Summary
Pre-installed malware is turning budget Android phones into global ad-fraud engines, as Cyware.com highlights a supply-chain campaign that has quietly hijacked thousands of devices across more than 150 countries. Midnight Mimosa arrives embedded in device firmware, using system-level privileges to rotate monetization payloads and evade removal, with Bitdefender’s anomaly detection tool flagging the operation after spotting suspicious behavior patterns.
A critical Magento vulnerability, tracked as CVE-2026-75650 with a CVSS score of 10.0, is enabling attackers to take over e-commerce servers by running PHP code during email rendering. Active exploitation has already been observed, with attackers planting webshells and payment skimmers, prompting Adobe to issue an emergency patch and researchers to warn of widespread risk to online retailers.
The FBI has disrupted the China-linked Integrity Technology Group, seizing domains tied to hacking toolkits used against U.S. government, healthcare, and manufacturing sectors. Investigators linked the group to exploitation of known flaws and spear-phishing campaigns, with the takedown following prior sanctions and overlapping with clusters tracked as Flax Typhoon, Ethereal Panda, and Red Juliett.
Top Malware Reported in the Last 24 Hours
Midnight Mimosa ships inside budget Android firmware
Midnight Mimosa is a supply-chain Android malware campaign that arrives pre-installed in device firmware, giving it system-level control that owners can’t simply uninstall. It hides behind system-sounding components such as com[.]android.system.lite, then silently installs and removes apps, grants permissions, and can execute remote code to keep monetization payloads rotating. Bitdefender says it spotted the operation with its App Anomaly Detection tool, which flagged suspicious behavior patterns rather than relying only on static app checks. Under the hood, it uses a native library called libeasy[.]so to decrypt and drop an obfuscated framework, while its ad-fraud scheme generates money through synthetic clicks and spoofed Play provenance. The campaign has hit thousands of devices across more than 150 countries, led by Mexico, France, and Italy, followed by the US, Germany, Brazil, and Spain—turning everyday bargain phones into ad-fraud engines and botnet nodes.
CastleStealer breaks Chromium encryption defenses
CastleStealer is a C# information stealer that has evolved beyond basic credential theft by bypassing Chromium’s app-bound encryption (ABE) and adding remote command execution. It spreads through social engineering and malicious advertisements that funnel victims to fraudulent Node.js installation sites, pulling infection into what looks like routine developer activity. Once launched, it uses in-house loaders built for stealth, including multiple self-decryption stages, obfuscated API lookups, and sandbox checks designed to frustrate analysis. It targets both Chromium and Firefox data—saved logins, cookies, browsing history, and extension storage—meaning a single hit can quickly translate into account takeover and follow-on fraud. Researchers say it also self-deletes after running, helping it leave fewer clues behind on compromised machines.
TraderTraitor weaponizes Terraform to breach crypto
TraderTraitor, a North Korea-linked group, has been caught using a trojanized Terraform provider posing as an AWS provider to slip cross-platform malware into cryptocurrency environments. Zscaler ThreatLabz says the poisoned provider executes as soon as it loads, launching a Bash loader that chooses and downloads payloads based on whether the victim is on macOS, Linux, or Windows. The campaign delivers two named malware families—FLATROOF and ROOFDECK—which provide remote access and data theft capabilities suited to long-running intrusions. It disguises downloaded payloads as font files and plants them in OS-specific locations, setting the stage for persistence and continued remote control. For crypto firms and projects, the real-world impact is straightforward: compromised developer or build environments can expose credentials, wallets, and sensitive operational data tied directly to financial loss.
Top Vulnerabilities Reported in Last 24 hours
Magento checkout hack enables silent server takeovers
A critical Magento remote code execution bug dubbed StyleSmuggler (CVE-2026-75650, CVSS 10.0) lets attackers run PHP code during email rendering without authentication, opening the door to full takeover of vulnerable stores. The campaign abuses a styles URL parameter and flows through code paths involving components such as ArrayScanner.php and the S3Client constructor, which attackers use to plant webshells, relays, and payment skimmers. Attackers are already exploiting this in the wild, and Sansec described three criminal toolsets seen in real intrusions. Researchers at Sansec identified the activity on September 4, 2026. Adobe issued a patch on September 7, 2026 (VULN-39341), and Sansec also described using an A/B test marker to verify the fix and hunting for indicators of compromise.
Backup servers hit as AhsayCBS bugs spread
Two critical flaws in the AhsayCBS backup solution—CVE-2026-105133 and CVE-2026-105134—are being chained to gain unauthorized access and execute code on exposed systems. In reported attacks, adversaries use the Replication Receiver API path for unauthenticated RCE with System privileges and then drop payloads ranging from webshells to cryptominers. Attackers are already exploiting this in the wild. Security reporting described follow-on tactics including use of the vulnerable WinRing0x64.sys kernel driver for deeper access and an AI-assisted PowerShell script that watches for Task Manager and terminates it if it stays open too long, alongside persistence via NSSM-managed services. No patch was described as available in the source article, and defenders are urged to restrict management interface access to trusted IPs and watch for unauthorized services and processes.
NetScaler flaw risks remote access outages
A critical Citrix NetScaler ADC and Gateway vulnerability (CVE-2026-107406, CVSS 9.5) can enable remote code execution and potential denial of service on infrastructure many organizations rely on for remote access to business applications. The issue is described as a buffer overflow affecting systems configured as SAML SP or SAML IdP, as well as Secure Private Access Hybrid deployments that use NetScaler. No active, unmitigated exploitation has been publicly confirmed for this specific CVE in the provided reporting. The report frames the risk in the context of Citrix being a frequent target, with CISA aware of 27 Citrix vulnerabilities previously used in attacks. Citrix has released an update for CVE-2026-107406, and the coverage also highlights limiting SAML SP/IdP configurations to cases where they are truly necessary.
Top Threat Actors Reported in Last 24 hours
Integrity Tech tooling hit in FBI takedown
Integrity Technology Group, a China-linked contractor described as state-sponsored in the reporting, had key infrastructure disrupted after the FBI seized domains tied to its hacking toolkit used against critical infrastructure worldwide. Investigators said they used MicroScan to scan for and exploit known flaws including CVE-2015-3306 and CVE-2021-22205, while FishHub supported spear-phishing and data theft. The same activity set also included EBurst for password-spraying against Microsoft Exchange, reflecting an emphasis on breaking into email to collect sensitive communications. Targets cited across the disclosures include U.S. government agencies plus healthcare, education, and critical manufacturing—sectors where stolen access can ripple into service disruption for patients, students, and residents. The FBI action follows prior sanctions by the U.S., UK, and EU, and officials said the activity overlaps with clusters tracked as Flax Typhoon, Ethereal Panda, and Red Juliett.
UAC-0099 keeps evolving MATCHBOIL loader
UAC-0099, a Russia-aligned group, has continued refining its MATCHBOIL downloader from 2024 through 2026, turning it into a more durable entry point for follow-on payloads, according to ESET researchers. They spread it via spearphishing links that pull down an archive and trigger execution through a VBScript stage, after which the malware checks for prior installs and profiles the host. Over time, the group shifted persistence from registry-based methods to scheduled tasks and added sandbox detection, making infections harder to spot and analyze. Reported targeting in Ukraine spans multiple sectors, including transportation (July–August 2025), manufacturing (December 2025), and energy (June 2026), putting essential services and business operations at risk if systems are quietly held under adversary control. ESET tied the most recent evolution to heavier obfuscation, including use of the Eziriz .NET Reactor.
TraderTraitor poisons Terraform to hit crypto
TraderTraitor, a North Korea-linked threat group, was caught slipping malware into infrastructure-as-code workflows by using a trojanized Terraform provider masquerading as an AWS component, Zscaler ThreatLabz reported. They rely on a cross-platform Bash loader that chooses payloads based on the victim’s operating system and disguises downloads as font files, helping the activity blend into normal developer behavior. The campaign delivers backdoors and stealers, including FLATROOF—a Rust-based implant with redundant command channels such as Telegram Bot API and GitHub API polling—alongside Python tooling aimed at browser data and cryptocurrency wallet extensions. For crypto firms and developers, the consequence is immediate: compromised build and deployment environments can translate into stolen credentials, drained wallets, and loss of customer trust. Zscaler said the activity observed in July 2026 overlapped with the KelpDAO incident and also involved ROOFDECK’s layered C2 discovery.
Frequently Asked Questions
What is Midnight Mimosa? Midnight Mimosa is a supply-chain Android malware campaign that arrives pre-installed in device firmware, giving it system-level control that owners can’t simply uninstall. It hides behind system-sounding components such as com[.]android.system.lite, then silently installs and removes apps, grants permissions, and can execute remote code to keep monetization payloads rotating.
What is CastleStealer? CastleStealer is a C# information stealer that has evolved beyond basic credential theft by bypassing Chromium’s app-bound encryption (ABE) and adding remote command execution. It spreads through social engineering and malicious advertisements that funnel victims to fraudulent Node.js installation sites, pulling infection into what looks like routine developer activity.
What is TraderTraitor? TraderTraitor, a North Korea-linked group, has been caught using a trojanized Terraform provider posing as an AWS provider to slip cross-platform malware into cryptocurrency environments. Zscaler ThreatLabz says the poisoned provider executes as soon as it loads, launching a Bash loader that chooses and downloads payloads based on whether the victim is on macOS, Linux, or Windows.
What is CVE-2026-75650? A critical Magento remote code execution bug dubbed StyleSmuggler (CVE-2026-75650, CVSS 10.0) lets attackers run PHP code during email rendering without authentication, opening the door to full takeover of vulnerable stores. The campaign abuses a styles URL parameter and flows through code paths involving components such as ArrayScanner.php and the S3Client constructor, which attackers use to plant webshells, relays, and payment skimmers.
What is CVE-2026-105133? Two critical flaws in the AhsayCBS backup solution—CVE-2026-105133 and CVE-2026-105134—are being chained to gain unauthorized access and execute code on exposed systems. In reported attacks, adversaries use the Replication Receiver API path for unauthenticated RCE with System privileges and then drop payloads ranging from webshells to cryptominers.
What is CVE-2026-107406? A critical Citrix NetScaler ADC and Gateway vulnerability (CVE-2026-107406, CVSS 9.5) can enable remote code execution and potential denial of service on infrastructure many organizations rely on for remote access to business applications. The issue is described as a buffer overflow affecting systems configured as SAML SP or SAML IdP, as well as Secure Private Access Hybrid deployments that use NetScaler.
What is Integrity Technology Group? Integrity Technology Group, a China-linked contractor described as state-sponsored in the reporting, had key infrastructure disrupted after the FBI seized domains tied to its hacking toolkit used against critical infrastructure worldwide. Investigators said they used MicroScan to scan for and exploit known flaws including CVE-2015-3306 and CVE-2021-22205, while FishHub supported spear-phishing and data theft.
What is UAC-0099? UAC-0099, a Russia-aligned group, has continued refining its MATCHBOIL downloader from 2024 through 2026, turning it into a more durable entry point for follow-on payloads, according to ESET researchers. They spread it via spearphishing links that pull down an archive and trigger execution through a VBScript stage, after which the malware checks for prior installs and profiles the host.
What is TraderTraitor? TraderTraitor, a North Korea-linked threat group, was caught slipping malware into infrastructure-as-code workflows by using a trojanized Terraform provider masquerading as an AWS component, Zscaler ThreatLabz reported. They rely on a cross-platform Bash loader that chooses payloads based on the victim’s operating system and disguises downloads as font files, helping the activity blend into normal developer behavior.