Kaspersky found what it calls the first malware built specifically for car head units, hiding inside Android-powered DoFun infotainment systems sold across China and APAC. The attackers hijacked the update channel to drop loaders, clickers, and reverse-proxy modules, and the firm ties the code to MoYu Group, operators of BadBox. So far the commands only pull proxy payloads, suggesting cars are simply new nodes in an ad-fraud and traffic-relay botnet that has already ensnared millions of devices.
Check Point has dissected a ransomware family it calls StopAndProtect, first spotted in May 2026, that infects victims through fake-CAPTCHA ClickFix prompts. The full chain spans PowerShell, two rounds of .NET loaders, then ransomware, a USB worm, and a credential stealer. Crucially, operators host all of it on thousands of outdated WordPress sites, some running five-year-old versions with nearly 40 vulnerabilities. Their sloppy ops security let researchers read the logs and count roughly 2,000 compromised domains.
Cisco Talos exposed UAT-10147, a Chinese-speaking group auto-piloting attacks on Windows and Linux web servers with open-source tools plus AI. One open directory held a target list of about 170,000 URLs, split for efficient parsing. The group leans on AI to refine exploits and automate post-exploitation, then lands SPECTRE (an unreported cross-platform implant) and a Linux rootkit for SEO fraud and data theft.
Attackers have found a new hiding place for malware staging: the greeting text an FTP server sends on connection. SOCRadar's STRU traced that dead-drop trick, first spotted by MalwareHunterTeam, to two new RATs, E4del, a Node.js Electron app masquerading as Discord, and PINHOLE, which pulls its C2 config from Pinterest and SurveyMonkey. It's a first in the wild, though arguably less stealthy than web-based resolvers.