$15B Crypto Bust, Satellite Spying, Billion-Dollar Smishing, Android RATs & More

The U.S. authorities has seized $15 billion (roughly 127,271 bitcoin) price of cryptocurrency belongings from one of many world’s largest operators of forced-labor rip-off compounds throughout Cambodia, Myanmar, and Laos, that are recognized to conduct romance baiting (aka pig butchering or Shā Zhū Pán) schemes to defraud victims below the pretext of elevated returns. The perpetrators, working from the rip-off compounds below the specter of violence, typically constructed relationships with their victims over time, incomes their belief earlier than stealing their funds. The Division of Justice (DoJ) unsealed an indictment in opposition to the Prince Group and its 38-year-old CEO, Chen Zhi (aka Vincent). “People held in opposition to their will within the compounds engaged in cryptocurrency funding fraud schemes, often called ‘pig butchering’ scams, that stole billions of {dollars} from victims in america and around the globe,” the DoJ said. “Trafficked staff had been confined in prison-like compounds and compelled to hold out on-line scams on an industrial scale, preying on 1000’s worldwide.” Zhi, the alleged kingpin behind the sprawling cybercrime empire, is at giant. The division additionally mentioned the seized funds signify “proceeds and instrumentalities of the defendant’s fraud and cash laundering schemes” and had been saved in unhosted cryptocurrency wallets whose non-public keys the defendant had in his possession. The compounds operated out of casinos and luxurious motels owned by the Group. A few of the stolen proceeds had been spent on luxurious items, together with yachts, non-public jets, artwork, and even a Picasso portray. In tandem, the U.S. and the U.Okay. designated Prince Group as a transnational legal group and announced sanctions in opposition to the defendant. Different proxy organizations focused by the sanctions embrace Jin Bei Group, Golden Fortune Resorts World, and Byex Alternate. Elliptic said the $15 billion seized by the U.S. was “stolen” in 2020 from LuBian, a bitcoin mining enterprise with operations in China and Iran. LuBian, per the blockchain analytics firm, was one of many ostensibly authorized enterprise enterprises overseen by Prince Group. “Pig butchering has exploded into an industrialized fraud economic system producing tens of billions of {dollars} yearly,” Infoblox said. “Refined Asian crime syndicates have confirmed adept at spinning up a whole lot of disposable web sites in minutes, overwhelming governments that can’t detect or block them quick sufficient to protect victims.”

Kaspersky has revealed that the newly found banking trojan dubbed Maverick focusing on Brazilian customers utilizing a WhatsApp worm named SORVEPOTEL shares many code overlaps with Coyote. “As soon as put in, the trojan makes use of the open-source challenge WPPConnect to automate the sending of messages in hijacked accounts by way of WhatsApp Internet, profiting from the entry to ship the malicious message to contacts,” the Russian safety vendor said. “The Maverick trojan checks the time zone, language, area, and date and time format on contaminated machines to make sure the sufferer is in Brazil; in any other case, the malware is not going to be put in.” The malware displays victims’ entry to 26 Brazilian financial institution web sites, six cryptocurrency trade web sites, and one cost platform to facilitate credential theft. It additionally comes with capabilities to completely management the contaminated pc, take screenshots, set up a keylogger, management the mouse, block the display screen when accessing a banking web site, terminate processes, and open phishing pages in an overlay. Kaspersky mentioned it has blocked 62,000 an infection makes an attempt utilizing the malicious LNK file shared by way of WhatsApp within the first 10 days of October, solely in Brazil, indicating a large-scale marketing campaign.

A new study from a workforce of lecturers from the College of Maryland and the College of California, San Diego has discovered that it is potential to intercept and spy on 39 geostationary satellite tv for pc communications visitors from the U.S. army, telecommunications companies, main companies, and organizations utilizing a consumer-grade satellite tv for pc dish put in on the roof of their constructing. Intercepted information comprised cell service calls and textual content messages, VoIP name audio, login credentials, company emails, stock information, and ATM networking info belonging to retail, monetary, and banking firms, army and authorities secrets and techniques related to coastal vessel surveillance, and net searching actions of in-flight Wi-Fi customers. “An incredibly great amount of delicate visitors is being broadcast unencrypted, together with vital infrastructure, inner company and authorities communications, non-public residents’ voice calls and SMS, and client Web visitors from in-flight wifi and cell networks,” the researchers said. “This information might be passively noticed by anybody with a number of hundred {dollars} of consumer-grade {hardware}.” Following disclosure, T-Cell has moved to encrypt its satellite tv for pc communications.

Lots of of customers are estimated to have had their delicate info stolen by way of a compromised web site belonging to online game software program improvement firm Unity Applied sciences. The malicious skimmer, injected into the checkout web page of Unity SpeedTree, was designed to reap the data entered by people who made purchases on the SpeedTree website, together with identify, handle, e-mail handle, cost card quantity, and entry code. In line with a filing with the Maine Lawyer Common’s Workplace, the incident impacted 428 people. The affected clients are being notified and supplied free credit score monitoring and id safety companies. The breach was found on August 26, 2025.

Smishing campaigns carried out by Chinese language cybercrime teams that distribute pretend SMS messages to U.S. customers about package deal deliveries and toll street funds have made greater than $1 billion during the last three years, The Wall Avenue Journal reported, citing the Division of Homeland Safety. The rip-off, made potential by way of phishing kits bought on Telegram, is designed to steal victims’ bank card particulars after which use them in Google and Apple Wallets in Asia and the U.S. to make unauthorized purchases, equivalent to reward playing cards, iPhones, clothes, and cosmetics. The messages are despatched by way of SIM farms, with about 200 SIM bins working in not less than 38 farms throughout the U.S. In line with Proofpoint, as many as 330,000 toll rip-off messages had been despatched to Individuals in a single day final month. A earlier report from SecAlliance in August 2025 noted that Chinese language smishing syndicates could have compromised between 12.7 million and 115 million cost playing cards within the U.S. alone between July 2023 and October 2024. The legal ecosystem has since developed to incorporate the sale of pre-positioned gadgets loaded with stolen playing cards, indicating an evolution of the monetization technique.

A complicated marketing campaign focusing on macOS customers has employed pretend Homebrew installer web sites (homebrewfaq[.]org, homebrewclubs[.]org, and homebrewupdate[.]org) that ship malicious payloads. The assault exploits the widespread belief customers place within the fashionable Homebrew package deal supervisor by creating pixel-perfect replicas of the official brew[.]sh set up web page, and mixing it with misleading clipboard manipulation methods. The spoofed websites incorporate hidden JavaScript designed to inject extra instructions into customers’ clipboards with out their data in the course of the set up part when unsuspecting customers try to repeat the command to put in the instrument. It is assessed that the assault chain is getting used to ship Odyssey Stealer. Earlier campaigns have used pretend Homebrew pages to trick customers into putting in Cuckoo Stealer.

The U.Okay.’s Nationwide Cyber Safety Centre (NCSC) reported 204 “nationwide important” cyber incidents between September 2024 and August 2025. The quantity represents an 130% improve in comparison with the earlier 12 months, when U.Okay. organizations confronted 89 incidents of such excessive affect. Of those, 18 had been categorised as extremely important incidents. The disclosure comes as Bloomberg revealed that Chinese language state actors systemically and efficiently compromised categorised U.Okay. authorities pc methods for greater than a decade, accessing low- and medium-level categorised info. The information accessed included confidential paperwork referring to the formulation of presidency coverage, non-public communications, and a few diplomatic cables, the report added.

Round 200,000 Linux pc methods from American pc maker Framework have been discovered to be shipped with signed UEFI shell parts that could possibly be exploited to bypass Safe Boot protections. An attacker might benefit from the problems to load bootkits that may evade working system-level safety controls and survive re-installs of the working system. The vulnerabilities have been codenamed BombShell by Eclypsium. “On the coronary heart of this situation is a seemingly harmless command: mm (reminiscence modify),” the firmware safety firm said. “This command, current in lots of UEFI shells, offers direct learn and write entry to system reminiscence. Whereas this functionality is important for legit diagnostics, it is also the right instrument for bypassing each safety management within the system.” Framework has launched safety updates to deal with the vulnerabilities.

Cybercriminals have unleashed a classy phishing marketing campaign focusing on Colombian customers by way of misleading judicial notifications, deploying a fancy multi-stage malware supply system that culminates in supply of AsyncRAT. The assault marketing campaign employs fastidiously crafted Spanish-language emails impersonating official correspondence from the Colombia courtroom system, informing recipients of purported lawsuits filed in opposition to them and tricking them into opening SVG file attachments that result in pretend touchdown pages in order to obtain the doc, which is an HTML Utility answerable for activating a sequence of interim payloads to deploy AsyncRAT.

Google has added new protections to Google Messages and account restoration strategies to safe individuals in opposition to scams. This contains the power to dam customers from visiting hyperlinks shared on Messages which have been flagged as spam, except customers explicitly mark the texts as “not spam.” The corporate has additionally added the choice to regain entry to the Google Account via a “Check in with Cell Quantity” possibility. “All you want is the lock-screen passcode out of your earlier machine for verification, no password wanted,” it mentioned. One other new characteristic contains Recovery Contacts, which permits customers to decide on trusted associates or relations to make it simpler to get better entry to the account in case it will get locked out resulting from a tool being stolen. Final however not least, Google mentioned it is also making the Key Verifier accessible to all Android 10+ customers for an additional layer of safety when chatting by way of Google Messages by guaranteeing that customers are speaking with the individual they intend to and never any person else.

A C# malware loader known as PhantomVAI Loader is being distributed by way of phishing emails bearing cargo lures to ship stealers and distant entry trojans like AsyncRAT, XWorm, Formbook, and DCRat. “The loader initially utilized in these campaigns was dubbed Katz Stealer Loader [aka VMDetectLoader], for the Katz Stealer malware that it delivers,” Palo Alto Networks Unit 42 said. “Hackers are promoting this new infostealer on underground boards as malware as a service (MaaS).” Phishing campaigns deploying PhantomVAI Loader have focused a large spectrum of sectors globally, together with manufacturing, training, utilities, know-how, healthcare, and authorities. The phishing emails include zipped JavaScript or Visible Fundamental Script information that launch PowerShell, answerable for dropping the loader within the type of a GIF picture, which then proceeds to run digital machine checks, set up persistence, and inject MSBuild.exe with the next-stage payload utilizing a method known as process hollowing.

A nascent toolkit named Whisper 2FA has emerged because the third most typical phishing-as-a-service (PhaaS) after Tycoon and EvilProxy. Barracuda mentioned it has detected near 1,000,000 Whisper 2FA assaults focusing on Microsoft accounts in a number of enormous phishing campaigns within the final month. Whisper 2FA has been discovered to share similarities with one other PhaaS package named Salty 2FA. “Whisper 2FA’s defining trait is its means to steal credentials a number of instances by way of a real-time credential exfiltration loop enabled by an internet know-how often called AJAX (Asynchronous JavaScript and XML),” safety researcher Deerendra Prasad said. “The attackers hold the loop going till they acquire a sound multi-factor authentication token.” The phishing package is assessed to be below lively improvement, with the authors progressively including extra layers of obfuscation and protections to dam debugging instruments and crash browser inspection instruments. “As phishing kits like this proceed to evolve, organizations want to maneuver previous static defenses and undertake layered methods: consumer coaching, phishing-resistant MFA, steady monitoring, and menace intelligence sharing,” Prasad added.

The Scattered Lapsus$ Hunters (SLSH) cybercrime group, comprised primarily of English-speaking youngsters combining parts of Scattered Spider, LAPSUS$, and ShinyHunters, has introduced it would go darkish till 2026 following the FBI’s seizure of its clearnet information leak website. “As per the distinctive circumstances by which the FBI tried to obliterate our legacy, we have exceptionally determined to quickly resign to oblivion [sic] and promptly hack them again,” one member wrote on October 11. “We will now dissolve once more within the ether. Good night time.” In a follow-up message, it mentioned: “I promise you, you’ll really feel our wrath.” The extortion crew has since published data allegedly belonging to 6 of the 39 focused firms, together with Qantas, Albertsons, GAP, Vietnam Airways, Fujifilm, and Engie Sources, per DataBreaches.web.

Cybersecurity researchers have documented an increase in cyber assaults exploiting distant monitoring and administration (RMM) instruments for preliminary entry by way of phishing e-mail alerts warning of faux login to recipients’ ConnectWise ScreenConnect situations. Superior persistent menace (APT) teams and ransomware crews have leveraged legit RMM platforms, together with AnyDesk, ScreenConnect, UltraViewer, AppAnywhere, RustDesk, CloneDesk, Splashtop, and TightVNC, to realize unauthorized management of methods. The researchers discovered that menace actors are additionally exploiting ScreenConnect’s legit options, equivalent to unattended entry and interactive desktop management, to ascertain persistence and transfer laterally inside compromised networks. “Their administrative energy, mixed with customized installers, invite hyperlinks, and public URLs, makes them high-value targets,” DarkAtlas said.

German and Bulgarian authorities have seized 1,406 web sites that had been used for perpetrating large-scale monetary scams. The websites, taken offline initially of the month, lured customers to spend money on cryptocurrency on fraudulent buying and selling platforms after which disappeared with their funds. Officers mentioned the platforms didn’t have the mandatory permission from BaFin to offer monetary or securities companies and banking transactions. In addition they mentioned greater than 866,000 makes an attempt to entry the websites had been recorded over a interval of ten days after they had been seized on October 3, 2025, underscoring the attackers’ success in pulling off the scheme. In mid-June 2025, around 800 illegal domains had been blocked as a part of an analogous effort.

NVIDIA has rolled out fixes for 2 vulnerabilities in NVIDIA’s Show Driver for Linux (CVE-2025-23280 and CVE-2025-23330) that may be triggered by an attacker controlling a neighborhood unprivileged course of to attain kernel learn and write primitives. Quarkslab, which found and reported the failings in June 2025, has released an entire proof-of-concept exploit.

Cyble and iVerify have detailed two new Android malware households known as GhostBat RAT and HyperRat that may steal delicate information from compromised gadgets. “Operators can fetch logs, ship notifications, dispatch an SMS from the contaminated consumer’s SIM, obtain archived messages, examine the decision log, view or modify granted permissions, browse put in purposes, and even set up a VNC session,” iVerify safety researcher Daniel Kelley said about HyperRat. The online-based command-and-control (C2) panel helps the power to create customized APK information utilizing a builder, serve pretend login overlays atop put in apps, and an choice to facilitate downstream spam or phishing campaigns by way of a mass messaging button. GhostBat RAT, alternatively, has been noticed focusing on Indian Android customers by way of bogus apps distributed by way of WhatsApp and SMS messages containing hyperlinks to compromised web sites and GitHub. As soon as put in, the malware makes use of phishing pages to seize banking credentials and UPI PINs. It could additionally exfiltrate SMS messages containing banking-related key phrases, with choose variants together with cryptocurrency mining capabilities. “The GhostBat RAT samples included multi-stage dropper workflows, native binary packing, deliberate corruption/manipulation of ZIP headers, runtime anti-emulation checks, and heavy string obfuscation, complicating reverse engineering,” Cyble noted.

Brazilian regulation enforcement authorities have disrupted a classy legal community that has been accused of laundering about $540 million. The sweeping operation, codenamed Lusocoin, noticed 13 searches and 11 non permanent arrests, in addition to the seizure of six luxurious autos and 6 high-value properties. Property totaling greater than 3 billion Brazilian reais (about $540 million) have been subjected to court-ordered freezes. Officers mentioned the community operated as a global money-laundering and foreign-exchange evasion scheme, changing illicit earnings from drug trafficking, smuggling, tax evasion, and even terrorism financing into cryptocurrency belongings to cover the supply of funds. In all, the group is believed to have moved greater than $9 billion by way of its ecosystem of shell firms, exchanges, and digital wallets.

New analysis has discovered that it is potential to leverage Amazon’s distributed utility tracing service AWS X-Ray as a covert C2 server, primarily turning cloud monitoring infrastructure to ascertain bidirectional communication. “AWS X-Ray was designed to assist builders perceive utility efficiency by amassing traces,” safety researcher Dhiraj Mishra said. “Nonetheless, X-Ray annotations can retailer arbitrary key-value information, and the service offers APIs to each write and question this information.” An attacker can weaponize this conduct to implant a beacon on the goal system and subsequently management it by issuing an HTTP PUT request containing a Base64 command to the X-Ray service’s “/TraceSegments” endpoint, from the place the sufferer machine fetches the malicious hint in the course of the polling part after which decodes and executes the embedded command inside it. The outcomes of the command execution are exfiltrated to the X-Ray service, permitting the attacker to entry the consequence traces by sending an HTTP GET request to the “/TraceSummaries” endpoint.

Seven safety vulnerabilities (from CVE-2025-54246 by way of CVE-2025-54252) have been disclosed in Adobe Expertise Supervisor that might end in safety characteristic bypass and permit attackers to realize unauthorized learn/write entry. The problems, which had been reported by Searchlight Cyber’s Assetnote workforce in June 2025, had been fixed by Adobe final month. There is no such thing as a proof that they had been exploited within the wild.

Google has reached a settlement settlement over its use of an open-source dataset named Diversity in Faces that allegedly contained pictures of individuals from the U.S. state of Illinois for coaching its facial recognition algorithms in violation of the Biometric Data Privateness Act (BIPA). The dataset was created in 2019 by IBM to deal with present biases in overwhelmingly light-skinned and male-dominated facial datasets. In line with plaintiffs, a number of the pictures had been pulled from a Flickr dataset that featured biometric information of individuals from Illinois. The phrases of the settlement weren’t disclosed. The case was initially filed in 2020, with lawsuits additionally filed in opposition to Amazon and Microsoft for comparable violations.

A brand new report from Chainalysis has revealed that cryptocurrency balances linked to illicit exercise exceed $75 billion. This contains about $15 billion held straight by illicit entities and greater than $60 billion in wallets with downstream publicity to these entities. “Darknet market directors and distributors alone management over $40 billion in on-chain worth,” the blockchain intelligence agency mentioned. Earlier this 12 months, Chainalysis disclosed that greater than $40 billion in cryptocurrency was laundered in 2024 alone, most of it by way of wallets and mixers that go away no hint in customary compliance methods.