ToxicPanda 2.0 targets 349 financial apps and abuses Android Wireless Debugging to gain deeper device access and steal banking credentials. ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks. That version is gone. Zimperium’s zLabs team just documented ToxicPanda 2.0, and the numbers alone tell the story: 349 targeted financial institutions across 16 countries, up from 16 apps in the previous version, plus a command set that ballooned to 167 remote instructions. The infection starts with a fairly standard trick dressed up in a new coat of paint. The malware poses as a dropper, requesting VPN permissions through a fake installation screen, then quietly uses that access to block communication from Google Play Protect while it decrypts and installs the real payload hiding inside the app’s own asset files. Once installed, it leans on Android’s Accessibility Service, the same feature legitimate screen readers and automation tools rely on, to see and interact with everything happening on the victim’s screen. ToxicPanda was once a malware mainly targeting a small number of European banks. That has changed. Zimperium’s zLabs team has documented ToxicPanda 2.0, which now targets 349 financial institutions in 16 countries, compared with just 16 apps before. It also has 167 different commands that attackers can send remotely. The attack starts with a common trick. The malware pretends to be a legitimate app and asks for VPN permissions through a fake installation screen. It then uses this access to block Google Play Protect while secretly installing the real malware hidden inside the app’s files. Once installed, ToxicPanda abuses Android’s Accessibility Service. This feature is normally used by legitimate tools such as screen readers, but the malware uses it to monitor the victim’s screen and interact with apps and data on the device. “By abusing the Android Accessibility Service, threat actors can steal every UI element on the screen, alongside an overlay-based credential theft mechanism targeting 349 financial institutions, compared to the previous version, which targeted only 16 banking applications, the latest iteration demonstrates a significant expansion in targeting scope and capabilities.” reads the report published by Zimperium’s zLabs. “Several commands previously identified as unimplemented in Cleafy’s analysis are now fully operational, expanding the malware’s remote control and fraud capabilities.” What sets this version apart isn’t just scale, it’s a genuinely new privilege escalation trick built around a feature most people have never touched: Android’s Wireless Debugging framework. The malware automates the entire process of turning it on, tapping the build number seven times to unlock developer options, toggling wireless debugging, and then scraping the six-digit pairing code straight off the screen using accessibility permissions. From there it performs the actual cryptographic pairing handshake itself, gaining shell-level access to the device without the victim ever realizing developer mode got switched on. ToxicPanda was once a malware mainly targeting a small number of European banks. That has changed. Zimperium’s zLabs team has documented ToxicPanda 2.0, which now targets 349 financial institutions in 16 countries, compared with just 16 apps before. It also has 167 different commands that attackers can send remotely. The attack starts with a common trick. The malware pretends to be a legitimate app and asks for VPN permissions through a fake installation screen. It then uses this access to block Google Play Protect while secretly installing the real malware hidden inside the app’s files. Once installed, ToxicPanda abuses Android’s Accessibility Service. This feature is normally used by legitimate tools such as screen readers, but the malware uses it to monitor the victim’s screen and interact with apps and data on the device. The real danger comes from its ability to use Android Debug Bridge (ADB). Once connected, ToxicPanda can run commands through ADB without showing the usual permission requests. This allows it to give itself more permissions, remove Android restrictions on background activity, enable important components without the user knowing, and maintain access to the device. “The malware also introduces an automated click-based mechanism to abuse Android Wireless Debugging (ADB), enabling privilege escalation and shell-level access on compromised devices. Additionally, it can steal lock screen credentials by placing overlays on top of the lock screen.” continues the report. The credential theft itself runs on two separate tracks. For banking and crypto apps specifically, the malware watches which app the victim opens, matches it against a list of 349 targets, and either overlays a fake login screen or deploys an invisible transparent layer to capture every touch and PIN entry directly. Separately, it can now overlay a convincing fake version of the phone’s own lock screen to steal the device PIN, pattern, or password outright, which hands attackers a way back in even after the initial infection window closes. Several capabilities that security firm Cleafy had previously flagged as unfinished in an earlier ToxicPanda variant are now fully working. The malware can automatically click through OEM-specific permission dialogs across Xiaomi, Samsung, Huawei, and other manufacturers’ customized Android builds, request Device Administrator privileges using a fake “system service” prompt, and even remotely force-reset a victim’s lock screen password using legitimate Android device management APIs. It can also load an attacker-controlled webpage inside a full-screen overlay on command, a feature that simply didn’t exist in prior versions. Distribution has shifted too, with samples now getting served from Amazon AWS-hosted storage buckets rather than whatever ad-hoc infrastructure earlier campaigns used. “The updated campaign also reveals a shift in distribution methods, with ToxicPanda 2.0 samples being delivered through Amazon AWS-hosted buckets, indicating the attackers are leveraging cloud infrastructure for malware delivery.” states the report. Using major cloud providers for malware delivery isn’t new, but it does complicate blocking efforts, since flagging an entire AWS IP range as malicious tends to take down a lot of legitimate traffic along with it. None of this requires a sophisticated zero-day, which is honestly the more unsettling part. Every capability here abuses a feature Android ships intentionally, Accessibility Services, Wireless Debugging, Device Administrator APIs, all designed for legitimate accessibility and enterprise device management. “As mobile banking threats like ToxicPanda become increasingly sophisticated, conventional signature-based security layers are no longer sufficient to protect enterprise mobile endpoints.” concludes the report. If you’re responsible for securing mobile endpoints, this is less a “patch something” problem and more a “detect abnormal use of normal features” problem, and that’s a considerably harder thing to build detection around. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ToxicPanda 2.0)
Windows named pipes provide fast interprocess communication, but weak access controls can expose privileged services to untrusted processes. ThreatLocker explains how endpoint verification, command authorization, strict input validation, and narrowly scoped privileges can help secure named-pipe communication.
Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network. Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as legitimate. Their report documents the first known malware infection targeting car head units, the Android-based infotainment and control systems built into many modern vehicles, spread through the vehicle’s own official update mechanism. Head units run Android for practical reasons, since manufacturers can build on existing source code and add their own custom system apps during production. That flexibility cuts both ways. Because head units are just Android devices under the hood, most apps built for smartphones can technically run on them too, including malware, even though something like a banking trojan would be wasted effort on a device nobody uses for mobile banking. Kaspersky researchers found something unusual in June 2026: an Android app with no visible interface that was installed like a normal app but did not try to look legitimate. Their report describes what they say is the first known malware infection targeting car head units, Android-based systems used for infotainment and vehicle controls, delivered through the car’s official update system. “We identified new Android malware: a multi-stage downloader whose ultimate purpose is ad fraud and creation of a proxy botnet.” reads the report published by Kaspersky. “The malware spread through the built-in updaters of Android-based automotive head unit firmware. This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.” Car head units often use Android because it is flexible and lets manufacturers add their own software. But this also creates a security risk. Since these systems are basically Android devices, many apps designed for smartphones can also run on them, including malware. The infection chain here starts inside TWCore, a completely legitimate system app responsible for analytics and firmware updates on DoFun head units. An MQTT message broker sends TWCore instructions about which APK files to download and install, and a specific configuration flag called installNotExists controls whether the app checks if something is already installed before pushing it. “TWCore only checks whether an app is already installed on the device when installNotExists = false The APK file is downloaded to <TWCore external cache dir>/push/apk/ for installation.” which means setting that flag the other way turns a routine update channel into a silent installation pipeline for anything the attackers want to push. What gets installed through that channel is a small dropper called JarService, carrying zero user interface and doing nothing but decrypting and loading the next stage. That stage is a loader that phones home to a command server, reports basic device details, and receives a download link for the actual payload, a third-stage module researchers found could be pulled in at least seven different versions simply by trying different version numbers in the download URL. That third stage turns out to be a clicker and reverse proxy component, checking in with its server every 90 minutes by default and waiting for new instructions. “In this stage, the malware sends a POST request to /cpc/api/task every 90 minutes by default, containing information about the infected device (display resolution, device model, the SSID of the connected Wi-Fi network, MAC address, and so on) along with the Trojan’s configuration version.” continues the report. “If the configuration is outdated, the C2 server returns an updated configuration containing new C2 addresses and new paths for sending HTTP requests.” The command system behind the malware is more powerful than you might expect from something running silently on a car’s dashboard. Researchers found nine commands, including ones that can change the clipboard, send HTTP requests, load web pages, and run JavaScript. In practice, attackers mainly used two: one to download and run new code, and another to send web requests. The extra module they deployed, called “zhima,” was a reverse proxy. This means the main goal was not to attack or control the car. Instead, the attackers wanted to use infected cars’ internet connections as part of a larger proxy network. Tracing the malware’s naming conventions and infrastructure led researchers to attribute the campaign, with high confidence, to MoYu Group, an actor connected to the BADBOX botnet that’s been documented previously by other researchers. A thread inside the second-stage loader carried the internal name “mosdk-host-loader,” which pointed toward malware previously found on TV set-top boxes tied to the same group, and overlapping network infrastructure independently spotted by a separate research team around the same time backed up the connection. The command system behind the malware is more powerful than you might expect from something running silently on a car’s dashboard. Researchers found nine commands, including ones that can change the clipboard, send HTTP requests, load web pages, and run JavaScript. In practice, attackers mainly used two: one to download and run new code, and another to send web requests. The extra module they deployed, called “zhima,” was a reverse proxy. This means the main goal was not to attack or control the car. Instead, the attackers wanted to use infected cars’ internet connections as part of a larger proxy network. There is also a strange detail in the network’s infrastructure. The proxy service’s admin panel allows people to create accounts if they have a valid invite code. Its copyright text and login page also look similar to those used by at least two commercial residential-proxy services. This suggests the network may be linked to a business-like proxy service, while also using infected cars to provide internet connections. BADBOX has survived several takedown attempts by researchers and law enforcement. This campaign shows why: the people behind it keep changing how they spread the malware and are moving into new types of devices. Cars are now joining smart TVs and set-top boxes as devices that can be quietly added to a botnet. As cars become more like computers, they also need the same kind of security protection. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Android Car)
A critical flaw (CVSS 9.4) in NASA/JPL’s AIT-GUI let anyone send unauthenticated commands to spacecraft instruments. Cycode researchers found that AIT-GUI, the browser-based operator console in NASA/JPL open-source AMMOS Instrument Toolkit, shipped with no authentication, no session checks, and no CSRF protection on any of its state-changing endpoints. “AIT-GUI, the web front end of NASA/JPL’s open-source AMMOS Instrument Toolkit, starts an HTTP server with no authentication, no authorization, and no CSRF protection on any of its state-changing endpoints.” reads the report published by Cycode. “Anyone who can reach the port, or any website an operator merely visits in a browser, can: Issue arbitrary commands via POST /cmd Run server-side scripts via POST /script/run Execute command sequences via POST /seq“ The vulnerability is tracked as GHSA-p9r8-2q67-fp86, rated Critical (CVSS score of 9.4), and fixed in AIT-GUI 2.5.2. AMMOS (Advanced Multi-Mission Operations System) is an open-source framework used by NASA/JPL and other missions to control spacecraft and instruments, send commands, and process the data they send back. AIT-GUI is the web interface operators use to do this in real time. Sending a command through this software is not like filling out a simple online form. The vulnerability isn’t one thing. It’s four ordinary web weaknesses that compose into something with unusual consequences. The first is that the server reads its configured host setting into a variable and then ignores it, binding instead to 0.0.0.0, which means all network interfaces. An operator who sets host: localhost to keep the console on the loopback gets a server exposed to the entire reachable network anyway. The second and third weaknesses follow from the first. There’s no login requirement, no session gate, no CSRF token, and no cross-origin restriction on any route. POST /cmd takes whatever arrives in the command field, parses it, and hands it directly to the command bus: no check, no validation, nothing between the network and the hardware. The fourth weakness lives on POST /seq and POST /script/run, which build filesystem paths by joining raw user input onto a root directory with no confinement. A seqfile value of ../../../../something resolves outside the intended sequence directory. The researchers note that the correct confinement check already exists in the same codebase, on a sibling route called /scripts/load; the safe pattern was already written, just not applied consistently. The CSRF risk is especially serious because a firewall does not stop it. Browsers can send certain form requests from another website without first checking with the target site. So, if an operator opens a malicious page in the same browser they use for the console, it could send commands such as POST /cmd, POST /seq, or POST /script/run. The attacker does not need direct access to the system or its network port—they only need the operator to open a malicious link. Cycode’s research team used a combination of AI-assisted code analysis and human validation to find and confirm the issues. The AI handled the initial codebase review, flagging recognizable patterns: state-changing routes with no auth anywhere in their call path, user input flowing from a request parameter into a subprocess call without sanitization, and a configuration value that was read and then silently discarded. The human researcher then confirmed each pattern was exploitable and reduced each to a working proof-of-concept, including a self-contained CSRF demonstration that drove a real headless browser and recorded zero network preflights. That second step matters. A pattern match points to a candidate; a reproduced exploit confirms the finding is real. Cycode says explicitly it only reports the second kind. “More broadly: operational and ground-system software inherits the same web weaknesses as everything else, but with a far higher cost of failure. Auth, CSRF defense, and input confinement are not optional extras on a panel that commands hardware.” concludes the report. The fix is in AIT-GUI 2.5.2. Operators should upgrade immediately and verify the console port is not reachable from untrusted networks. Anyone who ran an exposed instance before the patch should treat it as a reason to audit command and sequence history, since an unauthenticated POST leaves no user-level trace by design. Maintainers hardening deployments should add authentication and CSRF protection to the command, script, and sequence routes; bind the server to the configured host instead of 0.0.0.0; and apply the existing path-confinement logic from /scripts/load to /seq and /script/run. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NASA/JPL)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Zimbra Collaboration Suite (ZCS) flaw CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog. CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting the critical vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated remote code execution and was patched less than a month ago. “The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.” reads the advisory published by CERT Polska. “The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the snmp_notify parameter and the swatchdog service running (enabled by default).” The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default. The technical root cause is a sanitization failure in the SNMP monitoring component. Zimbra released version 10.1.20 on 20 July 2026 to address the issue. The fix came 28 days before active exploitation was confirmed, which is not a wide window, but apparently wide enough. The attack surface only exists when the optional zimbra-snmp package is installed and SNMP notifications are active, but swatchdog, the service that processes those notifications, is running by default on most installations. Below are recommendations by CERT Polska: “Due to the ongoing campaign exploiting this vulnerability, we recommend: verifying Zimbra logs /var/log/zimbra.log for the following entries: Service status change: <szkodliwy ładunek> changed from stopped to running Service status change: <szkodliwy ładunek> changed from running to stopped verification of files created by user zimbra in the last 30 days in the following directories: /opt/zimbra/jetty/webapps/ /opt/zimbra/jetty_base/webapps/ /tmp/ If you discover any signs of potential exploitation of this vulnerability, please contact our team immediately.” According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by August 24, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42.
Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's
More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid. Truffle Security has been tracking this exposure for the past four years and says that 817 of the exposed keys were linked to companies, 526 of them being AWS root keys. According to the researchers, 242 of the keys are associated with Identity and Access Management (IAM) users with the AdministratorAccess policy. This role has full permissions to create, modify, delete, and view virtually all AWS services and resources within an account. They note that each key of the 768 live keys in the two sets “full control of a company's AWS account.” The company found 431,875 AWS secrets across code repositories, Git history, datasets, Docker images, registries, and CI logs and extracted 64,024 unique AWS keys that corresponded to 50,654 AWS accounts after removing duplicates.
Microsoft says ongoing issues causing games to crash or fail to launch after installing the August 2026 Windows updates may be caused by peripherals with RGB lighting. As Microsoft explained when it confirmed it's investigating on Wednesday, this known issue affects games like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals on systems running Windows 11 24H2 and 25H2. "Following the release of Windows updates on August 11, 2026 (KB5121003) and later, Microsoft received reports of issues involving inability to run games as expected," Microsoft said on the Windows release health dashboard. On impacted PCs, users are also experiencing gaming freezes, "EXCEPTION_ACCESS_VIOLATION" errors, and even unexpected system restarts. In a Thursday update, Microsoft said the gaming issues may be caused by drivers or components installed by RGB devices on affected Windows systems.
Using the same email, phone number, payment method, and other identifiers makes it easier for data brokers and attackers to profile your activity. Anonyome Labs explains how separate digital personas can reduce correlation and limit the impact of breaches, spam, and identity theft.
Confirm this action.
Leaving now will discard your changes.