The invisible passenger in your car
2026-08-26T08:51:46Z•d8b016a8271d987e3e170b0f5c5e130834b97153eee4261dead7db83a71ae0df
.NETAitM phishingAndroidArmored LikhoBrazilC2CAV3RNCoolClientDNS tunnelingGoogle Apps ScriptHead MareHoneyMyteKerberoastingMFA bypassPhantomCorePhantomGraphTelegramTrueConfWindowsadwarecloud platformscyber espionagekernel rootkitmalwareproxy botnet
What happened
Kaspersky Securelist RSS collection covering August 2026 threat research, including Android adware and proxy botnets distributed via DoFun head units; HoneyMyte’s CoolClient backdoor with a kernel-level Windows rootkit; Armored Likho espionage targeting Telegram data; Head Mare exploitation of unpatched TrueConf servers to deploy PhantomCore and PhantomGraph; Project CAV3RN using Google Apps Script and DNS-based C2; cloud-hosted adversary-in-the-middle phishing designed to bypass MFA; and broader malware statistics and incident-response analysis.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- d8b016a8271d987e3e170b0f5c5e130834b97153eee4261dead7db83a71ae0df
- Enrichment time
- 2026-08-26T08:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.