
RatHat Turns Android’s Own Debugging Tools and Generative AI Into a Persistent Control Channel
RatHat Android malware abuses Accessibility to enable wireless ADB, persist via reverse proxy, and use AI for screen navigation and banking theft.

RatHat Android malware abuses Accessibility to enable wireless ADB, persist via reverse proxy, and use AI for screen navigation and banking theft.

BambooToken malware uses MQTT brokers to control Windows and Linux hosts, enabling stealthy commands, data collection and modular plugins.

Hackers hijacked HBO Max's verified Reddit account to post 108 ClickFix ads targeting Windows and macOS users with credential stealers and crypto malware.

Twitch Enhanced Viewer extension sent users' OAuth tokens to JeetBot proxies, exposing nearly 31,000 Chrome and Firefox users to account takeover.

GoldFactory uses Gigabud and Vwork to clone Indonesian banking apps inside Android Work Profiles, evading fraud controls and causing $1M losses.

Thousands of deceptive Android applications are abusing Google Play’s Early Access program to attract installs without exposing users to public reviews or

Mantax Otax Android malware encrypts files on Android 9 or older, steals SMS, screen data, and harasses victims. Distributed via APKs outside Google Play.

U.S. authorities seize Telegram channels and crypto wallets, freeze $52.8M in USDT, and sanction Xinbi Guarantee, a marketplace enabling pig-butchering scams.

Hackers compromise F5 BIG-IP APM with fileless Linux rootkit injecting a memory-resident web shell, evading file scans. Vector unknown.