Malware Activity
Hirudo Android Banking Trojan Replaces Legitimate Apps to Bypass Security Controls and Steal Financial Data
Cybersecurity researchers at ThreatFabric have uncovered a sophisticated Android banking trojan called Hirudo that replaces legitimate banking applications with maliciously modified versions to bypass security protections, steal financial credentials, and enable remote device compromise. The malware primarily targets eight (8) Indonesian banking applications, with additional credential targeting or potential expansion identified in China, India, Mexico, Morocco, and Thailand. Hirudo is distributed through seemingly legitimate shopping and entertainment applications, promoted through fraudulent Google Play Store pages and social media advertisements. These applications use deceptive update prompts to trick victims into installing the malware and granting Accessibility permissions, allowing attackers to uninstall legitimate banking apps and replace them with trojanized copies. The modified applications incorporate a hooking engine built on the YAHFA and Dobby frameworks to manipulate signature verification, conceal Accessibility services, disable screenshot protections, and circumvent Play Integrity checks through attacker-controlled infrastructure. Once deployed, Hirudo combines banking credential theft with advanced remote access trojan (RAT) capabilities, enabling attackers to steal passwords, payment PINs, device-unlock credentials, and SMS messages while remotely controlling infected devices, streaming screens through WebRTC, and accessing cameras and audio. Researchers also identified thousands of credential records and sensitive device information in an unsecured backend panel, although the total number of victims remains unknown. ThreatFabric warns that Hirudo represents a significant evolution in Android banking malware by shifting attacks from device-level protections to application-level security mechanisms, highlighting the need for server-side integrity verification, behavioral analytics, and transaction-risk monitoring to detect and prevent financial fraud.
Threat Actor Activity
DOJ Disrupts North Korean Laptop Farms and Remote IT Worker Scheme
The US Department of Justice (DOJ) has disrupted North Korea’s remote IT worker scheme, known as Famous Chollima (or WageMole), by charging fourteen (14) people and raiding more than forty (40) “laptop farms” across Texas. Two (2) US nationals, Michael Bostelle and Juan Pena Carrillo, were arrested on wire fraud, money laundering, and identity theft charges. Agents seized about one hundred and eighty-seven (187) employer issued laptops and keyboard-video-mouse (KVM) devices used by DPRK IT workers to appear US-based while working remotely from abroad. From 2019 to July 2025, the scheme helped North Korean operatives earn roughly $3 million from over seventy (70) US companies across seventeen (17) states in sectors like healthcare, cybersecurity, retail, and manufacturing. Facilitators in the US hosted laptops, set up bank and money-transfer accounts, and helped obtain or use fake IDs, while DPRK workers used stolen or fabricated identities, VPNs, and proxies to bypass sanctions and funnel salaries back to the regime. Cybersecurity researchers and the FBI note that North Korean IT workers are adapting, redirecting shipments with fake theft reports or last minute “moves,” spoofing device identifiers, subcontracting work to freelancers in South Asia and West Africa, and recruiting financially stressed Americans (including active-duty military) to host laptops or lend identities, sometimes under threat of physical violence or data leaks. Authorities warn this disruption will slow but not stop the evolving scheme. CTIX Analysts urge companies to tighten identity verification, device controls, and remote work vetting.
- Bleeping Computer: North Korean Laptop Farm DOJ Disruption Article
- The Record: North Korean Laptop Farm DOJ Disruption Article
- The Hacker News: North Korean Laptop Farm DOJ Disruption Article
Vulnerabilities
Palo Alto Networks Patches Actively Exploited PAN-OS Zero-Day Allowing Root-Level RCE
Palo Alto Networks has released security updates addressing CVE-2026-0322 (CVSS 8.6), a high-severity zero-day vulnerability in the PAN-OS management interface that allows authenticated attackers with network access to execute arbitrary code with root privileges. The flaw affects PA-Series and VM-Series firewalls and Panorama appliances, with no special configuration required for exploitation, while Cloud NGFW and Prisma Access remain unaffected. Palo Alto Networks confirmed limited exploitation in the wild and identified three IP addresses associated with the attacks: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. However, the responsible threat actors, attack timeline, and extent of compromise remain unknown. Security patches are available for affected PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2. with organizations urged to update immediately and restrict management interface access to trusted internal IP addresses or designated jump boxes. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal civilian agencies to remediate the vulnerability by October 17, 2026. The disclosure coincides with Palo Alto Networks issuing twelve (12) additional advisories addressing lower-severity vulnerabilities across its products and Cisco warning of active exploitation of CVE-2026-76519 (CVSS 9.8), a critical Secure Email Gateway vulnerability that could enable unauthenticated attackers to execute commands with root privileges. CTIX analysts urge any affected organizations to follow the CISA guidance, updating immediately and restricting management interface access to trusted internal IP addresses or designated jump boxes.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
