Endpoint/Device Security

Widespread malvertising campaign VASTFLUX, which involved the impersonation of more than 1,700 apps and impacted nearly 11 million devices, has been taken down by fraud prevention company HUMAN, The Hacker News reports.

ThreatFabric researchers have discovered the emergence of the new Hook Android malware created by BlackRock and ERMAC Android banking trojan DukeEugene, which has mostly been targeting financial apps in the U.S., Canada, France, Spain, Italy, Australia, and the U.K., reports The Hacker News.

Updated Roaming Mantis malware involves DNS changer Threat actors behind the Roaming Mantis credential theft and malware distribution campaign have added a DNS changer to their Wroba.o/XLoader Android malware, which enables DNS settings modification on targeted WiFi routers to facilitate further infections, according to BleepingComputer.

Both Netcomm and TP-Link routers have been reported by the CERT Coordination Center to be affected by critical bugs, some of which could be leveraged for remote code execution, reports The Hacker News.

Nozomi Networks reported that wiper malware, IoT botnet activity, and the Russia-Ukraine war significantly influenced the threat landscape last year.

More than 4,000 internet-connected Sophos Firewall devices continue to have the critical remote code execution flaw, tracked as CVE-2022-3236, unpatched despite the release of hotfixes last September and the issuance of official patches in December, reports BleepingComputer.