Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Akira Hits Safe Mode: Ransomware Rebooting Around EDR Multi-Functional Linux Botnet “Evooo1Bot” StubMaker RubyGems Campaign Delivers a Windows Infostealer Hunting MacSync Stealer infrastructure through behavioral pivots Manic: Blend between Banking Malware & Spyware Clop Returns with Custom Implant in Mass-Extortion Campaign The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile Striking gold: Inside the GoldDigger Android malware SilkParasite: Tracking a China-Nexus APT Across Central Asia Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux Implant The invisible passenger in your car Malware Crypting Services and the Threat Actors Who Sell Them Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign Survival of~the~Stealthiest: Evolving Low-Entropy Ransomware via~Genetic Algorithms Malformer: A Multi-Modal Malware Detector Using Transformers XAI-Guided Graph-Based Feature Engineering and Heterogeneous Ensemble Learning for Android Malware Detection An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands. The malware now requests VPN service permissions to create a local interface that allows it to control network traffic passing through it. The feature enables ToxicPanda 2.0 to block communication from Google Play and Google Play Services. Control at the network level permits the malware to interfere with various security checks and actions, such as app verifications, updates, Play Protect communication, or legitimate disruptions designed to protect users. After obtaining VPN service permissions, ToxicPanda 2.0 blocks communications to Google Play before extracting and installing its payload, then requests Accessibility Service permissions.
Iran-linked hackers shut down a UK power plant for four days in the first confirmed attack of its kind, concurrent with water infrastructure attacks across 12 US states. Iran-linked hackers shut down a British power plant for four days in what The Telegraph describes as the most successful cyberattack of its kind against UK energy infrastructure. “Iran shut down a British power plant for four days in an unprecedented cyber attack, The Telegraph can disclose.” reads the report published by The Telegraph. “It is thought to be the first time that hackers affiliated to the Iranian regime have succeeded in closing down such a facility in the UK, and is believed to be the most successful cyber attack of its kind.” British officials did not name the power plant because of security concerns. Staff worked for four days to restore it, but the plant was small and the outage did not affect the UK’s wider power supply. Still, the government warned power companies and businesses about the incident and provided guidance on how to respond. The attack was reported to the National Cyber Security Centre (NCSC), part of GCHQ, which helps protect the UK’s critical infrastructure. The NCSC did not comment on the specific incident. The US water infrastructure attacks hit dozens of wastewater treatment plants across 12 states, causing flooding and loss of pressure from taps. Authorities in affected areas told customers to boil water. The first reports came from Minnesota on July 26, followed by similar breaches in Michigan, Georgia, South Dakota, and New Jersey. The FBI attributed those incidents to “malicious cyber actors”; US government sources later confirmed the threat most likely originated in Tehran. The UK attack is not thought to have been designed to harm civilians. The more probable intent was to demonstrate that hackers linked to Iran’s Islamic Revolutionary Guard Corps could gain access to UK infrastructure and shut it down at will. A four-day outage at a small generator that nobody outside the industry noticed is, from that perspective, a successful proof of concept. Iran has accelerated its cyberattacks on Western countries since the US and Israel began air strikes in February. Suspected Iranian operations have been reported in Germany, Poland, Finland, Belgium, and Albania, with Israel and other Middle Eastern countries remaining the most frequent targets. In March, the NCSC advised British organisations to review their security posture in light of the wider conflict. NCSC chief executive Richard Horne said in June that the agency had handled more than 200 attacks on critical national infrastructure in the previous year alone. The timing is awkward for the intelligence and security committee, which oversees UK spying agencies. “Experts have long warned that the UK is unprepared for the scale of the threat of malicious cyber attacks from foreign adversaries, and the intelligence and security committee, which oversees spying agencies, reported last year that the chance of an Iranian cyber attack on British infrastructure was “unlikely”.” continues the report. A Cabinet Office risk assessment published last month placed the probability of a serious and successful cyberattack on domestic infrastructure at between five and twenty-five percent. The same document warned that AI is making attacks faster and cheaper to run, and is lowering the technical bar for anyone wanting to attempt them. The government’s public response leaned hard on the size of the target. A government source told The Telegraph: “We have thresholds for important generators to legally notify us of cyber activity, and this site is nowhere near. It’s a very small-scale site, less than a rounding error compared to grid capacity.” A government spokesman said the UK has a strong and resilient energy system and that the incident never threatened the wider power network. While both statements are technically true, they do not answer a key question: should it be considered acceptable for even a small power plant to remain offline for four days? Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iran-Linked Hackers)
New Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click Adversa AI researcher Rony Utevsky devised a new attack technique, called Cryptographic Context Injection, that bypasses AI safety filters by sending instructions as AES-encrypted ciphertext and tricking the model into decrypting them inside its own code execution runtime. The technique was demonstrated against two live production systems: xAI’s Grok and Google’s Gemini. “Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can’t read them, then tricks the AI into decrypting and trusting them as its own.” reads the report published by Adversa AI. “In Grok, an ordinary “summarize this page” steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.” The Grok case is the more serious of the two. A user asks Grok to summarize a webpage containing an encrypted payload and instructions to decrypt it. Grok visits the page, decrypts the payload in its Python sandbox, and follows the hidden instructions. It then accesses the user’s private session data, including their name, location, subscription plan, and full chat history, and puts this information into a URL that it opens automatically. The user receives no warning and does not need to click anything. The key technical distinction from earlier cipher-based prompt injection work is what happens during decryption. “Static safety guardrails classify inputs as text; they do not execute them. An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox.” continues the report. “Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time. “ Prior techniques like CipherChat and CodeChameleon used substitution ciphers, XOR, or base64, schemes the model can decode natively in its own context without an interpreter. AES-256-GCM can’t be decoded that way. Recovery requires the runtime, and that’s the channel the attack depends on. Once the runtime decrypts the payload, the attacker’s instructions appear as the output of code the model just ran, not as untrusted external content. “The runtime execution launders attacker-controlled data into trusted instructions the agent will act upon. That is how the attack got its name: cryptography helps fabricate trusted context for the agent.” states the report. “The same cryptographic backbone works whether the injection is direct or arrives indirectly, for example through the browsing channel.” The attacker payload inherits a credibility the same text would never get if pasted directly into the prompt. The Grok demo hides the data theft behind what looks like a normal request. The payload tells the model to create a “decryption key,” but the key is actually a template containing the user’s private data, such as their name, location, subscription tier, and chat history. Grok then uses this information as a URL parameter when opening an attacker-controlled website to “fetch additional context.” The data is sent through the URL as part of a seemingly normal web request. Adversa said the attack was still reproducible on August 19, 2026. Adversa traces the structural problem to Grok’s agentic framework, not to any model-layer failure. The framework lets instructions from an untrusted external page drive the invocation of a privileged, internet-connected tool. It allows private session metadata and conversation history to be resolved into the inputs of outbound calls. It enforces no egress boundary or consent gate on that path. Adversa’s description maps cleanly to SQL injection: a system that can’t distinguish its own trusted state from attacker-supplied data flowing through the same channel. The Gemini case uses the same basic trick but in a different way. A prompt asks Gemini to run a Python script that decrypts some data and returns a small JSON result. Instead, the decrypted data contains a fake Python error message with hidden instructions designed to bypass Gemini’s safety rules. Because Gemini treats the sandbox output as trusted context, those instructions can influence its behavior. Adversa used the technique to make Gemini generate detailed instructions for building an incendiary device. A modified version also exposed Gemini’s system instructions. Adversa reported the Grok issue to xAI on June 3, 2026, but received no further response after the initial acknowledgment. The attack was still working shortly before publication. The Gemini issue was not formally reported because Google’s bug bounty excludes jailbreaks. Adversa said Gemini’s vulnerability rate has nevertheless dropped sharply since June. For defenders, Adversa’s guidance is that nothing about this attack requires a fix at the model layer. Every control that bounds it sits in the harness around the agent. Untrusted content should be processed in a context with no tools and no credentials, returning only structured data to the privileged context. Outbound network calls and writes outside the workspace should require explicit confirmation with fully resolved arguments visible before approval. Per-session tool traces with resolved arguments should be logged, because without them there’s no forensics and no detection. Detection should alert on sequences, not individual payloads: untrusted content enters context, code executes, agent contacts a host outside its normal dependency graph. That chain is the signal, not any single ciphertext blob. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Cryptographic Context Injection)
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. Kaspersky researchers analyzed the malware and attributed the operation to the MoYu group, a threat actor previously associated with the BadBox malware botnet. The researchers note that this is the first documented case of a malware infection chain specifically created for the targeted car head unit. MoYu's operation targets systems from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd. DoFun is an automotive software, cloud services, and hardware provider that sells generic Android-based head units, which act as the command center for a car's infotainment, navigation, and settings systems.
A critical flaw (CVSS 9.4) in NASA/JPL’s AIT-GUI let anyone send unauthenticated commands to spacecraft instruments. Cycode researchers found that AIT-GUI, the browser-based operator console in NASA/JPL open-source AMMOS Instrument Toolkit, shipped with no authentication, no session checks, and no CSRF protection on any of its state-changing endpoints. “AIT-GUI, the web front end of NASA/JPL’s open-source AMMOS Instrument Toolkit, starts an HTTP server with no authentication, no authorization, and no CSRF protection on any of its state-changing endpoints.” reads the report published by Cycode. “Anyone who can reach the port, or any website an operator merely visits in a browser, can: Issue arbitrary commands via POST /cmd Run server-side scripts via POST /script/run Execute command sequences via POST /seq“ The vulnerability is tracked as GHSA-p9r8-2q67-fp86, rated Critical (CVSS score of 9.4), and fixed in AIT-GUI 2.5.2. AMMOS (Advanced Multi-Mission Operations System) is an open-source framework used by NASA/JPL and other missions to control spacecraft and instruments, send commands, and process the data they send back. AIT-GUI is the web interface operators use to do this in real time. Sending a command through this software is not like filling out a simple online form. The vulnerability isn’t one thing. It’s four ordinary web weaknesses that compose into something with unusual consequences. The first is that the server reads its configured host setting into a variable and then ignores it, binding instead to 0.0.0.0, which means all network interfaces. An operator who sets host: localhost to keep the console on the loopback gets a server exposed to the entire reachable network anyway. The second and third weaknesses follow from the first. There’s no login requirement, no session gate, no CSRF token, and no cross-origin restriction on any route. POST /cmd takes whatever arrives in the command field, parses it, and hands it directly to the command bus: no check, no validation, nothing between the network and the hardware. The fourth weakness lives on POST /seq and POST /script/run, which build filesystem paths by joining raw user input onto a root directory with no confinement. A seqfile value of ../../../../something resolves outside the intended sequence directory. The researchers note that the correct confinement check already exists in the same codebase, on a sibling route called /scripts/load; the safe pattern was already written, just not applied consistently. The CSRF risk is especially serious because a firewall does not stop it. Browsers can send certain form requests from another website without first checking with the target site. So, if an operator opens a malicious page in the same browser they use for the console, it could send commands such as POST /cmd, POST /seq, or POST /script/run. The attacker does not need direct access to the system or its network port—they only need the operator to open a malicious link. Cycode’s research team used a combination of AI-assisted code analysis and human validation to find and confirm the issues. The AI handled the initial codebase review, flagging recognizable patterns: state-changing routes with no auth anywhere in their call path, user input flowing from a request parameter into a subprocess call without sanitization, and a configuration value that was read and then silently discarded. The human researcher then confirmed each pattern was exploitable and reduced each to a working proof-of-concept, including a self-contained CSRF demonstration that drove a real headless browser and recorded zero network preflights. That second step matters. A pattern match points to a candidate; a reproduced exploit confirms the finding is real. Cycode says explicitly it only reports the second kind. “More broadly: operational and ground-system software inherits the same web weaknesses as everything else, but with a far higher cost of failure. Auth, CSRF defense, and input confinement are not optional extras on a panel that commands hardware.” concludes the report. The fix is in AIT-GUI 2.5.2. Operators should upgrade immediately and verify the console port is not reachable from untrusted networks. Anyone who ran an exposed instance before the patch should treat it as a reason to audit command and sequence history, since an unauthenticated POST leaves no user-level trace by design. Maintainers hardening deployments should add authentication and CSRF protection to the command, script, and sequence routes; bind the server to the configured host instead of 0.0.0.0; and apply the existing path-confinement logic from /scripts/load to /seq and /script/run. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NASA/JPL)
UMass Amherst researchers showed expired Visa contactless cards can make real purchases by exploiting an unsigned expiry field in Visa’s EMV kernel. Researchers at the University of Massachusetts Amherst demonstrated at USENIX Security 2026 in Baltimore that expired Visa contactless credit cards can complete real purchases, including transactions at live retail and grocery merchants, by exploiting a gap in how the payment protocol handles expiration dates. The paper is titled “Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments,” and the name is accurate. Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built the attack around a structural weakness in EMV, the contactless payment protocol used by Visa, Mastercard, American Express, and Discover. “A central source of fragility is that the EMV contactless protocol is a selectively authenticated transaction flow. Many data objects are exchanged in plaintext between the card and terminal [2], and only a subset is later bound to cryptographic verification via Offline Data Authentication (ODA) and issuer-verified cryptograms.” reads the paper. “In consequence, an adversary who obtains a man-in-the-middle position on the NFC channel can tamper with decision-critical fields that are consumed by the terminal but are not end-to-end integrity protected. Prior NFC attacks [10–12, 44], including relay-based manin-the-middle techniques, exploit this gap by manipulating transaction-relevant objects in transit while leaving cryptographic checks intact.” The attack exploits a specific design decision in Visa’s Kernel 3, the software layer that implements the EMV protocol for Visa transactions. A Visa contactless transaction presents the expiration date twice: once in a field the payment terminal reads (tag 5F24, the Application Expiration Date) and once in a field the issuing bank reads (tag 57, Track 2 Equivalent Data). These two representations should be tied together by a cryptographic signature, but in Visa’s implementation they aren’t. The relay attack changes only the expiry date that the payment terminal sees, replacing it with a future date while leaving the data sent to the bank unchanged. The card’s digital signature remains valid because it does not cover the expiry date. As a result, the bank receives a transaction that appears legitimate and passes its normal security checks. In simple terms, an attacker can change the expiry date between the card and the terminal without breaking the card’s cryptographic protection. The relay itself is two NFC-capable Android phones running custom software over Wi-Fi: one emulates a card, one emulates a terminal. Each communication round trip added roughly 20 milliseconds for relay alone and about 50 milliseconds with the date modification, keeping the per-transaction average around 415 milliseconds, within Visa’s 500-millisecond command limit. None of the test hardware used EMV’s optional Relay Resistance Protocol, which would have detected the added latency by bounding permissible response times. Mastercard, American Express, and Discover all blocked the attack. Mastercard’s terminal checks consistency between the two expiry representations during record parsing and treats a mismatch as a card data error. American Express binds the expiration date into the data covered by offline authentication, so a modified value produces a hash mismatch. Discover’s kernel wraps the modified transaction objects into the verified transaction hash, and those also failed. Visa’s Kernel 3 does none of these things. The outcome also depended on the issuing bank. The researchers tested three banks with expired and replaced physical Visa cards and found three distinct policies, not a clean pass or fail split. Bank A accepted the modified transactions at $1.00, $100.00, and $500.00 in the lab, and completed purchases of $2.79 at a retail merchant and $3.19 at a grocery merchant on campus. Bank A also accepted transactions from both the expired original card and its replacement against the same account simultaneously, a separate finding that Anwar described as alarming. Bank B detected the modification but still accepted some transactions. A third bank tested on Discover’s kernel detected the edit and declined; however, it also showed the simultaneous-card problem without any modification at all. There is another finding that makes the issue more serious. Researchers changed the Consumer Device Cardholder Verification Method flag at five US banks, and the transactions worked at most of them. This flag controls how the terminal verifies the cardholder, and attackers can change it because the payment data can be modified while it travels between the card and the terminal. There is also another problem with Kernel 3. It sends the issuer a Terminal Verification Results value filled with zeros. This means the bank cannot tell whether the terminal checked the card’s expiry date or whether that check failed. The bank must therefore approve the transaction without seeing what the terminal actually detected. “Across all tests, the dominant factors that determine attack success or failure are: (i) the EMV kernel in use and whether expiry data fields are cryptographically bound to authenticated protocol outputs; (ii) issuer-side lifecycle enforcement, especially whether authorization is tied only to the active account and PAN or also to the specific card instrument and expiration date; and (iii) whether terminal-side validation results are visible to the issuer via TVR. In contrast, transaction amount1 , merchant category, and POS terminal brand did not independently determine the transaction outcome.” continues the paper. The researchers disclosed the findings to Visa in May 2025 and followed up in December 2025. The paper records that Visa acknowledged the report, said it passed initial triage, and indicated it was undergoing reproduction by Visa’s red team. No CVE has been assigned. Neither Visa nor any of the notified banks confirmed any mitigation as of the paper’s acceptance. The Register asked Visa for comment and received no response. The countermeasures the paper proposes sit at the kernel, terminal, and issuer layers: bind the expiry date cryptographically to an issuer-verifiable signature, require terminals to compare both expiry representations and make mismatches visible to the issuer, and have issuers authorize against the PAN-and-expiry combination rather than the PAN alone. For cardholders, the researchers recommend destroying the chip and magnetic stripe of expired cards rather than discarding them intact. Given that the attack requires only the expired physical card or sustained NFC proximity to it, that guidance is now slightly less hypothetical than it was before this paper. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Visa)
A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. The attacker impersonates the target company's IT help desk, a tactic Microsoft highlighted earlier this year as increasingly common in multi-stage attacks. Expel’s security researcher Marcus Hutchins explains that the attacks direct the victim to install a fake “PowerShell Cleaner” executable (.MSI) hosted in Microsoft Azure, making the download appear trustworthy. Analysis of the malware showed "compile dates and file timestamps indicating it was first compiled and distributed around July 28, 2026." The installer extracts a PowerShell script named cleaner.ps1 and a ZIP archive containing the Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs.
More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 are still active and valid. Truffle Security has been tracking this exposure for the past four years and says that 817 of the exposed keys were linked to companies, 526 of them being AWS root keys. According to the researchers, 242 of the keys are associated with Identity and Access Management (IAM) users with the AdministratorAccess policy. This role has full permissions to create, modify, delete, and view virtually all AWS services and resources within an account. They note that each key of the 768 live keys in the two sets “full control of a company's AWS account.” The company found 431,875 AWS secrets across code repositories, Git history, datasets, Docker images, registries, and CI logs and extracted 64,024 unique AWS keys that corresponded to 50,654 AWS accounts after removing duplicates.
Using the same email, phone number, payment method, and other identifiers makes it easier for data brokers and attackers to profile your activity. Anonyome Labs explains how separate digital personas can reduce correlation and limit the impact of breaches, spam, and identity theft.
Confirm this action.
Leaving now will discard your changes.