Mobile Malware Threat Intelligence

Mobile malware targets smartphones and tablets through malicious apps, fake app stores, and SMS-based attack vectors. Banking trojans, spyware, and adware campaigns increasingly target both Android and iOS platforms. defend.network tracks mobile threats that pose risks to enterprise environments through BYOD policies and mobile device management gaps.

Google dismantles 1.3M Android botnet; critical Langflow RCE; Microsoft patches 1,400 flaws

Google disrupted a 1.3M-device Android TV botnet allegedly supplied by manufacturer Videostrong; IBM disclosed critical Langflow RCEs; Microsoft released 1,400+ patches.

P7 DarkSword iOS exploits escalate; ShinyHunters arrests surge; AI agents targeted in bank breaches

P7 DarkSword iOS variant adds keychain & crypto-wallet theft; multiple ShinyHunters members arrested across three countries; Chinese threat actor exploited Claude AI agents in South Korean bank attacks.

Flax Typhoon infrastructure seized; Cisco NX-OS RCE patches released

FBI-led international coalition seized Flax Typhoon's MicroScan and FishHub hacking tools. Cisco patched critical NX-OS RCE flaws. Android devices ship with Midnight Mimosa firmware malware enabling proxy abuse.

Microsoft patches 974 CVEs; Check Point RCE; Docker Sandboxes escape on macOS

Microsoft released 974 patches in its largest single batch; Check Point Security Management servers vulnerable to unauthenticated RCE; Docker Sandboxes can be escaped on macOS.

Android malware surge; AI-powered PaperCut campaign hits 395+ orgs

Mantax Otax and Gigabud banking trojans spread across Android, Russian-speaking actors deployed hundreds of AI agents to exploit PaperCut flaws on 395 organizations

Microsoft patches 398 flaws; Zimbra exploitation deadline looms; Android cars compromised

Microsoft released 398 security patches including one actively exploited flaw; Zimbra command injection (CVE-2026-73570) in CISA KEV with Aug 24 federal deadline; Android vehicle head units infected via supply-chain attack distributing proxy botnet malware.

Android vehicles, AWS keys, Snowflake extortionist: Active threats escalate

Android car head units infected via malware-laden firmware updates; 9,300+ AWS keys remain active; Snowflake extortionist pleads guilty after compromising 165+ organizations.

GitHub, Gitea, Google Dialogflow hit by active exploits; RedWing Android malware-as-service

GitHub Agentic Workflows leak private repo data via public issues; Gitea CVE-2026-20896 authentication bypass actively exploited; RedWing Android malware rented as fraud service on Telegram.

Fortinet actively exploited; Rokarolla targets 217 banking apps; Google Vertex AI flaw

Fortinet FortiSandbox faces active in-the-wild exploitation of three CVEs. Android banking trojan Rokarolla targets 217 financial apps with 137 remote commands. Google Vertex AI SDK bucket-squatting flaw enables unauthorized model hijacking.

Google Gemini prompt injection, Microsoft 365 token theft, Redis RCE patched

Google Gemini voice assistant hijackable via poisoned notifications; Microsoft 365 Android apps leak tokens; Redis RCE (CVE-2026-23479) patched; critical fuel tank systems under active attack.