Apple issued warnings across 99 nations as the Apple mercenary spyware threat targets investigative journalists with sophisticated surveillance tools.

Related Posts:

• BITTER PapRAT Malware Targets South Asian Organizations
• Hugging Face Malware Campaign Infects AI GPU Servers
• PSK Agent RAT Hits Magento Stores Through StyleSmuggler Exploitation

The post Apple Mercenary Spyware Threat Prompts Global Alerts appeared first on Daily CyberSecurity.

Apple warns German Bundestag lawmakers of mercenary spyware attacks; BSI urges victims to assume compromise.

The German government is warning politicians and public figures that they were targeted by government-backed spyware. The warning follows Apple’s notifications, which began reaching iPhones on October 29, according to the federal cybersecurity office, the BSI. The BSI says members of the Bundestag and other notable people got an Apple alert about an attack with so-called mercenary spyware.

“The Federal Office for Information Security ( BSI ) has learned that several members of the German Bundestag and other public figures have received a threat notification from Apple on their devices since October 29, 2026. In the notification, Apple states that it has detected an attack using so-called mercenary spyware . This is commercially developed, advanced spyware that has frequently been used in the past by state actors against specific, targeted individuals.” reads the notice issued by BSI.

“The BSI (Federal Office for Information Security) is unaware whether these notifications indicate actual compromises or merely signal attempted attacks.y “

“Germany’s digital minister, Karsten Wildberger, has confirmed that members of the Bundestag and the federal government received warnings from Apple that their iPhones may have been targeted by spyware.” states the report.

Digital minister Karsten Wildberger confirmed it on ARD’s Bericht aus Berlin on Sunday, saying there had been “a notification from Apple that certain devices may have been compromised” and that members of both the Bundestag and the federal government were among those warned. Digital minister said the BSI had reacted super quickly and written to everyone affected. Wildberger didn’t say how many politicians got the alerts or who they are.

“According to Wildberger, the BSI advised those affected to assume – as a precaution – that their device may have been compromised, because the alerts do not show whether an attack succeeded.” states Euronews.

The German government has not revealed who was targeted. Government spokesperson Stefan Kornelius told the Financial Times that officials are taking the incident and Apple’s warning very seriously. However, he did not say which government members received the alerts or whether Chancellor Friedrich Merz was among them. Apple has not commented on the reports, according to Euronews.

The Apple warning does not provide all the answers. Apple does not identify the governments behind these attacks, nor does it confirm whether a device was actually infected. Germany’s cybersecurity agency, the BSI, also says it is unclear whether the alerts indicate successful infections or only attempted attacks.

Apple says mercenary spyware is far more advanced than common cybercrime tools and that most users will never be targeted. This commercial surveillance software is often used on behalf of governments to spy on specific individuals. It can infect devices through so-called zero-click attacks, which do not require victims to open a message or click a link. In most cases, victims do not notice anything unusual.

Once a phone is compromised, the BSI says, attackers can read messages, including in encrypted apps, and access calls, contacts, calendars and location. They can also turn on the camera and microphone. That’s the whole phone, not a corner of it.

For recipients the BSI’s advice is concrete. Update the operating system immediately, unless you plan a forensic analysis, and consider turning on Lockdown Mode, which makes new attacks harder but doesn’t remove an existing infection. Lockdown Mode limits some features such as message attachments, link previews and FaceTime calls from unknown people, while calls and plain text messages keep working.

If the risk looks high, the BSI suggests replacing the device. That means resetting every account used on it and, to make repeat attacks harder, changing the phone number. Then set a new device passcode, change the passwords of your Apple account and email, and make sure two-factor authentication is on.

The BSI recommends turning on Signal’s registration lock and WhatsApp’s two-step verification, with a new PIN for each. It also advises removing any linked devices you don’t recognize.

Anyone who received a warning can email the BSI Service Center at service-center@bsi.bund.de. This helps the agency work out how many people may be affected. The agency says a genuine Apple warning never asks you to click links, open files, install apps or profiles, or share passwords and codes. These warnings appear on the lock screen, in settings, by email and at the top of account.apple.com after you sign in.

The warnings weren’t limited to Germany. Beirut-based filmmaker Radwan Mortada said on X that Apple had warned him about another attack against his device. He had already been targeted by spyware in 2021.

According to his notice, Apple sent the latest warnings to users in 99 countries. Nobody has publicly identified the attackers or the government that may have ordered the attacks.

The BSI warned German lawmakers that Apple threat notifications may indicate compromised devices and urged recipients to contact the agency and take protective measures.

“Those affected who have received a corresponding warning message from Apple should therefore assume that their device may have been compromised.” BSI concludes. “In a letter dated October 30, 2026, the German Federal Office for Information Security (BSI) alerted members of the German Bundestag to the threat and informed them of necessary measures. Affected individuals were urged to contact the BSI directly .”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Bundestag)

Researcher Ovi exposes uCreator Android spyware. The YingGai uCreator Android spyware platform uses VirtualApp and LSPatch to hijack 20 mobile apps.

Related Posts:

• Amazon ClickFix Campaign Abuses Windows Finger Command to Drop Lumma Stealer and NetSupport
• Skynet LLMjacking Agent Hijacks Exposed AI Models to Hack Servers and Mine Crypto
• INC Ransomware Affiliates Expose Seven Servers Holding Phantom AI Framework and 46 Encryptors

The post uCreator Android Spyware Hooks Telegram and WeChat Inside Virtual Containers appeared first on Daily CyberSecurity.

uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform.

uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof camera feeds to bypass identity checks. Victims may install modified versions of Telegram, WeChat or GCash through sideloading or social engineering.

Researcher Ovi found stolen data on a control server, but the number of victims and links between operators and customers remain unconfirmed.

“The repackaged APK can be relatively thin: target-specific instrumentation is retrieved after installation from the operator’s Alibaba OSS and MinIO infrastructure, including buckets and paths named Huuk_<target> and fengzhuang-app (literally, “packaging”). Distribution hosts include telegram-apk.uzyzx.com.” researcher Ovi states. “I could reconstruct much of the post-installation execution chain from the recovered code, but I could not directly establish the initial delivery mechanism for every victim.”

Ovi rebuilt most of the chain from recovered code but couldn’t establish how every victim got the first install.

The product is older than the samples. The package com.ucreater.autotool dates to about 2014, Windows tools tied to ucreater.com were signed between 2016 and 2019, and the YingGai mobile line shows up in records from September 2021. The samples Ovi studied run from 2024 to 2026: uip.exe builds from February to December 2024, Telegram repacks from July and November 2024, the WeChat host and Telegram framework from December 2024, and the Onion Box client from March 2026. The control server’s ICP filing, 湘ICP备2024061212号, dates to 2024.

The infrastructure hints at scale, though not at victim numbers. Ovi counts about 20 target apps with confirmed code support, six operator domains with dozens of subdomains, three Redis buses, two MQTT buses, and a cloud-phone cluster in Changsha spread across several ISPs. A Censys search for the operator’s Tengine gateway fingerprint returned roughly 48 hosts. It looks like a multi-year product sold to many downstream operators, but he can’t say how many customers used it or how many devices fell.

Attributing the platform to a specific legal entity is more difficult. Hunan Youchuang Technology is linked to the ucreater.com brand and a self-signed certificate on videoflow.cn. Changsha Sukai Network holds the ICP filing for the control server’s main domain, qianxuncc.cn, while Changsha Zhuoqing E-commerce appears as the signing identity on uip.exe, using a DigiCert certificate. A common owner is plausible but unproven.

Another lead involves hunanzhijing.com, a domain belonging to the Hunan Intelligent Police Public Safety Technology Research Institute. It shares the same gateway fingerprint, and an official Hunan document connects the institute to an intelligent-policing research project. However, shared cloud infrastructure establishes only co-tenancy, not ownership or operational involvement. There is no evidence that the police developed or operated uCreater.

Other infrastructure links also require caution. A Thailand-based relay used by the Telegram component, hosted on Huawei Cloud, also served gambling websites, an advertising-account service and an SMS service. The cloud-phone web client displayed a certificate for another vendor, while the gateway served a Vue application titled 舆情交易, meaning “public-opinion trading”. These observations are leads for further investigation, not proof of common ownership.

uCreater relies on app virtualization, a technique already identified by Zimperium as a growing mobile threat. VirtualApp runs another application inside a container, LSPatch merges code hooks into repackaged apps without requiring root access, and Pine hooks Android’s runtime. Together, these components allow malicious code to operate inside a legitimate app while it is signed in and has access to decrypted data.

“uCreater is notable because it turns these techniques into a reusable, remotely managed product.” the researchers continues.

Operators distribute modified versions of Telegram-X, Telegram-Web and other messaging apps, integrating modules through LSPatch or loading them from an asset called TgJarPine.dex. WeChat can instead run inside a VirtualApp container, including the va_vx or Onion Box host. LSPatch also stores the original APK under cache/lspatch/origin/*.apk. The presence of this path or the specific asset can help identify an infected device.

The approach differs from GodFather, a banking trojan documented by Zimperium that runs apps in a virtual container and displays fake overlays to capture credentials. uCreater operates inside the real application without relying on an overlay. It uses XposedBridge hooks, reflection and access to the app’s own database interfaces. This allows it to reach beyond login screens and potentially support any application for which the vendor develops a module. Ovi found no evidence linking the two platforms.

One distinguishing feature is a local command server embedded in each hooked application. It exposes around 40 numbered handlers, with descriptions and parameters that allow operators to discover available functions. The code supports device monitoring, contact and SMS collection, installed-app enumeration, message sending, chat-history retrieval, session management and account-related actions.

The Telegram module can execute SQL queries directly against the application’s live database through its own interface. Its Db_MessagesStorageRawQuery handler accepts operator-supplied SQL and returns results through compatibility classes that recreate Telegram objects. This can expose information that would otherwise be protected in the app’s encrypted or locally stored data while the application is running.

The module also hooks Telegram’s SRPHelper.getX routine, capturing the two-step verification password in cleartext before hashing and storing it for exfiltration. The code provides functions to list or reset sessions, change or confirm a linked phone number, delete an account and lock users out. It can also remove its own session from the victim’s device list, potentially concealing the operator’s access. Ovi stresses that the source code demonstrates these capabilities, not that every action has been successfully performed against victims.

The implant retrieves its control-server address from Redis using the Domain key, optionally selecting a value for a particular channel. It caches the address and can fall back to a hardcoded value, explaining why callback domains differ between builds. Signed JSON beacons report to endpoints under /api/callback/Tg*, while command requests include a device fingerprint and signature and use retries with increasing delays.

Updates and additional code arrive through Alibaba Object Storage Service (OSS) and MinIO. The Telegram module retrieves an update manifest and hooks from designated storage paths, while a contacts.vcf file can supply contact information. The WeChat component subscribes to a Redis channel identified by a device-specific machine ID, with its host and credentials embedded in a child code file.

The WeChat module focuses on account access rather than chat-history collection. Its _2_0_UploadAppLoginInfo command retrieves login identity information, after which the app data can be packaged, uploaded to OSS and used in account cloning. Ovi found no evidence that the examined sample accessed WeChat’s encrypted database.

Ovi tested uCreater on a Pixel 10 Pro running Android 17 and found that its bundled Pine engine fails because of changes to Android’s internal APIs. The latest sample, dated July 29, 2026, still uses the outdated engine. Although this creates obstacles for operators, updating Pine could restore functionality, and other devices remain untested. Ovi also identified five samples that successfully contacted the control server, confirming active deployments targeting Telegram, Telegram-X and WeChat.

Ovi and researcher Jurre discovered the platform’s source code after finding an exposed GitLab server. Other infrastructure was protected by IP allowlists, but this server contained the control platform’s source code, configuration and operational details.

The repositories revealed Spring Cloud services for command dispatch, authorization capture, data collection, backups and message bridging, alongside a Vue-based administration console. Thirteen repositories contained commit histories identifying roughly three dozen developers, with activity timestamps consistent with China time. At least one commit used a corporate email domain associated with Tanzhou, a Changsha software firm.

uCreater’s backend is a rented, multi-tenant platform that lets operators manage infected devices, steal account data and automate contact collection. Kafka, RocketMQ, Redis and Nacos coordinate commands and schedule activity to avoid triggering security controls. The infrastructure runs on Aliyun and Huawei Cloud, with control services and storage hosted in China. Although GitLab records identify developers behind key components, Ovi stresses they are not confirmed operators. The recovered backend did not appear to support Telegram, and some callback domains are no longer active.

Ovi attributes the platform to a vendor in Changsha and Hunan operating through three companies, each linked to a different technical or infrastructure artifact. The reseller model, focus on mobile wallets and theft of authentication codes suggest financially motivated crime, but the researcher presents this as an assessment rather than a proven fact.

The technical findings show that uCreater goes beyond a conventional banking trojan or a tool that merely steals credentials. By embedding code inside legitimate applications, it can manipulate sessions, access account data, collect contacts and potentially take control of messaging accounts. Its rented, multi-tenant architecture also allows different operators to use the same underlying platform.

The scale of the infrastructure indicates a substantial operation, but neither the number of customers nor the number of compromised devices has been established. Likewise, infrastructure overlaps and developer records provide investigative leads, not conclusive proof of who operated the spyware or who was responsible for individual attacks.

“Mapping points to a commercial resale structure, and targeting driven by wallets and OTPs. My assumption is financially-motivated crimeware.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Citizen Lab exposes the AdFection spyware attack, a zero-click ad-bidding exploit that targeted at least 45 Al Jazeera devices.

Related Posts:

• Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
• OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build
• GhostBat RAT Uses Transparent Overlay to Steal PINs From 60 Indian Financial Apps

The post AdFection Spyware Attack Targets Al Jazeera Devices appeared first on Daily CyberSecurity.

Spyware vendors use online ad infrastructure to profile targets and deliver exploits without requiring users to click anything.

The investigation links Discover-Tech to Candiru, an Israeli spyware vendor that the US government placed on its Entity List in 2021. Candiru has since used the name Integrity Labs. Citizen Lab also identified links involving other surveillance companies, including Bindecy and Intelos, suggesting that Discover-Tech’s infrastructure served more than one customer.

The researchers examined almost four billion advertising bid records covering March to June 2026. During that period, Discover-Tech’s MyDSP platform bid on nearly 3.77 billion ad impressions and won about 442 million, with advertisements appearing across more than 120,000 websites and 70,000 mobile apps.

“We reviewed bidding data for MyDSP for four months (March through June 2026). In this period, Discover-Tech’s MyDSP bid on 3,770,286,576 impressions, and appeared to win 441,954,291 (11.7%). About 76.7% of the bids were for ad impressions in mobile apps, and 23.3% for impressions in the web browser.” reads the report published by Citizen Lab. “The database shows a total of three advertisers, with nine total combinations between advertiser and an advertiser domain name.”

Reuters, citing Citizen Lab and advertising security firm Confiant, reported that the company’s wider advertising activity reached more than 120,000 websites and 75,000 apps, potentially exposing hundreds of millions of people to its tracking infrastructure.

The distinction between exposure and infection matters. Most advertisements didn’t necessarily deliver spyware, and seeing one doesn’t prove a device was compromised. But the system gave Discover-Tech a way to profile users at scale and select particular devices for more intrusive operations.

“In 2024 and 2025, international news network Al Jazeera was targeted in a series of zero-click attacks that we link with high confidence to Candiru’s spyware delivered via Discover-Tech’s ads. At least 45 devices within Al Jazeera were targeted in these attacks.” continues the report.

Citizen Lab reached this finding by examining network logs supplied by the broadcaster. The researchers linked the activity in 2024 and 2025 to Candiru spyware delivered through Discover-Tech advertisements, providing technical evidence of a real operation rather than a theoretical attack scenario.

The advertising records also showed impressions on networks associated with sensitive organizations, including the Pentagon, NATO, the United Nations, the European Commission and the International Criminal Court. Researchers identified activity involving government, defense, media and critical-infrastructure networks across several countries.

These findings don’t mean that every organization whose network displayed an advertisement suffered a spyware infection. They do show that advertising infrastructure can reach people working in environments where their identities, communications and device activity have intelligence value.

This creates a problem for security teams. Traditional defenses focus on malicious attachments, suspicious links, vulnerable software and unauthorized network connections. AdFection adds another route: code delivered through a service that users and organizations routinely allow because it supports ordinary web browsing.

Advertising identifiers, IP addresses, browser characteristics and other technical signals can help operators distinguish one device from another. When combined with targeted advertising, these signals can support reconnaissance and help an operator decide which users merit further attention. In intelligence terms, the same infrastructure can support both broad collection and selective exploitation.

Discover-Tech’s access to major advertising platforms helped its operations appear legitimate. Citizen Lab found that Google and the advertising industry association IAB Europe had listed the company among approved vendors for years, despite links to people and businesses associated with the surveillance industry.

Following the investigation, Google terminated Discover-Tech’s access to its advertising exchanges, while IAB Europe suspended its vendor status. Beeswax removed the company from its platform, and Vungle, operated by Liftoff, paused its access while reviewing the findings. Eskimi also blocked its accounts and domains.

These actions matter, but they don’t resolve the underlying problem. The advertising industry relies on complex chains of buyers, exchanges, publishers and third-party scripts, often with limited visibility into what each component does when an advertisement loads. A company can pass routine checks while using targeting rules to deliver different code to different users, making malicious behavior harder to detect through automated scanning alone.

Organizations should treat online advertising as a potential attack surface, particularly on devices used by executives, intelligence personnel, journalists and employees with access to sensitive systems. Blocking advertisements and tracking requests at the network gateway can reduce exposure, while managed devices should disable ad personalization where possible and use browsers with strong tracking protections.

Security teams should also review traffic generated when advertisements load, looking for unexpected connections to external infrastructure or suspicious scripts. Organizations facing elevated targeting risks should consider stricter controls on advertising, browser extensions and third-party content, especially on systems used to access confidential information.

The larger lesson is that a familiar user experience doesn’t guarantee a safe technical process. A banner promoting a phone or a pair of earbuds may look entirely ordinary, while the code behind it performs tracking or checks whether the device matches a target. The victim doesn’t need to click anything, and that’s precisely what makes this technique difficult to spot.

“The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.” continues the report. “Two major U.S. security agencies, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA), have warned already in 2018 and 2020 that adversaries may leverage malicious ads to deploy malware on devices, and thus both recommended that government agencies and other organizations use ad-blocking software.”

This is the central warning from Citizen Lab’s investigation: online advertising is no longer just a privacy concern. Under the right conditions, it can become an operational tool for espionage.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, spyware)

Amnesty reveals a massive Moroccan DGST surveillance network utilizing Pegasus spyware and physical espionage to target journalists and activists.

Related Posts:

• DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel
• New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes
• BPFDoor Backdoor and New AVERAT Implant Hide in SMTP Traffic on Telecom Edge Devices

The post Moroccan Intelligence Deploys Vast Surveillance Panopticon appeared first on Daily CyberSecurity.

Zimperium zLabs discovered Mantax Otax Android malware, a fierce Indonesian mobile ransomware integrating spyware to hijack, record, and extort victims.

Related Posts:

• SloppyRAT Malware Analyzed in Ransomware Attacks
• Vwork Android Malware Clones Apps in Gigabud Attacks
• Casbaneiro Banking Trojan Hits Latin American Banks

The post Mantax Otax Android Malware: Spyware Meets Ransomware appeared first on Daily CyberSecurity.

Os pesquisadores de cibersegurança descobriram uma nova família de malware para Android, chamada Manic. Esse malware permite que criminosos espionem vítimas, roubem credenciais bancárias e assumam o controle remoto de dispositivos infectados.

Mas seu truque mais extraordinário é o seguinte: o Manic pode repassar os dados roubados aos invasores, mesmo quando o dispositivo em questão não tiver conexão com a Internet. Aparentemente, interrupções aleatórias da Internet móvel parecem atrapalhar os cibercriminosos tanto quanto qualquer outra pessoa, então os agentes por trás do Manic criaram uma solução alternativa incomum.

Pessoas em vários países europeus estão em risco, da Rússia ao Reino Unido. Nesta postagem, explicamos o que esse cavalo de Troia pode realmente fazer, como ele envia clandestinamente os dados roubados aos invasores e como você pode proteger seu dispositivo Android contra Manic e outras ameaças semelhantes.

Como o Manic se espalha e quem está em risco

Os pesquisadores ainda não identificaram exatamente como os invasores estão instalando o Manic nos dispositivos das pessoas. Normalmente, malware como esse se espalha por meio de canais como:

• Aplicativos infectados em lojas de aplicativos legítimas
• Arquivos APK maliciosos compartilhados em sites piratas
• Links de download enviados por meio de aplicativos de mensagens e e-mail
• Sites fraudulentos

O Google disse a jornalistas que não encontrou nenhum vestígio do Manic se disseminando por meio de aplicativos da Google Play Store. Isso sugere que os usuários provavelmente estão instalando aplicativos infectados de fontes não oficiais.

Os especialistas rastrearam o início da infraestrutura dos invasores nesta campanha até fevereiro de 2026. As primeiras amostras do próprio malware foram encontradas no final de maio deste ano. Desde então, os criminosos por trás do cavalo de Troia refinaram as formas de se esconder da detecção no dispositivo da vítima.

Atualmente, o Manic combina os poderes de um cavalo de Troia bancário, spyware e uma ferramenta de acesso remoto que permite que um invasor controle o dispositivo. Os invasores estão especialmente interessados em dados de fontes como:

• Aplicativos bancários e serviços de pagamento
• Aplicativos oficiais do governo
• Carteiras e plataformas de negociação de criptomoedas
• Aplicativos de autenticação de dois fatores
• Mensagens de texto e notificações: principalmente os códigos de uso único usados para verificar logins ou aprovar transações

Ao analisar quais aplicativos bancários o Manic tem como alvo, os pesquisadores conseguiram descobrir quais países ele pretende atingir. Acontece que seu alcance é amplo, abrangendo Áustria, República Tcheca, Estônia, França, Alemanha, Lituânia, Holanda, Polônia, Rússia, Eslováquia, Espanha, Ucrânia e Reino Unido.

Senhas roubadas, códigos interceptados, controle remoto: o que o Manic pode realmente fazer

Vamos analisar exatamente quais informações o Manic rouba e como ele consegue obtê-las. O principal truque do malware consiste em abusar dos serviços de acessibilidade do Android, um conjunto de recursos integrados desenvolvidos para ajudar usuários com deficiências visuais. Usados da forma pretendida, esses recursos são genuinamente úteis para pessoas com perda de visão. Mas os criminosos há muito tempo exploram silenciosamente essas ferramentas para seus próprios interesses.

Depois que o usuário concede ao aplicativo permissão para usar os Serviços de Acessibilidade, esse aplicativo pode “ver” o texto e os botões na tela, interagir com eles, rolar pelas páginas e executar ações automaticamente, tudo como se o próprio usuário estivesse fazendo isso. Os invasores usam esse recurso para ler mensagens na tela, conceder silenciosamente permissões extras ao malware, interferir nas tentativas de desinstalá-lo, desativar as proteções de segurança ou controlar outros aplicativos sem que a vítima perceba.

Com o Manic, esse abuso dos serviços de acessibilidade é combinado com os recursos avançados do próprio cavalo de Troia. Ele pode gerar um teclado invisível que fica sobreposto ao teclado real do telefone. Quando o usuário digita sua senha para fazer login em um aplicativo bancário, o Manic registra exatamente quais teclas foram pressionadas. Em seguida, ele usa os serviços de acessibilidade para reproduzir instantaneamente a mesma sequência de teclas no teclado do aplicativo real.

O Manic gera uma camada de captura transparente que cobre o teclado do telefone, registra cada toque e o retransmite ao teclado real. Fonte

Isso significa que os invasores não precisam criar uma tela de login falsa para cada aplicativo que desejam alcançar. Uma vez que o Manic funciona como uma camada invisível sobre o aplicativo genuíno, tudo parece e se comporta como de costume, portanto, o proprietário do telefone não tem motivos para suspeitar que está entregando seu PIN ou senha a um criminoso.

O Manic não registra simplesmente tudo o que o usuário digita. Ele reconhece automaticamente o tipo de informação capturada e a classifica em categorias: senhas, logins de e-mail, códigos SMS de quatro a seis dígitos, sequências de caracteres que se parecem com frases-semente de carteiras de criptomoedas e códigos de desbloqueio ou padrões de desbloqueio do telefone. Juntamente com o próprio texto capturado, o Manic também registra de qual aplicativo ele veio, quando foi inserido, se o usuário o digitou manualmente ou usou o preenchimento automático e se o aplicativo está em sua lista de alvos.

As capacidades do Manic não param na coleta de informações. Usando os serviços de acessibilidade novamente, ele também permite que os invasores assumam o controle remoto de um dispositivo infectado. Para ocultar essa atividade, o Manic pode exibir uma tela preta ou fingir que está realizando uma atualização do sistema.

Além de usar os serviços de Acessibilidade, o malware também solicita permissão para ler mensagens de texto e notificações. Isso permite que os invasores interceptem códigos de autenticação de dois fatores e códigos de verificação de uso único antes que a vítima tenha a chance de digitá-los no aplicativo.

Em suma, o malware dá aos invasores não apenas senhas, credenciais bancárias e códigos de verificação, mas também a capacidade de controlar remotamente o telefone da vítima.

Nem mesmo ficar offline impede o roubo de dados por parte do malware

O método original do Manic para retransmitir dados roubados do dispositivo para os invasores merece uma menção especial. Ainda hoje, os dispositivos ficam offline com mais frequência do que as pessoas poderiam esperar, e os criadores do Manic criaram uma solução alternativa especificamente para essas situações.

Normalmente, um malware como esse coleta informações no dispositivo e as envia diretamente para um servidor controlado pelos invasores. Mas o que acontece quando o dispositivo infectado não tem acesso direto à Internet ou não consegue acessar o servidor de comando e controle por algum outro motivo?

Nesse caso, o Manic simplesmente armazena os dados roubados no dispositivo e começa a verificar nas proximidades outros telefones infectados que possam ser acessados por Wi-Fi ou Bluetooth. Se encontra algum com acesso à Internet, ele transfere os dados criptografados para esse telefone, que então os encaminha para o servidor dos invasores.

Mas não para por aí. Os dados podem passar por uma cadeia de dispositivos infectados. Por padrão, o Manic permite até quatro desses dispositivos de retransmissão na cadeia. Se nenhum dispositivo adequado estiver próximo, os dados simplesmente permanecem no telefone original e o Manic tenta novamente mais tarde.

Como proteger seu telefone do Manic e de outros cavalos de Troia bancários

Os malwares para Android estão cada vez mais sofisticados. Por isso, vale a pena lembrar e, de fato, seguir alguns hábitos básicos de higiene digital para usuários de telefones e tablets Android:

• Evite instalar aplicativos de fontes não oficiais.
• Não conceda permissão a aplicativos para usar os Serviços de Acessibilidade, a menos que isso seja absolutamente necessário e você entenda exatamente por que eles precisam dessa permissão.
• Instale um software de segurança confiável em todos os seus dispositivos, execute verificações regularmente e leve seus avisos e recomendações a sério. Recomendamos o Kaspersky para Android. Nossos aplicativos de segurança para Android estão temporariamente indisponíveis na Google Play Store, portanto, para instalá-los em um dispositivo Android, recomendamos usar uma loja de aplicativos alternativa ou instalar o arquivo APK manualmente a partir de nosso site. Um guia passo a passo completo está disponível em nossa postagem Como instalar ou atualizar apps da Kaspersky para Android em 2026.

O malware não tem como alvo apenas os smartphones; ele também se sente em casa em outros dispositivos com Android, de dispositivos de streaming a… carros. Confira os detalhes em nossos posts relacionados:

• Botnet sobre rodas: o primeiro cavalo de Troia voltado para centrais multimídia automotivas
• Vulnerabilidade da Qualcomm: consertos de celulares e manutenção de carros não são mais seguros
• Sua TV box virou uma porta de entrada para terceiros?
• O trojan para Android que simula serviços governamentais e aplicativos da Starlink
• A tempestade perfeita de ameaças no Android

At least 14 people connected to Serbia's student protest movement and opposition politics have been targeted with mercenary spyware since early 2026, the Belgrade-based digital rights organization SHARE Foundation said, in what it called the largest documented wave of such targeting in the country.

The group said the cohort includes student movement members, civil society activists, a member of parliament and a local councilor. Forensic analysis was independently confirmed by the Citizen Lab at the University of Toronto and by Amnesty International's Security Lab.

Citizen Lab, in its own findings, said it verified an infection with NSO Group's Pegasus on the iPhone of a student activist who asked not to be named. High-confidence infection indicators span December 2025 through January 2026, delivered by a zero-click iMessage exploit that required no interaction from the target. Apple has since patched the underlying flaw; the fix shipped in iOS 18.4.1. Pegasus grants an operator access to notes, photographs and messages decrypted on the device, and can silently activate the microphone and camera.

Amnesty's Security Lab confirmed a new variant of NoviSpy, an Android implant first identified in Serbia in 2024, on two additional devices. SHARE said the rebuilt version was designed to evade the detection methods that exposed its predecessor.

Also read: Investigative Journalists in Serbia Hit by Advanced Spyware Attack

The circumstances of two infections are what elevate the findings beyond routine spyware reporting. SHARE said one NoviSpy infection appeared after police seized a student's phone during questioning, and another after private messages from that device were published by a pro-government media outlet. Donncha Ó Cearbhaill, who heads Amnesty's Security Lab, said the evidence suggests "infections are being carried out during detention by Serbian authorities."

Suspicion centers on Serbia's Security Information Agency, or BIA. Amnesty's December 2024 report "A Digital Prison" found earlier NoviSpy samples configured to send collected data to IP addresses associated with BIA servers, and documented the agency's parallel use of Cellebrite extraction tools on journalists and activists. In March 2025, Amnesty reported that two journalists at the Balkan Investigative Reporting Network were targeted with Pegasus.

The current cases surfaced through Apple's threat notification wave of Aug. 13, which reached users in 110 countries. The timing is politically loaded. The targeting overlaps with protests that followed the November 2024 collapse of a railway station canopy in Novi Sad, spans local elections held March 29 in 10 municipalities, and precedes October parliamentary elections widely read as a test of the ruling Serbian Progressive Party.

Ana Toskic Cvetinovic, a legal expert cited in the reporting, noted that deploying intrusive software without judicial authorization is unlawful under Serbian law. SHARE published an analysis of the domestic legal framework in January arguing the same. Criminal complaints filed over the 2024 cases remain pending before Serbian courts, with no resolution.

Also read: 7 New Pegasus Infections Found on Media and Activists’ Devices in the EU

NSO has been on the U.S. Commerce Department's Entity List since 2021.

Serbia is an accession candidate, the European Parliament has previously questioned the Commission over unlawful spyware use in the country, and the Commission published its 2026 enlargement country report in July. Amnesty's submission for that package raised surveillance directly.

Both groups urged at-risk users to enable Lockdown Mode on iOS or Advanced Protection on Android.

Apple sent a new wave of mercenary spyware threat notifications to targeted users in 110 countries, while making the warnings more visible on iPhones. The alerts signal suspected targeting, not confirmed compromise, and Apple is urging affected users to verify the warning, consider Lockdown Mode, and seek expert help.

The post Apple Warns Users in 110 Countries of Mercenary Spyware as iPhone Alerts Get Harder to Miss appeared first on TechRepublic.

Federal court records show how far the FBI’s Pegasus review progressed — and why new US spyware reporting will still leave major gaps in government hacking transparency.

The post FBI Pegasus Records Expose a Blind Spot in US Spyware Oversight appeared first on TechRepublic.

U.S. courts will begin separately tracking spyware-based interceptions, giving the public new data on government hacking while leaving key gaps.

The post US Courts To Begin Publishing Spyware Records From 2029 appeared first on TechRepublic.

Apple is testing an iOS 26.6 security alert that warns users about malicious iMessages and lets them report suspicious messages.

The post Apple Tests New iMessage Warning for Malicious Messages appeared first on TechRepublic.

Apple is releasing some iPhone security fixes earlier as AI raises concerns about faster cyberattacks and shorter patch windows.

The post iPhone Security Fixes May Arrive Sooner as AI Speeds Up Threats appeared first on TechRepublic.

Modern browser extensions and ad blockers are legally collecting and reselling user data, including streaming habits and B2B sales intelligence, under the guise of "analytics." This unregulated "legal spyware" creates massive security gaps as employees unwittingly leak corporate URLs, SaaS dashboards, and research activity to third-party databases. With the rise of AI-native browsers and personal device syncing, security leaders must evolve beyond simple permission checks to implement rigorous extension governance and privacy policy reviews to prevent targeted attacks and corporate data leakage.

The post Networks of Browser Extensions Are Spyware in Disguise  appeared first on Security Boulevard.