Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users
2026-05-28T01:24:13Z•1c158bdee4d20df3ad3b854806afd05043a2ce1dbd28c8fa3c79d984c5490397
AI-abuseAndroidBTMOBCERT-InDrupalGhost CMSGiteaGlassWormGrandoreiroKnowledgeDeliverLiteSpeedMFA-prompt-bombingPackagistPyPISharePointWindowsactive-exploitationbanking-trojancrates.iocredential-stealercryptojackingmalwarenpmsupply-chainvulnerability-management
What happened
The feed details a broad surge in active malware, supply-chain compromises, and high-severity vulnerabilities. Key items: Grandoreiro and BTMOB banking-trojan campaigns targeting Windows and Android in Latin America/Europe; a malicious npm package ('mouse5212-super-formatter') exfiltrating files from Anthropic Claude's /mnt/user-data; coordinated supply-chain campaigns (TrapDoor, Laravel‑Lang, Packagist) distributing credential-stealers; GlassWorm C2 disruption; AI-assisted abuse including chatbot-driven cryptojacking and MFA prompt-bombing; and multiple actively exploited or high‑severity CVE
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 1c158bdee4d20df3ad3b854806afd05043a2ce1dbd28c8fa3c79d984c5490397
- Enrichment time
- 2026-05-28T01:24:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.