VIRY.CZRADAR
sektor
téma
typ textu
zrušit filtry

Výsledky hledání

sektor: finance× typ: rozbor× v celém archivu zrušit filtry

24 karet z 24 položek CZ · EN/orig

1

New Android malware uses AI to steal bank logins and PINs

Researchers at Zimperium’s zLabs have analyzed an Android Trojan that uses an automated, multi-stage infection process. What’s new is that RatHat gives a live AI assistant the keys to the accessibility tree of the infected device and uses it to determine where to tap or scroll, rather than following a hardcoded script. The variable attack path makes it harder for signature- and rule-based mobile security tools to detect this Trojan. It also abuses Android Debug Bridge (ADB), a legitimate tool…

Google finance US

tg: rozbor tg: propagace tp: malware tp: podvod tp: AI tp: identita

· Malwarebytes Labs · New Android malware uses AI to steal bank logins and PINs

1

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic Security Labs has tracked REF9334, a Brazilian banking malware operation, since May 2025. Its toolkit is called KREMLIN (as named by the malware author, Kr3mlin4rt1st), though nothing about the operation is Russian. Lures impersonate twelve Brazilian banks; error messages and code comments are written in Portuguese, and the operators' Ethereum transactions cluster during São Paulo working hours. Over 15 months and seven campaigns, they built a malicious browser extension that installs…

Google Microsoft finance US

tg: varování tg: rozbor tp: malware tp: podvod

· Elastic Security · The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

1

Android malware creates a hidden copy of your banking app

Researchers at Group-IB found that the Android banking Trojan Gigabud can create a separate work profile on an infected phone and run a cloned banking app inside it. The attacker can then carry out fraudulent transactions in the new profile, potentially separating them from signs of malware detected elsewhere on the device. To do this, Gigabud installs Vwork, a malicious version of the legitimate open-source tool Shelter. Shelter normally lets Android users isolate apps or run second copies of…

finance US

tg: rozbor tg: propagace tp: malware tp: phishing tp: podvod

· Malwarebytes Labs · Android malware creates a hidden copy of your banking app

1

1

1

ASCII smuggling crosses over from AI prompt injection to phishing evasion

In this article What is ASCII smuggling?Writing a practical ASCII-smuggling signatureWhat we observed: ASCII smuggling repurposed for phishingWhat is known and what is newIs there a detection gap?Mitigation and protection guidanceReferencesLearn More Microsoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized in AI prompt injection research as ASCII Smuggling. Instead of using these characters to hide instructions from people…

Microsoft finance US

tg: varování tg: rozbor tp: phishing tp: AI

· Microsoft Security Blog · ASCII smuggling crosses over from AI prompt injection to phishing evasion

4

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

While monitoring Mirage Kitten activity, we uncovered a previously undocumented malware family that we dubbed NodeRabbit. We identified the first sample on a system in Afghanistan. Further threat hunting revealed two additional, more advanced, variants: one on a system in Egypt and another on a system in Ethiopia. NodeRabbit is a cross-platform remote access trojan (RAT) built with Node.js. It targets Windows, Linux, and macOS. Its operators deliver it through spear-phishing messages on…

doprava finance RU

tg: varování tg: rozbor tp: malware tp: phishing tp: špionáž

· Securelist (Kaspersky) · Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Financially Motivated Threat Actor BREEZE COMET Targets Brazil

Introduction Beginning in 2024 Mandiant investigated a string of compromises affecting Brazilian financial services, retail, and eCommerce organizations. Google Threat Intelligence Group (GTIG) tracks this activity as BREEZE COMET (formerly UNC5669), a financially motivated threat actor specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers. This activity overlaps with operations publicly reported as Plump Spider and SHADOW-AETHER-064. In…

finance obchod US

tg: varování tg: rozbor tp: malware tp: phishing tp: podvod tp: AI

· Mandiant / Google TI · Financially Motivated Threat Actor BREEZE COMET Targets Brazil

1

Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

IntroductionDespite modern verification controls, identity theft remains one of the most pervasive threats to both individuals and enterprise organizations. U.S. Federal Trade Commission statistics show over 1 million identity theft reports annually, with related fraud and imposter scams accounting for billions in financial losses each year. While stolen credit cards enable rapid, short-term monetization, Social Security numbers (SSNs) represent a far more permanent and dangerous tier within…

finance US

tg: incident tg: rozbor tp: únik dat tp: identita

· Rapid7 · Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

1

1

ToxicPanda 2.0 can take over your Android phone and banking apps

Researchers have uncovered ToxicPanda 2.0, an Android banking Trojan and remote-access tool designed for account takeover and “on-device fraud.” Not only does ToxicPanda 2.0 have a much larger target list of banks and e-wallets, it has also expanded its capabilities by combining banking overlays, remote access, PIN capture, Android accessibility abuse, and attempted Wireless Debugging automation. Together, those functions can help operators turn a compromised phone into a platform for account…

Google finance US

tg: rozbor tg: návod tg: propagace tp: malware tp: podvod tp: identita

· Malwarebytes Labs · ToxicPanda 2.0 can take over your Android phone and banking apps

1

Scammers are using fake crypto AML checkers to drain your wallet

Scammers are creating fake crypto wallet-checking sites that promise to tell you whether a wallet is linked to suspicious activity. Instead, they try to trick you into giving them access to your crypto. What real AML checking looks like AML stands for anti-money laundering. These are rules that require banks and other regulated businesses to screen customers for ties to crime. It’s designed to prevent cybercriminals from hiding or moving illegally obtained money. In the crypto world, this…

finance US

tg: varování tg: rozbor tp: phishing tp: podvod

· Malwarebytes Labs · Scammers are using fake crypto AML checkers to drain your wallet

1

New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles

You can’t patch everything. So what do you fix first? Findings in Q2 2026 have changed traditional answers.The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive…

CVSS 7.0 Microsoft veřejná správa finance zdravotnictví výroba a průmysl US

tg: rozbor tp: ransomware tp: AI tp: špionáž tp: průmyslové systémy

· Rapid7 · New Report: AI threats are here. Why Q2 2026 signals the end of traditional patch cycles

1

New Android malware lets criminals use your bank card in real time

Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it “WindRelay.” NFC (Near Field Communication) is wireless technology that allows devices such as smartphones, payment cards, and payment terminals to communicate when they’re very close together. So, instead of stealing your physical bank card, the attackers capture NFC activity on an infected mobile phone and relay it in…

Google finance US

tg: varování tg: rozbor tp: malware tp: phishing tp: podvod

· Malwarebytes Labs · New Android malware lets criminals use your bank card in real time

2

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

A Mexican banking fraud operation we're tracking as REF6045 doesn't run on autopilot. A human operator is behind the wheel, monitoring infected machines and deciding what happens next. Victims are infected through fake CAPTCHA pages that trick them into running a single command, which installs SCMBANKER, a PowerShell toolkit with components dating back to at least October 2025. Once installed, the operator can see when a victim opens a banking session, lock the screen behind a fake bank warning…

finance telekomunikace US

tg: varování tg: rozbor tp: malware tp: phishing tp: podvod

· Elastic Security · ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

A Mexican banking fraud operation we're tracking as REF6045 doesn't run on autopilot. A human operator is behind the wheel, monitoring infected machines and deciding what happens next. Victims are infected through fake CAPTCHA pages that trick them into running a single command, which installs SCMBANKER, a PowerShell toolkit with components dating back to at least October 2025. Once installed, the operator can see when a victim opens a banking session, lock the screen behind a fake bank warning…

finance telekomunikace US

tg: varování tg: rozbor tp: malware tp: phishing tp: podvod

· Elastic Security · ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

1

1

Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

TrendAI™ Research has identified two emerging threat campaigns—SHADOW-AETHER-040 and SHADOW-AETHER-064—that use agentic AI to drive intrusion operations against government and financial organizations in Latin America, marking these among the first cases we have observed of AI agents executing attacks from initial access to data exfiltration.

veřejná správa finance JP

tg: varování tg: rozbor tp: únik dat tp: AI tp: špionáž

· Trend Micro · Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

1

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family. The campaign, tracked as REF3076, features a loader with robust anti-analysis capabilities that deploys two embedded .NET Reactor-protected modules: a full-featured banking trojan and a worm module for self-propagation. The banking trojan monitors the victim's browser address bar via UI Automation, targeting 59…

Logitech finance US

tg: varování tg: rozbor tp: malware tp: podvod

· Elastic Security · TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

1

1

Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT

A follow-up publication will provide a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail. Preamble Elastic Security Labs has identified a novel social engineering campaign that abuses the popular note-taking application, Obsidian, as an initial access vector. The campaign, which we track as REF6598, targets individuals in the financial and cryptocurrency sectors through elaborate social engineering on…

Obsidian Shell Commands Hider finance US

tg: varování tg: rozbor tp: malware tp: phishing

· Elastic Security · Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT

1

Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER

Key takeaways A South Asian financial institution was targeted with two custom malware components: a modular backdoor (BRUSHWORM) and a keylogger (BRUSHLOGGER) BRUSHWORM features anti-analysis checks, AES-CBC encrypted configuration, scheduled task persistence, modular DLL payload downloading, USB worm propagation, and broad file theft targeting documents, spreadsheets, email archives, and source code The keylogger masquerades as libcurl via DLL side-loading, capturing system-wide keystrokes…

finance US

tg: incident tg: rozbor tp: malware tp: AI

· Elastic Security · Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER