GoKawiil
Tech News
Google's Threat Intelligence Group dismantled x.cpe, a botnet that infected over 1.3 million Google-certified Android TV boxes, mostly sold under the MECOOL brand by Shenzhen-based Videostrong Technology. The malware used a backdoor to remotely install itself after devices went online, disabling Play Protect and evolving into a three-stage platform sold to third parties for residential proxying and ad fraud.
Google Threat Intelligence Group and Mandiant report that cybercriminals are stealing access to commercial large language models through compromised cloud credentials and reselling that access on underground markets. In some cases, fraudulent usage charges topped $100,000 in a single day, with total costs to a victim organization reaching $1 million before the compromised access was cut off.
Google's Threat Intelligence Group and Mandiant found that attackers are stealing API keys and exploiting exposed LLM endpoints to resell unauthorized access through services called LLM mixers. Victim organizations have seen fraudulent usage spike past 1,000 requests per second, with some racking up over $100,000 in charges in a single day and cumulative losses reaching $1 million. One service, Jet Night, reportedly passed nearly $1 million in token costs to a single victim after executing more than 500,000 API calls in under eight hours.
A coalition including Google Threat Intelligence Group, TrendAI and Japan's National Police Agency disrupted a botnet of more than 1.3 million Android TV boxes and projectors spanning over 200 countries. Google says Shenzhen-based manufacturer Videostrong Technology deliberately built a backdoor called XCPE into device firmware and sold access to criminal affiliates, who installed malware modules to route traffic through unsuspecting owners' home networks. The group also took down command-and-control domains tied to affiliate modules and said it has cut ties with Videostrong, banning it from shipping devices with preloaded Google apps.
Google's Threat Intelligence Group worked with industry partners to take down a botnet, dubbed XCPE, built from more than 1.3 million Android TV set-top boxes. Investigators traced the malware to Videostrong Technology Co., a Chinese manufacturer accused of preloading devices with backdoors that resold users' internet connections through residential proxy services and enabled advertising fraud. Google took legal action to seize the domains and servers used to control the botnet.
A coordinated law enforcement effort known as Operation Blackout successfully took down a network of scam centers, according to a threat intelligence expert who detailed the operation's execution. The expert described the takedown as a significant win against organized scam operations and called for similar efforts to continue.
Amazon's Threat Intelligence team says it detected an attempt to exploit two critical PHP vulnerabilities on October 17th, using a honeypot monitoring system, days before an official patch was released this week. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers remotely execute malicious code on PHP-based systems including WordPress sites. The PHP Foundation's executive director Elizabeth Barron says there's no known successful remote code execution so far, but urges all affected systems be updated immediately.
Amazon Threat Intelligence found an exploitation attempt against the PHP2Shell vulnerability (CVE-2026-109618/CVE-2026-109619) in its MadPot honeypot telemetry dated Oct. 17, 2026, four days before the embargoed flaw was publicly disclosed. The attempt came from an IP tied to a commercial anonymization service. After the embargo lifted on Oct. 21, Amazon observed multiple proof-of-concept exploits and additional attacks from varied anonymized infrastructure within hours, and the vulnerability is now reportedly being exploited broadly in the wild.
Amazon Threat Intelligence reports that attackers began targeting the two critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on October 17, four days before PHP released fixes on October 21. The PHP team had to move up its disclosure timeline after details including the CVE IDs and mitigation guidance leaked online two days early, and researchers say functional exploits appeared within hours of the patch release.
A developer released VoidAccess, a self-hostable, open-source tool that lets security researchers turn dark-web search queries into structured threat intelligence. It collects data from Tor indexes, paste sites, code forges and security feeds, extracts entities like IOCs and malware, and builds relationship graphs that can be exported in formats such as STIX, MISP and YARA. It is available via pip install and can run locally or as a Docker Compose stack.
Attackers identified as UNC7017 compromised AOMEI's servers between April and July 2026, briefly altering configuration files used by AOMEI Backupper's promotional feature to distribute a new downloader called CROSSROAD and a backdoor called SHINYROAD, then restoring the files to cover their tracks. Researchers from ManageEngine's METAL team, Google's Threat Intelligence Group and Mandiant found affected organizations in the US, Australia, India, Singapore, Spain and Switzerland, spanning IT services, telecoms and higher education.
F-Secure's Threat Intelligence team has published a Scam Encyclopedia, a continuously updated guide documenting more than 50 distinct online scam types, from cryptocurrency fraud to social media and shopping schemes. The resource describes each scam from the victim's point of view, detailing what they see, what they're told, and what they're asked to do, rather than explaining the mechanics from a technical standpoint.