Cloud Phones Linked to Rising Financial Fraud Threat

A cluster of high-impact incidents and trends: multiple supply‑chain compromises (TeamPCP-linked LiteLLM PyPI package, compromised Trivy Docker images, Ghost npm campaign) are delivering credential‑stealers and RATs; browser extensions and “prompt‑poaching” attacks are harvesting AI conversations; mobile‑focused fraud and Android OS‑level attacks are escalating financial theft and MFA bypass techniques (Tycoon2FA, LSPosed exploits). Active exploitation of critical vulnerabilities is widespread — Citrix NetScaler memory‑leak flaw and a Cisco zero‑day (CVE-2026-20131) are being weaponized in the