A silent takeover is unfolding through cheap, everyday smart devices. The FBI has reported over a million infections tied to BADBOX 2.0, a malware campaign targeting uncertified Android-based smart TVs, tablets, and IoT devices. Preinstalled malware and rogue updates turn these devices into residential proxies, with infections spanning 222 countries.

A harmless-looking paste site is quietly fueling major malware campaigns. Cybercriminals are leveraging Paste[.]ee to host malicious scripts that deliver strains like XWorm and AsyncRAT through phishing emails. The platform’s anonymity helps attackers avoid detection while executing keylogging, credential theft, and remote system manipulation.

A spearphishing campaign is exploiting a critical flaw in Roundcube to compromise webmail users. Threat actor UNC1151 targeted Polish organizations using CVE-2024-42009 to execute JavaScript via XSS and plant a persistent Service Worker. The vulnerability affects multiple Roundcube versions and carries a CVSS score of 9.3.

Top Malware Reported in the Last 24 Hours

BADBOX 2.0 campaign on the rise, warns FBI

The FBI reported that the BADBOX 2.0 malware has infected over one million internet-connected devices, primarily Chinese-manufactured Android-based smart TVs, tablets, and IoT devices, turning them into residential proxies for malicious activities. Devices are infected through preloaded malware, malicious firmware updates, or apps downloaded from unofficial marketplaces. Once compromised, they connect to C2 servers for tasks like ad fraud, credential stuffing, and routing malicious traffic. The malware primarily targets uncertified Android Open Source Project devices, often from lesser-known brands, and impacts devices in 222 countries. BADBOX 2.0 evolved from the original BADBOX malware discovered in 2023 and has spread globally, with significant infections in Brazil (37.6%), the US (18.2%), and Mexico (6.3%).

Paste[.]ee abused to drop XWorm and AsyncRAT

Paste.ee is being misused by cybercriminals to distribute malware, including XWorm and AsyncRAT, via phishing emails. Attackers exploit Paste[.]ee’s anonymity and accessibility to host malicious scripts, complicating traceability and bypassing security defenses. XWorm and AsyncRAT enable keylogging, credential theft, and system manipulation, with advanced evasion tactics like polymorphic code and encrypted communications. The attacks pose significant risks to sectors like banking, potentially stealing sensitive credentials, and share similarities with tactics used by APT groups.

Details on Operation DRAGONCLONE

Operation DRAGONCLONE is a malicious campaign targeting China Mobile Tietong Co., Ltd. using VELETRIX and VShell malware. The attack begins with a malicious ZIP file containing signed and unsigned binaries, employing DLL-sideloading techniques. VELETRIX uses anti-sandbox methods, such as execution delays and IPFuscation to obfuscate shellcode, which is executed via callback mechanisms. The campaign has identified 44 implants linked to known APT groups like UNC5174 and Earth Lamia, utilizing tools like Cobalt Strike and SuperShell. The operation has been active since March, showcasing advanced techniques for persistence and evasion.

Top Vulnerabilities Reported in the Last 24 Hours

Attackers abuse Roundcube bug

Hackers exploited a critical vulnerability (CVE-2024-42009) in the Roundcube webmail platform to steal user credentials via a spearphishing campaign targeting Polish entities. This attack, attributed to the UNC1151 threat actor linked to Belarusian and possibly Russian state interests, used XSS to execute malicious JavaScript and register a Service Worker for persistent access. The vulnerability affects Roundcube versions ≤1.5.7 and 1.6.x ≤1.6.7, with a CVSS score of 9.3. Another vulnerability (CVE-2025-49113) allowing remote code execution has been identified but not yet exploited. 

Critical flaw in HPE Insight Remote Support (IRS)

Multiple high-severity vulnerabilities (CVE-2025-37097, CVE-2025-37098, CVE-2025-37099) were found in HPE IRS software, allowing remote attackers to execute arbitrary code and access sensitive data. The flaws include Directory Traversal, RCE, and XML External Entity (XXE) injection, which can compromise system integrity and leak sensitive information. Successful exploitation enables attackers to place malicious files, steal authentication tokens, and escalate privileges. HPE has released IRS version 7.15.0.646, addressing these vulnerabilities with improved input validation, XML parsing security, and authentication checks.