Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

Pulse of recent security news: multiple active malware and supply-chain campaigns (Grandoreiro, BTMOB, GlassWorm, TrapDoor, Laravel‑Lang compromises, Packagist abuses) are targeting Windows, Android, and developer ecosystems across Latin America, Europe, and globally. Several high‑impact vulnerabilities are being exploited or patched, including Gitea unauthenticated container access, LiteSpeed cPanel RCE (CVE‑2026‑48172) under active exploitation, Ghost CMS SQLi (CVE‑2026‑26980) used to hijack sites, and other disclosed flaws (SharePoint, KnowledgeDeliver, Drupal) with active exploitation and/