted on an embedded Google Maps view with full location history. Notifications are captured passively, including alerts from WhatsApp, Instagram, Telegram, YouTube, missed calls and system events, without opening any apps. ZeroDayRAT also includes dedicated financial theft modules: A crypto stealer that detects wallets and injects attacker-controlled clipboard addresses A banking stealer targeting online banking apps, UPI platforms such as PhonePe and Google Pay and services including Apple Pay and PayPal via overlay attacks A Persistent and Growing Threat iVerify said the platform represents a complete mobile compromise toolkit that once required nation-state resources. It is now marketed through Telegram channels, offering buyers access to a target's location, messages, finances, camera, microphone and keystrokes across Android and iOS. iVerify warned that compromised employee devices pose serious risks for credential theft, account takeover and data exfiltration. "For enterprises, a compromised employee device is a vector for credential theft, account takeover, and data exfiltration," the team said. "For individuals, it means total loss of privacy and direct financial exposure. Mobile device security needs to be treated with the same urgency as endpoint and email security." They added that detecting threats like ZeroDayRAT requires mobile EDR capabilities that extend beyond traditional device management, combining on-device detection, mobile forensics and automated response across both managed and BYOD environments.