MEDIUMMalware
Global

Indonesia Hit by Android Banking App-Cloning Campaign

·Source: Dark Reading

Updated:

Executive Summary

The GoldFactory threat group exploits the Android Work Profile feature to deliver the Gigabud Trojan, while Mantax Otax spreads separately.

Analysis

The GoldFactory threat group exploits the Android Work Profile feature to deliver the Gigabud Trojan, while Mantax Otax spreads separately.
Source Attribution

Originally published by Dark Reading on Sep 11, 2026.

Related Threats

CRITICALMalware

Artifactory flaws chained in attacks deploying backdoor malware

Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. [...]

BleepingComputer
CRITICALMalware

India’s STPI serves TerminalFix-style attack via fake Cloudflare check

A website linked to India’s Software Technology Parks of India (STPI) is serving a spoofed Cloudflare verification page that silently copies a malicious string to visitors’ clipboards and prompts them to execute it via Windows Terminal, in a technique consistent with emerging TerminalFix-style attacks. STPI, a Government of India organization that supports the country’s IT services and startup eco

CSO Online
MEDIUMMalware

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

A newly analyzed Linux rootkit is believed to have given attackers a way to hide shells inside recently compromised F5 BIG-IP Access Policy Management (APM) environments, without leaving the malicious PHP code on disk. Sophos said the malware, found in compromised BIG-IP APM environments using Apache and PHP components, uses custom ELF loading, function hooking, and runtime code patching to establ

CVE-2025-53521
CSO Online