Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE. MalwareHunterTeam observed this unusual technique in July in an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands. FTP banners are text strings the server uses as a greeting message for connecting hosts before they log in. By embedding commands in the initial response sent when a compromised system connects to an FTP server, a malware stager can receive instructions from a remote server. After discovering FTP banners being used to deliver malicious commands during an investigation, researchers at threat intelligence platform SOCRadar expanded their hunt and found that the technique remains in use.
GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects. WatchTowr researchers warn of active exploitation of critical GitLab flaw CVE-2026-19478 (CVSS score of 9.4). This week, GitLab pushed out an emergency patch to address this flaw, which could let an attacker with zero credentials remotely modify or delete public projects and user data. “GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory. GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one. hiimguardian reported the flaw through the company HackerOne bug bounty program. Organizations should urgently patch internet-facing GitLab servers. Until they can update, they should restrict unauthenticated access to /api/graphql, disable public repositories where possible, and check logs for requests containing @gl_introduced. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CVE-2026-19478)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-72529 (CVSS score of 9.3) TrueConf Server Missing Authentication for Critical Function Vulnerability CVE-2026-72530 (CVSS score of 9.5) TrueConf Server Code Injection Vulnerability TrueConf Server is an on-premises video conferencing and unified communications platform developed by TrueConf. Organizations can deploy it on their own infrastructure to provide secure video meetings, voice calls, messaging and collaboration without relying entirely on a cloud service. It is typically used by businesses, government organizations and other institutions that want to keep communications and related data under their own control. CVE-2026-72529 is a remote code execution vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to execute arbitrary scripts by calling an undocumented function. The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. An attacker who can reach the vulnerable service could potentially compromise the server and use it as an entry point into the affected network. CVE-2026-72530 is a sandbox escape vulnerability in TrueConf Server that allows an unauthenticated remote attacker with network access to TCP port 4307 to break out of an isolated environment and execute arbitrary code on the underlying host. The flaw affects TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, 5.5.x through 5.5.5, and earlier versions. By sending a specially crafted script, an attacker could escape the restricted environment and gain code execution on the host system, potentially leading to a full server compromise. In the context of CVE-2026-72529 and CVE-2026-72530, the concern is that vulnerable TrueConf Server installations exposed on TCP port 4307 could provide attackers with a path to execute code on the server. Vyacheslav Kopeytsev from Kaspersky ICS CERT discovered both vulnerabilities. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2nd. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a
Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. "The malware spread through the built-in updaters of
Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate
Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review. Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, regardless of the device configuration. A brief description of each of the flaws is below -
A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring
Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action is required. The vulnerability, tracked as CVE-2026-69836 (CVSS score: 10.0), is a case of remote code execution impacting the tech giant's cloud-based identity and access management service. It was previously called Azure Active Directory
Manic Android malware combines banking fraud and spyware, using a Bluetooth relay to steal data even when devices are offline. ThreatFabric’s Mobile Threat Intelligence team has identified a new Android malware, dubbed Manic, which has been active in the wild since at least February 2026. The researchers state that the malware is still under development as of July. “Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features.” reads the report published by the ThreatFabric’s Mobile Threat Intelligence team. “Its targeting is strongly focused on Ukraine, covering Ukrainian banks, government and identity services, and messaging applications, while also extending to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications.” The malware monitors 169 different Android apps, including banking and payment apps across several European countries, government and eID services, crypto exchanges and wallets, 2FA tools, messaging apps, browsers and email clients. This wide coverage appears deliberate. By targeting both financial and communication apps, the attackers can track a victim’s money, messages, location and files from the same device. ThreatFabric traces the first infrastructure registrations back to February 2026, with development and production services appearing in late March and April. By July, an updated build had added stronger anti-analysis checks, in-memory DEX loading, and a technique the researchers call lock-secret phishing, which extracts the device PIN or pattern by presenting a fake prompt before the victim reaches the real lock screen. Once installed, Manic requests Accessibility and notification access, then uses the Accessibility service as a UI keylogger. It classifies everything it captures before logging it: lock-screen input, recovery phrase candidates, four-to-six-digit SMS codes, passwords, long messages, email logins, and ordinary text. “Manic uses its Accessibility service as a UI keylogger. It classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.” continues the report. “Each key log record includes the app and package, captured text, timestamp, whether the input came from Autofill or manual entry, and whether the app is on Manic’s target list “ Each log record includes the app name and package, the captured text, a timestamp, whether input came from autofill or manual entry, and whether the app is on Manic’s target list. The PIN theft technique works differently from a typical banking overlay. When Manic detects a numeric keypad in a targeted app, it places an invisible layer over the keys and records each tap. It then briefly passes the tap to the real keypad using Android’s Accessibility features, so the banking app works normally while Manic captures the PIN. Another function, called autoEnterPin, can try to enter a stored PIN or pattern on the Android lock screen. This gives attackers two options: capture a PIN during a banking session and later use it to unlock the device without the victim being present. According to the researchers, Manic stands out for its offline relay. “Manic uses a store-and-forward relay mechanism to exfiltrate data even when the infected device cannot reach the C2 server directly.” continues the report. “Collected files and command results are encrypted with AES-GCM and placed in a local queue, allowing the source device to remain offline while the malware searches for another infected device that can provide a route to the C2 infrastructure.” Manic searches for nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, and supports chains of up to four relay hops. Cutting an infected phone off from the Internet doesn’t cut it off from exfiltration, as long as another infected device is within radio range. It’s a store-and-forward mesh built out of other people’s compromised phones. Manic gives attackers remote control of the device through WebRTC, allowing them to view the screen and interact with it using Android’s Accessibility features. It can hide its activity with black screens, fake screens or fake update messages, while also covering permission requests. The July version goes a step further by removing itself from the device’s app launcher. This keeps it out of the normal app list and lets attackers activate it through its wrapper or a deep link. For defenders, the combination here is complete in an uncomfortable way: credential theft, live screen monitoring, authentication interception, device takeover, and an exfiltration path that doesn’t require the infected device to have Internet access at all. Monitoring for unusual Accessibility service grants and unexpected Bluetooth or Wi-Fi Direct connections from phones that aren’t actively transferring files are the most practical detection starting points. “Manic is an evolving Android fraud platform designed for Device Takeover (DTO), combining credential and authentication theft with live screen monitoring and remote control. Its targeting spans banks, payment and cryptocurrency services, eID applications, and messengers, with a strong focus on Ukraine.” concludes the report. “A particularly distinctive capability is its offline mesh relay, which allows collected data to move through nearby infected devices over Wi-Fi Direct or Bluetooth when direct C2 access is unavailable. “ Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Android Malware)
Confirm this action.
Leaving now will discard your changes.