GoKawiil
Tech News
A threat actor group calling itself "BYOD" published records for 3,615 Trump Mobile customer accounts on the dark web, including names, emails, phone numbers, home addresses and order histories. The group says it broke in via a remote access trojan placed on an employee device at Liberty Mobile, the MVNO that powers Trump Mobile's network, and the leak reportedly includes personal details of Trump Organization CIO Eric Brunnett.
Security researchers at Flare identified a ClickFix social-engineering campaign distributing the CrocoRat remote access Trojan and cryptocurrency stealer via a misspelled domain showing a fake house-wiring image. Instead of fetching malware directly, the pasted PowerShell command queries an attacker-controlled DNS TXT record, which returns instructions for the next stage of the attack.
A cybersecurity incident has potentially compromised the personal information of 3,615 individuals linked to Trump Mobile, including names, addresses, emails, and phone numbers. The breach was claimed by the hacking group BYOD, which reportedly gained access through a remote access trojan on a Liberty Mobile employee and also accessed Trump Mobile’s website backend. Some affected individuals may not have fully registered with the service, yet their data was still exposed.
Fortinet's FortiGuard Labs identified a new variant of the SectopRAT remote access Trojan concealed within legitimate digital-audio software from an Italian company. Researcher Xiaopeng Zhang said attackers modified the FrameworkBase.dll file after the software was already installed on victim machines, secretly loading the SectopRAT payload rather than compromising the vendor itself.
Cybersecurity agencies from Japan, the US, Australia and Germany issued a joint advisory identifying North Korea's WaterPlum group as the actor behind malware hidden in fake job application coding tests. The scheme has infected over 30,000 devices across 100 countries and compromised more than 7,000 crypto wallets, netting $10.71 million believed to fund the North Korean government.
A malware-as-a-service platform called VectraRAT is being sold on underground markets for roughly $250 monthly, giving buyers a Windows-based remote access implant, command-and-control infrastructure, and a management panel. The package effectively bundles everything needed to compromise and control enterprise Windows systems without requiring technical expertise from the attacker.