New CrystalRAT malware adds RAT, stealer and prankware features

Multiple active threats and security developments: a new Malware-as-a-Service called CrystalRAT is being promoted on Telegram offering RAT, stealer, keylogging and clipboard-hijack/prankware features; the EvilTokens kit enables device-code phishing to hijack Microsoft accounts and fuel BEC; NoVoice Android malware found in >50 Google Play apps infected an estimated 2.3M devices; attackers exploited a TrueConf zero-day to push malicious software updates to connected endpoints; Apple expanded iOS 18 update coverage to block DarkSword exploit-kit attacks; Google patched the fourth Chrome zero-day