RedHook Android RAT Gains Shell Access via Wireless ADB Loopback
July 13, 2026
Group-IB analyzed a new RedHook Android RAT variant that gains shell-level access by turning the device into its own ADB
Endpoint Security
RedHook Android RAT Gains Shell Access via Wireless ADB Loopback
Group-IB analyzed a new RedHook Android RAT variant that gains shell-level access by turning the device into its own ADB client via loopback, without rooting.
Compromised jscrambler npm Package Drops Rust Infostealer on Devs
An attacker compromised jscrambler's npm credentials and published five malicious versions dropping a Rust infostealer targeting cloud and AI credentials.
Binarly Finds Six U-Boot CVEs That Break Secure Boot on 50+ Firmware
Binarly disclosed six flaws in U-Boot's FIT signature verification subsystem, including two RCEs that bypass Secure Boot across more than 50 firmware releases.
Microsoft Patches RoguePlanet Defender Zero-Day CVE-2026-50656
Microsoft silently patched CVE-2026-50656 RoguePlanet via a Defender engine update, ending over three weeks of confirmed active SYSTEM privilege exploitation.
SCMBANKER Targets Mexican Banking With AI-Written PowerShell
Elastic Security Labs found REF6045 deploying SCMBANKER, an AI-written PowerShell toolkit that lets operators control Mexican banking sessions live and hijack transfers.
Friendly Fire PoC Turns Claude Code and Codex Into Malware Launchers
AI Now Institute's Friendly Fire PoC shows Claude Code and Codex in security-audit mode will execute disguised malware when seeded with strings from a legitimate ...
Microsoft Discloses GigaWiper: Disk Wiper Hidden Behind Fake Ransom
Microsoft disclosed GigaWiper, a Windows backdoor combining a real disk wiper, fake ransomware encryption, and multi-pass file overwriting in a single payload.
GodDamn Ransomware Uses PoisonX Driver to Kill EDR Before Encrypting
Symantec identified GodDamn ransomware using a kernel driver named PoisonX via the BYOVD technique to kill security software before file encryption begins.
Seven FatFs Flaws Threaten Cameras, Drones, and Crypto Wallets
runZero disclosed seven unpatched vulnerabilities in the FatFs filesystem library affecting hundreds of millions of IoT devices, drones, and hardware wallets.
Cisco Talos Exposes UAT-7810 LONGLEASH Backdoor on Ruckus Routers
Cisco Talos disclosed UAT-7810, a China-linked APT building the LapDogs ORB relay network using LONGLEASH malware on compromised Ruckus and ASUS routers.
Compromised jscrambler npm Package Drops Rust Infostealer on Devs
July 13, 2026
An attacker compromised jscrambler’s npm credentials and published five malicious versions dropping a Rust infostealer targeting cloud and AI credentials.
Binarly Finds Six U-Boot CVEs That Break Secure Boot on 50+ Firmware
July 13, 2026
Binarly disclosed six flaws in U-Boot’s FIT signature verification subsystem, including two RCEs that bypass Secure Boot across more than
Microsoft Patches RoguePlanet Defender Zero-Day CVE-2026-50656
July 10, 2026
Microsoft silently patched CVE-2026-50656 RoguePlanet via a Defender engine update, ending over three weeks of confirmed active SYSTEM privilege exploitation.
SCMBANKER Targets Mexican Banking With AI-Written PowerShell
July 10, 2026
Elastic Security Labs found REF6045 deploying SCMBANKER, an AI-written PowerShell toolkit that lets operators control Mexican banking sessions live and
Friendly Fire PoC Turns Claude Code and Codex Into Malware Launchers
July 10, 2026
AI Now Institute’s Friendly Fire PoC shows Claude Code and Codex in security-audit mode will execute disguised malware when seeded
Microsoft Discloses GigaWiper: Disk Wiper Hidden Behind Fake Ransom
July 10, 2026
Microsoft disclosed GigaWiper, a Windows backdoor combining a real disk wiper, fake ransomware encryption, and multi-pass file overwriting in a
GodDamn Ransomware Uses PoisonX Driver to Kill EDR Before Encrypting
July 10, 2026
Symantec identified GodDamn ransomware using a kernel driver named PoisonX via the BYOVD technique to kill security software before file
Seven FatFs Flaws Threaten Cameras, Drones, and Crypto Wallets
July 10, 2026
runZero disclosed seven unpatched vulnerabilities in the FatFs filesystem library affecting hundreds of millions of IoT devices, drones, and hardware
Cisco Talos Exposes UAT-7810 LONGLEASH Backdoor on Ruckus Routers
July 8, 2026
Cisco Talos disclosed UAT-7810, a China-linked APT building the LapDogs ORB relay network using LONGLEASH malware on compromised Ruckus and
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.