Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
2026-10-13T07:23:58Z•e23908f03dd5fd7ec0f6bfa6ae8b5a40a4e448e3554d5ef04bb31c20af9a74fd
CVE-2015-3306CVE-2026-102255CVE-2026-105133CVE-2026-107406CVE-2026-85097AI-assisted attacksAhsayCBSAndroid malwareChina-linked APTCobalt StrikeFlax TyphoonGitHub ActionsSSRFSonicWall SMAWordPressactive exploitationcredential theftcritical infrastructurecritical vulnerabilitiescryptocurrency theftiOS exploit kitransomwareremote code executionresidential proxysupply-chain compromisezero-day exploitation
What happened
The feed highlights active exploitation of critical vulnerabilities, including SonicWall SMA 1000 SSRF (CVE-2026-102255), Bricksforge WordPress unauthenticated RCE (CVE-2026-85097), AhsayCBS flaws used to deploy web shells and XMRig miners, and other attacks involving supply-chain compromise, credential theft, mobile malware, AI-assisted intrusion, and China-linked threat actors. Several incidents involve in-the-wild exploitation or significant data and financial theft.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- e23908f03dd5fd7ec0f6bfa6ae8b5a40a4e448e3554d5ef04bb31c20af9a74fd
- Enrichment time
- 2026-10-13T07:23:58Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.