An exposed attack server led Lexfo to three Microsoft 365 phishing operations using Evilginx and device code abuse to capture sessions.
Category: cybercrime/malcode – Page 3
New CrashStealer malware poses as Apple crash reporting tool
A new macOS information-stealing malware called CrashStealer pretends to be Apple’s crash-reporting tool to steal credentials, keychain data, and crypto wallets.
Malware researchers started tracking the malware in May, when it appeared to still be in development, but observed it being used in attacks in early July.
CrashStealer has a typical infostealer capability set that seems to focus on password managers and more than 80 crypto wallet extensions.
CISA warns of actively exploited RCE flaws in Joomla extensions
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads.
The agency has categorized the flaws as a maximum priority, ordering federal agencies to apply available security updates and/or mitigations within three days, with the deadline set for today.
The first flaw, tracked as CVE-2026–48939, is an arbitrary file upload flaw impacting the iCagenda extension used for registering and scheduling events and creating calendars.
RedHook Android malware now uses Wireless ADB for shell access
A new version of the RedHook Android malware abuses the Android Wireless Debugging (Wireless ADB) mechanism in a novel way to gain shell-level privileges without requiring a computer connection.
Researchers at cybersecurity company Group-IB analyzed the new release of the mobile malware and say that it significantly expands its capabilities compared to the previous variant documented in 2025.
At the same time, the malware retains its remote access trojan (RAT) features, allowing it to stream the screen, intercept keystrokes, automate UI interactions, and steal credentials.
New U-Boot flaws could enable stealthy firmware attacks
Six vulnerabilities in the widely used U-Boot bootloader have been discovered that could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks that compromise security protections and install persistent malware.
U-Boot is one of the world’s most widely used open-source bootloaders and is found in many embedded Linux devices, including enterprise servers’ Baseboard Management Controllers (BMCs), networking equipment, industrial systems, IoT devices, and other appliances.
Because U-Boot is responsible for loading the operating system, vulnerabilities in the bootloader can allow attackers to compromise a device before the operating system and its security software have a chance to start.
Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks
A 41-year-old former ransomware negotiator has been sentenced to nearly six years (i.e., 70 months) in prison in the U.S. for their role in conspiring with the now-defunct BlackCat ransomware operators to extort multiple victims and working with two other cybersecurity professionals to target additional victims in 2023.
In a sentencing memorandum, federal prosecutors described Martino as a “double agent working to maximize the harm to his clients and the financial gain to cybercriminals who paid him a part of the ransom.”
Angelo Martino, 41, of Land O’Lakes, Florida, pleaded guilty to one-count information charging him with conspiring to interfere with interstate commerce through extortion back in April. The defendant worked as a negotiator on behalf of five different ransomware victims, while providing BlackCat attackers with confidential information regarding their negotiating position and strategy without their knowledge or permission.
Beyond Agentic AI: The Emergence Of Cognitive AI Ecosystems
In the next decade, AI will likely undergo more significant changes than only becoming more independent; it will also grow more cognitive. AI systems will act as interconnected ecosystems that are capable of contextual awareness, cooperative reasoning, ongoing learning, and adaptive decision-making in almost every facet of society, rather than isolated applications.
Large language models of today are remarkable due to their ability to produce and anticipate information. Persistent memory, multimodal perception, long-term planning, causal reasoning, and self-directed learning within strictly regulated bounds will probably be characteristics of the AI of 2036. Similar to biological neural networks, millions of specialized AI agents will work together to create dynamic intelligence fabrics that continuously optimize national defense, manufacturing, transportation, financial markets, healthcare delivery, and energy grids.
The line between workforce and software will become increasingly hazy. Hundreds of thousands of AI agents working continuously alongside human employees may be employed by organizations as digital workforces. A customized constellation of AI advisers, researchers, legal assistants, financial analysts, engineers, and cybersecurity specialists working around the clock could be present for every knowledge worker. This shift signifies the emergence of an entirely new digital labor force in addition to automation.
