6+ hour, 9+ min ago   (367+ words) Rescana Technical Analysis of Malware/TTPs The attack chain began with the automated mass-download of 1.8 million Android APKs from multiple app stores using a distributed pipeline orchestrated on ten AWS EC2 instances. The APKs were decompiled and scanned for hardcoded secrets…...

1+ week, 3+ hour ago   (237+ words) No public attribution to a specific APT group has been made, but the sophistication and targeting patterns suggest a well-organized criminal operation with a focus on financial gain. The malware’s modular architecture and rapid evolution indicate ongoing development and adaptation…...

1+ week, 1+ day ago   (422+ words) No exploitation in the wild or public proof-of-concept (PoC) has been confirmed as of September 4, 2026. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no CISA-confirmed active exploitation. However, the exposure is automatable…...

1+ week, 1+ day ago   (555+ words) rescana.com FalconFlank Zero-Day Exposes Critical Privilege Escalation Vulnerability in CrowdStrike Falcon Sensor for Windows 11 and Windows Server 2026 A critical zero-day vulnerability, designated FalconFlank, has been publicly disclosed in the CrowdStrike Falcon Sensor for Windows. This flaw enables local attackers…...

1+ week, 23+ hour ago   (772+ words) rescana.com Large-Scale Phishing Campaign Uses Invisible Unicode and ActiveCampaign to Evade Email Security Filters A newly identified, large-scale phishing campaign is actively exploiting invisible Unicode characters to bypass traditional email security filters, sending millions of malicious emails globally. This…...

1+ week, 1+ day ago   (517+ words) Rescana Active Exploitation Alert: North Korean APTs Deploy Ted Backdoor in Compromised HAProxy Builds to Hijack Web Traffic Technical Analysis of Malware/TTPs The Ted backdoor is not a vulnerability in the official HAProxy codebase, but rather a malicious plugin…...

2+ week, 4+ day ago   (209+ words) Both vulnerabilities are remotely exploitable via HTTP(S) requests to the vulnerable endpoint and require no authentication or user interaction. The attack surface is significant, with over 600 internet-exposed instances identified through search engine reconnaissance, including those hosted on Kaltura’s own infrastructure....

3+ week, 3+ day ago   (255+ words) Persistence is achieved by exploiting Accessibility Services to automate the disabling of battery optimization and auto-start restrictions, ensuring the malware remains active even after device reboots or system updates. Device Admin privileges are leveraged to prevent uninstallation and enable remote…...

3+ week, 3+ day ago   (698+ words) Rescana Active Exploitation of MLflow SSRF Vulnerability (CVE-2026-64849) Enables Cloud Credential Theft and Account Compromise A critical vulnerability has been identified and is being actively exploited in MLflow, a widely used open-source platform for managing the machine learning lifecycle. The…...

3+ week, 6+ day ago   (392+ words) The exposure of service accounts and privileged users provides attackers with a roadmap for subsequent social engineering, spear-phishing, and privilege escalation attacks. The structured nature of the data enables highly targeted Business Email Compromise (BEC) and impersonation campaigns, as attackers…...