Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
7 / 7 results
highperson_alertThreat ActorOvi Exposes uCreator Android Spyware Targeting Telegram and WeChat
Ovi is a security researcher who discovered and analyzed the uCreator Android spyware kit in October 2026. Ovi is not a threat actor but rather the researcher who exposed this rentable spyware operation.
highbug_reportVulnerabilityRemControl Android MaaS targets banking users via fake TVTap IPTV app
Android users in Europe (Italy, France, Spain, Poland, Portugal), Canada, and Middle East. Targets 30+ banking applications through phishing overlays. Distributed via malvertising campaigns impersonating TVTap IPTV app on fake Google Play pages.
highperson_alertThreat ActorMantax Otax: Android malware blends ransomware and spyware features
Mantax Otax is a newly identified Android malware family that exhibits hybrid functionality, combining ransomware encryption capabilities with spyware data exfiltration and victim harassment features.
highbug_reportVulnerabilityManic Android malware exfiltrates data via nearby infected devices
Android users in Central and Western Europe (including UK), Russia, and primarily Ukraine. Targets 169 banking, government/eID, payment, crypto wallet, messaging, and 2FA apps. Active since at least February 2026.
highperson_alertThreat ActorKimwolf v7 Botnet Adds HTTP/2 DDoS with Browser Fingerprinting
Kimwolf (also tracked as AISURU) is an Android and IoT botnet operation active since at least mid-2024. The threat actors behind Kimwolf have demonstrated continuous evolution in their tooling, targeting Android TV boxes since August 2025 and Linux I…
highbug_reportVulnerabilityBTMOB Android RAT ecosystem fragments into resellers and source-code sales
Organizations and individuals targeted by BTMOB Android RAT malware-as-a-service (MaaS). BTMOB is an Android remote access trojan distributed through multiple channels including official operators, resellers, and source-code buyers.
highbug_reportVulnerabilityBTMOB Android RAT offered as MaaS with custom phishing builder
Android devices targeted by BTMOB remote access trojan. No specific vendor or version restrictions; affects users who install malicious APKs distributed through phishing campaigns.