NeedyMantis Is Hiding Behind Poedit, curl, Vim and TightVNC
Microsoft found NeedyMantis hiding beside legitimate software in targeted intrusions. The real hunt starts before the backdoor appears.
Malware
This Android Ransomware Can Watch Your Screen While Demanding Payment
Mantax Otax combines ransom demands with screen monitoring and message theft. Newer Android limits broad file encryption, but not every other risk.
Your Chinese Subsidiary Downloaded the Right Software From the Wrong Site
Microsoft says a China-focused campaign is rebuilding malicious installers between downloads, making familiar names and file hashes unreliable clues.
Authorities Turned Sality’s Own Peer-to-Peer Network Against It
A multinational operation redirected Sality's peer-to-peer command traffic into sinkholes after two decades and more than 11 million linked IP addresses.
The Extension Changed Owners. Its Permissions Did Not.
Nineteen Chrome and Edge extensions delivered wallet-draining and credential-stealing modules, including five legitimate tools weaponised after ownership changes.
The CAPTCHA was the Door. TerminalFix Turned One Windows PC Into a Network Tunnel.
A fake verification prompt led to DLL sideloading, Active Directory reconnaissance and a reverse tunnel that turned one Windows endpoint into an internal network pivot.
The Signed Driver’s Job Was to Kill Your EDR.
Cruciferra combines ClickFix delivery, a signed vulnerable driver, signed Microsoft binaries and process hollowing to disable endpoint security and deploy an infostealer.
The Phone Was Stolen. An AI Voice Agent Asked the Owner to Unlock It.
AnonyMousKIT combines stolen-device data, phishing pages and low-cost AI voice agents to obtain the credentials needed to disable Activation Lock.
The Package Wasn’t the Payload. Its Trusted Mirror Was the Phishing Site.
Attackers used npm packages as storage for fake verification pages rendered through trusted mirrors, turning legitimate CDN domains into phishing infrastructure.
ToxicPanda Blocked Google Play, Then Paired With ADB From Inside the Phone.
ToxicPanda 2.0 abuses VPN permission to cut off Google Play, then automates Android wireless debugging to obtain shell-level capability. The chain shows how legitimate platform functions can become a post-compromise control path.