-
Midnight Mimosa, a widespread Android malware campaign, is turning inexpensive smartphones into advertising fraud engines and potential residential proxy nodes by embedding malicious apps in device firmware before purchase. Bitdefender observed thousan…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Midnight Mimosa, an Android malware campaign embedded in firmware that monetizes compromised smartphones through advertising fraud and residential proxy services. Disclosed on October 8, the operation affected thousands of devices across more than 150 …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cling, an IoT botnet that disguises operator commands as Google STUN replies, blending malicious communications into routine NAT traversal traffic. Published October 1, the research documents exploitation of exposed networking devices and a command cha…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly identified Windows botnet dubbed x47.c is marketing a blend of conventional DDoS tooling, credential theft, SOCKS5 proxying, fast-flux command-and-control infrastructure, and an “AI API drain” capability designed to exhaust victims’ paid artifi…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The FBI and DOJ disrupted a global botnet used by QTFY to compromise IoT devices and conceal attacks against US government agencies and critical infrastructure.
·
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A multi-stage Android malware campaign that abuses the firmware-update mechanism of Android-based automotive head units to deploy ad-fraud tooling and enroll vehicles into a residential proxy botnet. The activity, discovered in June 2026, is the first …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly identified Linux botnet dubbed Evooo1Bot is targeting vulnerable internet-facing routers, edge appliances, cameras, and enterprise systems, combining Mirai-derived DDoS capabilities with proxy relaying, credential theft, SSH brute forcing, and …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Botnet operators are systematically probing router diagnostic interfaces for OS command injection flaws, chaining default credentials, legacy CGI endpoints, and weak command execution patterns to gain full remote control and deploy Mirai‑like payloads….
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A covert Monero (XMR) cryptomining campaign uncovered in May 2026 is abusing Linux Pluggable Authentication Modules (PAM) to evade detection, maintain fileless execution, and persist across multiple user accounts on compromised hosts. The operation, tr…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Tengu, a newly observed Mirai-derived botnet, is demonstrating how modern IoT malware is rapidly evolving beyond traditional distributed denial-of-service (DDoS) operations by integrating persistence, evasion, and multi-functional attack capabilities. …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
