A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."
Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The preinstalled
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration from various South Korea-based financial firms,
Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. Frontline Education is an edtech company that provides administration and workforce management software and services used by school districts. Last night, a reader shared a data breach notification with BleepingComputer that Frontline sent to an impacted school district, stating that attackers breached its environment through a vulnerability in a third-party application. "On August 14, 2026, our security team identified a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment," the notification letter reads.
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. In data breach notification letters shared online by affected individuals, the DMDC told affected military personnel that "a small number of unauthorized users" had access to their sensitive data, including personally identifiable information (PII), between October 2025 and July 2026 after exploiting a vulnerability in its file-sharing systems. The stolen data varies by person and includes Social Security numbers (SSNs), names, dates of birth, contact information, sex, race, and military personnel information. Pentagon officials told Federal News Network that the data breach affects more than 3 million people, including nearly 2.8 million living individuals and 294,000 "deceased individuals."
DOJ charges against Oxygen Forensics reveal the Russian-linked firm also sold forensic software to EU projects and European police forces for years. Last week’s Justice Department indictment of Oxygen Forensics looked, at first, like an American procurement scandal. CEO Lee Reiber and Russian co-founder Oleg Davydov stand accused of hiding that the company was Russian-owned and its software built in Russia, while it sold forensic tools to the Pentagon, the Secret Service, and other US agencies. Politico’s reporting shows the reach went a lot further than Washington. “The CEO of a Virginia-based software company and a Russian national have been arrested on a federal criminal complaint charging them with concealing from U.S. government agencies that their company was owned and controlled by Russian nationals and that its software was developed in Russia, the Justice Department announced today.” DoJ states. “Reiber allegedly represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia.” According to documents reviewed by Politico, Oxygen Forensics was involved in two EU-funded projects designed to improve how European investigators collect and share digital evidence. The first, EVIDENCE, ran from 2014 to 2016 and received more than €1.9 million in EU funding. Oxygen was consulted alongside organizations such as Europol, Eurojust and the European Anti-Fraud Office’s digital forensics unit. The second project, INSPECTr, was funded through Horizon 2020. It developed software that allowed investigators to combine evidence extracted with tools such as Oxygen’s with data from other systems. The project continued until 2023, after Russia’s invasion of Ukraine. “The second project, INSPECTr, backed under Horizon 2020, an EU research and innovation funding arm, was designed to help European police bring together and analyze digital evidence collected using different tools. It built software that could take evidence extracted with Oxygen Forensics and make it easier for investigators using other systems to access and analyze it.” reports POLITICO. “Although both of those EU-backed projects were launched well before Russia’s February 2022 full-scale invasion of Ukraine and subsequent European sanctions, INSEPCTr continued to operate until 2023.” The European Commission said Oxygen was not a formal member of either consortium and did not receive direct EU funding. It also noted that Russian entities have been excluded from Horizon Europe projects since the war began. That may be technically correct, but the issue is broader: Oxygen was still consulted on EU-funded projects dealing with digital evidence and investigative technology, even if it was not officially part of the project or directly funded by the EU. The domestic Russian side of this story is the part that should worry European agencies more than the funding technicality does. The same five people who secretly owned Oxygen Forensics also controlled MKO Systems, a Russian company selling the same underlying technology to the FSB and Russia’s Interior Ministry. That’s not two unrelated businesses that happen to share a founder. That’s one piece of forensic technology with two sets of customers who are, depending on how you look at it, on opposite sides of several ongoing investigations. And the client list in Europe, once you start counting, is long. Police agencies in Germany, Spain, Italy, and Poland accredited or purchased Oxygen’s products, according to EU tender records. Hungary’s police signed a contract worth roughly €27,000 in December 2024, running through the end of last year. A prosecutor’s office in Sardinia listed Oxygen among its recognized mobile-extraction systems as recently as April 2026, and a Spanish National Police inspector accredited by the company co-authored a 2026 study on cracking WhatsApp data on Android and iPhone. Romania and Latvia bought in as recently as this September, days before the arrests. There is also a more worrying case outside the EU. French outlet Disclose reported that Oxygen’s software was provided to Moroccan authorities through an EU-funded border management program covering the Maghreb. The EU also paid for training courses where Oxygen employees trained Moroccan police to use the software. In other words, a tool allegedly controlled by Russian interests was being used to train foreign law enforcement, with the training funded by the EU. Some agencies are now reacting. Romania’s National Anticorruption Directorate told Politico it will stop using Oxygen’s products after the ownership issue became public. However, this does not change any data that may already have been extracted using the software. Other national police agencies contacted by Politico did not respond. “In December 2022 and October 2023, Reiber falsely certified to the U.S. government that Oxygen Forensics had no immediate or highest-level owner. According to the affidavit, in November 2023, a reporter asked Reiber about Oxygen Forensics’ ownership and its connection to the Russian company.” continues DoJ. “Reiber then wrote to Davydov and two other Russian owners that public reporting on the connection “could destroy this entire opportunity,” referring to a pending contract with the National Computer Forensics Institute, and that the “current existence of this company hangs in the balance.”” Natalia Krapiva at Access Now put the stakes about as plainly as they can be put: civil society groups had flagged Oxygen’s Russian links for years, and this case just confirmed what they’d been saying. “If in fact Russian-made software designed for the FSB and Investigative Committee was used for handling EU Commission criminal evidence database, it raises a serious possibility of sensitive information being compromised and accessed by Russian authorities,” Krapiva told Politico. “We call on the EU and every government using these tools to suspend them and fully investigate how a Russian-owned company spent a decade inside Western law enforcement.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Oxygen Forensics)
Confirm this action.
Leaving now will discard your changes.