Midnight Mimosa: When Your Android Phone Arrives Already Compromised
Worried about preinstalled malware on a budget Android phone? Learn what to check before buying, when to disconnect, and why a factory reset may not solve it.
Malware
9 articles
ClingSTUN: Linux Backdoor Uses Public STUN Servers After IoT Exploitation
ClingSTUN turns vulnerable Linux devices into proxy backdoors. Learn what STUN traffic proves, which persistence traces matter, and how to close the entry points.
Nordic Cyberattacks, August–September 2026: Data Theft, Service Disruption and ClickFix
A sourced Nordic review of CPR, Ryde, Dustin, Norwegian DDoS attacks and malicious websites in Finland and Iceland, with an early-October update.
Trump Died of Rabies — And What That Means for Your Package Manager
When DuckDuckGo's AI killed Trump with rabies, the world laughed. When AI coding assistants invent package names, attackers register them. Nobody's laughing then.
When Malware Rebuilds Itself: Defending Against GTG-20006's AI Evasion Loop
Anthropic observed a Russian-nexus espionage operator using AI workflows to modify and redeploy malware after detection. Hashes still help, but identity, behavior, network, and execution controls must carry the defense.
BREEZE COMET Did Not Steal Card Numbers. It Manipulated the Payment System
Google and Mandiant say BREEZE COMET compromises the identities, certificates, applications, and networks authorized to move money through Brazil's payment systems.
ChocoPoC: The Exploit You Cloned Is the Attack
ChocoPoC hides a remote access trojan inside trojanized CVE proof-of-concept repositories on GitHub, using a malicious PyPI dependency chain to compromise the researchers who clone them.
Operation Endgame Hits SocGholish: FakeUpdates Takedown
Operation Endgame's June 2026 action against SocGholish shows why fake browser updates, compromised WordPress sites, and criminal loader infrastructure still matter to defenders.
Quasar Linux QLNX: A Developer Workstation RAT Built for Supply Chain Access
Trend Micro documented QLNX, a Linux RAT that combines credential harvesting, LD_PRELOAD persistence, PAM backdoors, and rootkit behavior. The real risk is not one infected host - it is the supply chain access behind it.