VulnHub

Recent findings reveal that low-cost Android smartphones, particularly those using MediaTek platforms, are being shipped with preinstalled malware known as Midnight Mimosa. This malicious software enables attackers to covertly install additional applications, engage in ad fraud, and convert the devices into residential proxies. The issue affects various smartphone brands that utilize these MediaTek platforms, posing a significant risk to users' privacy and security. The presence of malware at the firmware level complicates detection and removal, leaving many users unaware that their devices are compromised. This incident raises concerns about the security practices of manufacturers and the potential for widespread exploitation of infected devices.

Recent reports indicate that attackers have successfully compromised three country code top-level domains (ccTLDs): .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). By breaching the registries for these domains, they managed to obtain unauthorized HTTPS certificates. This is concerning because it could allow malicious actors to impersonate legitimate websites, potentially leading to phishing attacks or data breaches. The incident raises alarms about the security of domain registries and the importance of safeguarding against such intrusions. Users and organizations relying on these domains need to be vigilant and consider additional security measures to protect their online presence.

In October 2026, Android released updates that patched 25 vulnerabilities, including a significant flaw in the System component that could allow attackers to escalate their privileges. This particular vulnerability is critical, meaning it poses a serious risk to device security. Users of Android devices should install the latest updates as soon as possible to protect their systems from potential exploitation. The updates address weaknesses across various Android versions, ensuring that devices remain secure against these threats. Keeping software up to date is essential for maintaining security and preventing unauthorized access.

The Viidure Dashcam Android Application is facing serious security vulnerabilities that could allow attackers to access sensitive user data and critical system files. Two main issues have been identified: one involves a misconfigured cloud storage backend that permits unrestricted public access to sensitive records and live footage, while the other reveals hard-coded credentials embedded in the application, granting full access to critical storage. Affected users are running versions of the app prior to 3.3.1.260403. Despite the severity of these vulnerabilities, Viidure has not provided any fixes and did not respond to CISA's attempts to coordinate on these issues. Users are advised to contact Viidure support for more information and to take defensive measures to secure their systems.

A new Android banking trojan called RatHat is being controlled through a web console used by its operators to manage infected devices. Security firm Cleafy has identified nearly 100 instances of this console being deployed since April 2026. This malware operates on a malware-as-a-service model, allowing different customers to run their own versions of the trojan. The console collects various data from compromised phones, which can include sensitive financial information. The use of this malware poses significant risks to users, particularly those with banking applications on their Android devices, as attackers can steal personal and financial information with relative ease.

A popular Chrome extension called 'Poper Blocker,' which claims to block ads, has been found to be harvesting sensitive user data. Researchers reported that the extension, despite being downloaded millions of times and having Google’s approval, is actually functioning as spyware. It collects extensive information from users, raising serious privacy concerns. This incident highlights a significant risk for millions of users who may have trusted the extension for its advertised functionality. The situation calls into question the vetting process for applications in the Chrome Store and the potential for malicious software masquerading as legitimate tools.

Google has issued a warning about a surge in attacks exploiting a serious vulnerability in Oracle PeopleSoft, identified as CVE-2026-35273. This flaw has a CVSS score of 9.8, indicating a high risk of unauthorized remote code execution. The attacks are linked to the ShinyHunters group and are targeting various sectors worldwide. Organizations using Oracle PeopleSoft should take immediate action to secure their systems, as the vulnerability is currently being exploited in the wild. This situation underscores the need for companies to stay vigilant and apply necessary patches to mitigate the risk of exploitation.

A Chinese hacking group known as UTA0565 has been exploiting a recently discovered exploit chain affecting Google Chrome and Microsoft Windows. The attacks, which took place on September 3 and 4, 2026, take advantage of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one in Windows (CVE-2026-85880). By using fake websites, the attackers are able to deploy a malware variant named CLEANGULP. This is concerning as it indicates a coordinated effort to target users of these widely-used platforms, potentially compromising sensitive information and system integrity. Users of both Chrome and Windows should be vigilant and consider updating their systems promptly to mitigate the risks associated with these vulnerabilities.

The RatHat Android Trojan is a new piece of malware that uses artificial intelligence to enhance its ability to navigate and control infected devices in real-time. This makes it more adaptable and harder to detect by traditional security measures. Users of Android devices are particularly at risk, as the malware can exploit vulnerabilities to take control of their devices. The implications of this are significant, as it could lead to unauthorized access to personal information, financial data, and other sensitive content. As the malware continues to evolve, it raises concerns about the effectiveness of current security protocols against AI-driven threats.