Cybersecurity Threats Surge: DDR5 Bot Scalping, Samsung TV Tracking, Reddit Fined £14.47M & More

Recent developments in cybersecurity have highlighted a rapidly evolving threat landscape, with significant incidents and trends emerging that could impact millions of users globally. This week has seen a series of alarming reports, including phishing campaigns, malware distribution, and regulatory actions against major tech companies.

Phishing Campaigns Targeting Ukrainian Institutions

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a warning regarding a phishing campaign aimed at government institutions. The campaign employs phishing emails containing ZIP archives or links to compromised websites to distribute SHADOWSNIFF and SALATSTEALER malware, as well as a Go backdoor known as DEAFTICKK. This activity has been attributed to a threat actor identified as UAC-0252. The situation is further complicated by a suspected Russian espionage operation targeting Ukraine, which has introduced two new malware strains, BadPaw and MeowMeow, as reported by ClearSky.

TrustConnect: A New Malware-as-a-Service

A new malware-as-a-service (MaaS) offering called TrustConnect has emerged, masquerading as a legitimate remote monitoring and management (RMM) tool. Priced at $300 per month, it has been linked to a threat actor associated with RedLine Stealer. Email security firm Proofpoint has reported that multiple threat actors have been distributing this malware through phishing emails since January 27, 2026. These emails often disguise themselves as event invitations or bid proposals, tricking recipients into downloading malicious executables. Once installed, TrustConnect grants attackers full control over the victim’s machine, allowing them to record and stream their screens.

Google Chrome’s New Release Cycle

In a significant shift, Google has announced that it will transition to a two-week release cycle for Chrome updates, moving away from the previous four-week schedule. This change aims to provide developers and users with immediate access to performance improvements and security fixes. The new release cycle will also apply to beta versions, starting with Chrome 153, set to launch on September 8, 2026.

Covert Vehicle Tracking via TPMS

Researchers at IMDEA Networks Institute have discovered that Tire Pressure Monitoring System (TPMS) sensors in vehicles transmit unencrypted signals containing persistent identifiers. This vulnerability allows for covert vehicle tracking, as malicious actors could deploy passive receivers to collect TPMS messages from numerous vehicles. The researchers have warned that this could enable the systematic inference of sensitive information about drivers and their vehicles.

Telegram’s Role in Cybercrime

A recent analysis by CYFIRMA has revealed that Telegram has become a central hub for cybercriminal activities. The platform’s structure facilitates global reach for threat actors, enabling seamless onboarding of buyers and affiliates and supporting various payment options. Telegram has transformed the way cyber operations are coordinated and monetized, serving as a storefront for financially motivated actors and a mobilization tool for hacktivists.

AuraStealer’s Command-and-Control Infrastructure

Intrinsec has uncovered 48 command-and-control (C2) domains associated with AuraStealer, a new information-stealing malware. The malware utilizes .shop and .cfd domains and routes traffic through Cloudflare to obscure its true server. AuraStealer first appeared on underground forums in July 2025 and is available in subscription packages. Its distribution is primarily facilitated through ClickFix malware campaigns.

Malvertising Campaign Targets macOS Users

A malvertising campaign has been identified that uses deceptive ads on Google Search to redirect users seeking macOS storage solutions to fraudulent websites. These sites serve ClickFix-style instructions that deploy a new variant of the Atomic Stealer, known as malext, to extract sensitive data from compromised systems. The campaign has leveraged over 50 compromised Google Ads accounts to push more than 485 malicious landing pages.

DDR5 Inventory Scalping by Bots

A large-scale data-gathering operation has been reported, with bots submitting over 10 million web scraping requests to e-commerce sites to locate desirable DDR5 memory stock. These bots utilize cache-busting techniques to evade detection and check stock every 6.5 seconds. This aggressive targeting of the supply chain is driving up prices and limiting availability for legitimate consumers.

Reddit Fined for Children’s Data Violations

The U.K. Information Commissioner’s Office (ICO) has imposed a fine of £14.47 million on Reddit for unlawfully processing the personal information of children under 13. The ICO found that Reddit failed to implement adequate age verification measures, exposing young users to inappropriate content. Reddit has announced plans to appeal the decision, asserting that it prioritizes user privacy.

Samsung’s Data Collection Restrictions in Texas

In response to a lawsuit, Samsung has agreed to cease collecting Automated Content Recognition (ACR) data in Texas without explicit user consent. The Texas Attorney General’s office has mandated that Samsung update its smart TVs to include clear disclosures and consent screens regarding data collection practices.

NATO Approves iPhones and iPads for Classified Use

Apple’s iPhones and iPads have received approval to handle classified information within NATO networks, marking the first time consumer-grade devices have been authorized for such use without additional software. This approval follows a security evaluation conducted by Germany’s Federal Office for Information Security.

TikTok’s Stance on End-to-End Encryption

TikTok has stated that it will not implement end-to-end encryption for direct messages, citing concerns that such measures would hinder law enforcement’s ability to monitor communications for safety reasons. The company emphasizes its commitment to user protection, particularly for younger audiences.

Multi-Stage Phishing Campaign Using Agent Tesla

A new phishing campaign has been identified that employs purchase order lures to deliver Agent Tesla malware. This multi-stage attack chain utilizes obfuscation and in-memory execution techniques to evade detection. The malware is designed to remain hidden until it is certain it is not being monitored.

Abuse of the .arpa Domain by Cybercriminals

Research from Infoblox has revealed that cybercriminals are exploiting the .arpa top-level domain, which is reserved for network infrastructure, to host malicious content. This tactic allows them to bypass traditional security measures. The report also highlights the use of LNK shortcut files and WebDAV for malware delivery.

LastPass Users Targeted by Spoofed Email Chains

A phishing campaign targeting LastPass users has begun, utilizing spoofed email chains to trick recipients into visiting fake login pages. The attackers manipulate display names to impersonate LastPass, concealing the true sender’s address.

Concerns Over AI Coding Agents

OX Security has cautioned against placing blind trust in AI coding agents, emphasizing that these systems do not create new code patterns but replicate existing ones. The company warns that reliance on a single AI model for both coding and validation could exacerbate existing vulnerabilities in software engineering practices.

Automated Deanonymization Using LLMs

A collaborative study from Anthropic and ETH Zurich has demonstrated that large language models (LLMs) can deanonymize internet users based on their digital footprints. This research indicates that traditional assumptions about online pseudonymity may no longer hold, necessitating a reevaluation of online privacy threat models.

As reported by thehackernews.com, these developments underscore the dynamic nature of the cybersecurity landscape, where new threats and vulnerabilities continue to emerge.