The Signal
Must Know
Pegasus and NoviSpy findings in Serbia
What happened
Citizen Lab confirmed that an iMessage zero-click exploit infected a Serbian student protest movement member’s iPhone with NSO Group’s Pegasus spyware without victim action. [1]
The reported Pegasus infection could remain hidden while giving the attacker access to messages, photos, notes, microphone, and camera. [1]
Why it matters
SHARE Foundation documented at least 14 people targeted with advanced spyware since early 2026, including student movement members, civil society activists, an opposition parliament member, and a local councilor. [1]
StreamRat Android malware reporting
What happened
A malicious campaign advertising a fake free TV-streaming service reached roughly 570,000 Meta users, primarily Spanish-speaking people in Spain; the same banners were also used on TikTok. [4]
The ads promoted StreamRat, an Android banking Trojan and infostealer that can monitor screens, capture typed information, display fake login screens, and enable remote device control. [4]
Why it matters
The reported reach measures ad exposure rather than downloads or infections, but the researchers state that it demonstrates how quickly paid advertising can expose a scam to a large audience. [4]
FalconFlank privilege-escalation PoC
What happened
Chaotic Eclipse released FalconFlank, described as a proof-of-concept exploit for a CrowdStrike Falcon privilege-escalation zero-day. [3]
The researcher says FalconFlank abuses Falcon’s Microsoft Office malicious-macro-removal feature, which operates with high privileges as part of remediation. [3]
Why it matters
The researcher warned that CrowdStrike may already detect the published PoC; the article notes that detection of the specific technique would not necessarily remove the underlying vulnerability. [3]
Watch
The article presents the vulnerability and exploit behavior as researcher claims and does not provide independent validation, vendor confirmation, or a permanent fix status. [3]
Fishbrain breach and password response
What happened
Fishbrain disclosed an August 19 breach involving user data including names, contact details, usernames, country information, password hashes, and salts. [2]
Fishbrain said passwords were not stored in plaintext, but compromised hashes for some users may be susceptible to decoding; attackers can attempt offline password guesses using the hashes and salts. [2]
Why it matters
The success of password-cracking attempts depends on password strength and the hashing algorithm, which Fishbrain did not disclose. [2]
Watch
Fishbrain did not disclose the breach scale or how many of its claimed more than 20 million users were affected. [2]
Report on Russian cyber-operator recruitment
What happened
More than 2,000 leaked Bauman Moscow State Technical University documents reportedly describe Department No. 4 as a covert training pipeline serving Russian military intelligence and cyber operations. [5]
Department No. 4 operated inside Bauman’s Military Training Center, was absent from the university’s public organizational chart, and trained roughly 250 career and reserve students across three military specialties. [5]
Why it matters
The reports establish unit placements, but not that an identified individual participated in a specific operation or attack; the source says this distinction matters for attribution and legal proceedings. [5]
Watch
A DarkForums user may have shared the leaked data, but the source says it is unconfirmed whether that account originally obtained the records. [5]