RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service
2026-07-08T01:24:14Z•39427a9a12dcaf91eebb18a7f8455fb76d6f64f238ed74280f19744df68aea82
active-exploitationai-securityandroidbackdoorclouddata-exfiltrationdevice-code-phishingexploitiotkvm-escapelinux-kernelmaasmalwarenation-state-activityphishingransomware-relatedratsupply-chainvulnerability
What happened
A broad set of high-severity cybersecurity developments: multiple critical vulnerabilities and active exploit campaigns (Gitea CVE-2026-20896, Linux KVM Januscape CVE-2026-53359, Bad Epoll CVE-2026-46242, BeyondTrust CVE-2026-40138, Tenda hidden backdoor CVE-2026-11405, Roundcube CVE-2024-42009) are being scanned for or actively abused. Malware-as-a-service and cross-platform RAT offerings (RedWing Android MaaS, QuimaRAT, Avalon) and novel exfil techniques (TrojPix) lower the bar for attackers. Phishing and auth-abuse campaigns (Microsoft device-code flow/DEBULL, GitHub Agentic issue trick, DE
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 39427a9a12dcaf91eebb18a7f8455fb76d6f64f238ed74280f19744df68aea82
- Enrichment time
- 2026-07-08T01:24:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.