Android
Hackers Turn Low-Cost Android Phones Into Hidden Proxy Botnets Through Preinstalled Malware
Midnight Mimosa, a widespread Android malware campaign, is turning inexpensive smartphones into advertising fraud engines and potential residential proxy nodes by embedding malicious apps in device firmware before purchase....
Android
Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
Midnight Mimosa, an Android malware campaign embedded in firmware that monetizes compromised smartphones through advertising fraud and residential proxy services.
Disclosed on October 8,...
Botnet
Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices
Cling, an IoT botnet that disguises operator commands as Google STUN replies, blending malicious communications into routine NAT traversal traffic.
Published October 1, the...
AI
New AI-Powered Botnet x47.c Steals Credentials and Drains AI Account Credits
A newly identified Windows botnet dubbed x47.c is marketing a blend of conventional DDoS tooling, credential theft, SOCKS5 proxying, fast-flux command-and-control infrastructure, and an...
Android
First Android Malware Targeting Car Head Units Uses Firmware Updates to Build Proxy Botnet
A multi-stage Android malware campaign that abuses the firmware-update mechanism of Android-based automotive head units to deploy ad-fraud tooling and enroll vehicles into a...
Botnet
Evooo1Bot Turns Compromised Routers Into DDoS Bots and Anonymous Proxy Nodes
A newly identified Linux botnet dubbed Evooo1Bot is targeting vulnerable internet-facing routers, edge appliances, cameras, and enterprise systems, combining Mirai-derived DDoS capabilities with proxy...
Botnet
Botnet Scans Router Diagnostic Tools for OS Command Injection Vulnerabilities
Botnet operators are systematically probing router diagnostic interfaces for OS command injection flaws, chaining default credentials, legacy CGI endpoints, and weak command execution patterns...
Botnet
Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access
A covert Monero (XMR) cryptomining campaign uncovered in May 2026 is abusing Linux Pluggable Authentication Modules (PAM) to evade detection, maintain fileless execution, and...
Botnet
Tengu Mirai Botnet Uses Watchdog Reboots and Binary Bricking to Resist Removal
Tengu, a newly observed Mirai-derived botnet, is demonstrating how modern IoT malware is rapidly evolving beyond traditional distributed denial-of-service (DDoS) operations by integrating persistence,...
Botnet
Dysphoria IoT Botnet Uses Blockchain Domains and 200,000 Devices for DDoS Attacks
A rapidly evolving IoT botnet dubbed “Dysphoria” has emerged as a significant global threat, leveraging blockchain-based domain resolution and a hybrid command-and-control (C2) architecture...
Botnet
Hackers Turn GitHub Actions Into a Global Botnet for Attacking Web Hosting Servers
Hackers are abusing compromised GitHub repositories and GitHub Actions workflows to build a de facto global botnet that scans and exploits web hosting servers,...