Security news.
Today's security news highlights a critical focus on supply chain attacks, with Android car head units and npm packages being exploited. We also see significant developments in AI-related security, from new skill risks to AI-assisted malware, alongside ongoing efforts to patch actively exploited vulnerabilities across various platforms.
Android Car Head Units Infected with Proxy Botnet Malware
A supply-chain attack is leveraging legitimate device-update apps to spread malware that enlists Android-based car head units into a proxy botnet or uses them for ad fraud.
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
TikTok has agreed to pay $400 million to settle a 2024 lawsuit from the U.S. Department of Justice (DoJ) regarding violations of child privacy laws.
Trojanized npm Packages Deliver AI-Assisted RedC2 4.0 Linux Backdoor
Cybersecurity researchers have uncovered 14 trojanized npm packages, disguised as utilities, engineered to deploy the AI-powered RedC2 4.0 Linux implant.
New SynkLoader Malware in Microsoft Teams Phishing Campaigns
A previously unknown malware family, SynkLoader, is being distributed via Microsoft Teams phishing campaigns to steal credentials using a fake lock screen.
Banking Trojans Manic, Grandoreiro, and ToxicPanda 2.0 Resurface
New campaigns highlight the ongoing threat of banking Trojans, including the spyware-equipped Manic, a persistent Grandoreiro operation, and an expanded ToxicPanda 2.0 malware.
New Phishing Toolkit Uses Passkeys for Persistent Access
The iAuthFlow V2 phishing toolkit can register attacker-controlled passkeys, enabling persistent access to accounts even after victims change passwords and revoke active sessions.
Critical Isolated-vm Vulnerability Leads to RCE on Host
A type confusion bug in the isolated-vm package could allow for a V8 sandbox escape and control-flow hijacking of the host process, leading to remote code execution.
CISA Orders Feds to Patch Actively Exploited TrueConf Server Flaws
CISA has mandated federal agencies to immediately patch two actively exploited vulnerabilities (CVE-2026-72529, CVE-2026-72530) in the TrueConf Server self-hosted communications platform.