AOMEI Backupper update servers hijacked to push malware: Check your PC
Attackers tampered with AOMEI Backupper’s update system to deliver malware that could give them remote access to users’ PCs.
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
309 matching stories — in Mobile Threat Defense — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Attackers tampered with AOMEI Backupper’s update system to deliver malware that could give them remote access to users’ PCs.
A recent investigation uncovered RemControl, an Android banking trojan designed to give attackers extensive control over compromised mobile devices. The malware combines remote access capabilities with techniques for stealing credentials, intercepting sensitive information, and manipulating device activity to support financial fraud. By operating directly on the victim’s device, attackers can monitor interactions with banking apps and potentially bypass security measures that rely on identifying
This week on the Lock and Code podcast, we speak with John DeMay about a sextortion plot that targeted his son on the night of his suicide.
The California Department of Education notified students about a data breach at contractor Educational Testing Service.
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
In a story recently reported by BuzzFeed, scammers are using calls and messages from seemingly legitimate mobile numbers to lure users with fake job offers before moving conversations to WhatsApp. Once there, attackers can repeatedly contact victims, send malicious links, and request personal information or money, highlighting how mobile messaging platforms are increasingly used for social engineering and fraud.
A recent report reveals that 90% of banking scam attempts now occur on mobile devices, highlighting the growing role of smartphones in financial fraud. Researchers found that scammers are increasingly exploiting mobile banking interactions through social engineering, impersonation, and deceptive communications to manipulate victims into authorizing fraudulent transactions. These attacks often rely on convincing users to act voluntarily, making them difficult to detect through traditional securit
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.
Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands on vulnerable VPN appliances. The vulnerability came to light after Volexity investigated a compromised Ivanti Connect […] The post CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticate
Cybercriminals have long been using artificial intelligence. They automate attacks, develop malware more quickly and scan corporate networks for vulnerabilities in a matter of moments. Meanwhile, G DATA CyberDefense’s Managed Security Operations Centre (SOC) uses AI to stop attacks swiftly.
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name
Three criminal AI storefronts, one legitimate backend. The post Criminal AI, powered by OpenRouter appeared first on ThreatDown.
A stage-by-stage walkthrough of a realistic attack across Microsoft Entra ID and Okta, and exactly where each step gets flagged. The post It took one password to compromise two identity platforms appeared first on ThreatDown.
Used the least. Installed on the most. The post Copilot has the largest AI attack surface of any tool we tracked appeared first on ThreatDown.
Cyberattacks often begin in an inconspicuous way – for example, by clicking on an email attachment or a phishing link. Whether this leads to a serious security incident depends primarily on how quickly suspicious activity is detected and stopped. This is precisely the role of the Managed Security Operations Centre (SOC) at G DATA CyberDefense. But how does a SOC actually operate in practice?
The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News
Approving a third-party app once isn't ongoing security. Here's what continuous app risk monitoring looks like for aviation IT teams.
Crew scheduling and communications apps make a convincing phishing disguise and carry real permission risk of their own. Here's the mechanism.