Fake bank websites play dead to evade security scanners
Researchers have documented a phishing technique called Chameleon SEO Poisoning that uses manipulated search rankings and cloaked, typosquatted banking domains to steal credentials while dodging automated security sweeps. The trick lies in “presentation control”: a visitor who types the domain in directly gets served a dead, offline-looking page, while the same domain flips to a convincing fake bank login screen for anyone who clicked through from a poisoned search result. Cases jumped 40% in the second quarter of 2026, and the guidance for defenders is to treat referrer spoofing and browser emulation as standard practice when validating a reported URL, since a direct visit alone no longer reveals anything.
Iran-Linked Hackers Force UK Power Plant Offline in Unprecedented Four-Day Cyberattack
A cyberattack tied to Iran-linked actors knocked a small British power generator offline for four straight days last month, in what officials call the first successful attack of its kind against UK energy infrastructure. The government has stressed the facility was minor enough that it posed no risk to the wider national grid, but the incident is being read as a deliberate show of capability by groups affiliated with Iran’s Islamic Revolutionary Guard Corps, timed close to a parallel wave of attacks against US water utilities across a dozen states. GCHQ’s National Cyber Security Centre has since briefed energy executives and is updating sector cybersecurity guidance, while its chief has warned that “nationally significant” cyberattacks are now hitting at least four times a week.
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
A newly discovered malware family is infecting Android-based vehicle head units by hijacking their legitimate built-in firmware update mechanism, marking the first documented infection chain built specifically for car infotainment systems. The dropper, called JarService, installs quietly with no user interface and pulls down a reverse proxy module that turns the vehicle’s internet connection into a node in a residential proxy botnet, alongside support for ad fraud and arbitrary code execution. The campaign has been attributed with high confidence to the MoYu Group, the actor behind the broader BADBOX ad fraud and proxy scheme that Google sued over in 2025, underscoring how aftermarket and factory-installed car electronics are becoming a fresh target for botnet operators.
Critical Zimbra RCE flaw now actively exploited in attacks
Poland’s national CERT has warned that attackers are actively exploiting a critical command injection flaw in Zimbra Collaboration Suite that allows unauthenticated remote code execution when the optional SNMP monitoring component is enabled. A patch has been available since July, but more than 12,000 Zimbra servers remain exposed online, concentrated in Europe and Asia, and it’s unclear how many have actually been updated. Administrators are being urged to check logs for signs of compromise, such as unexpected service restarts or new files appearing under the Zimbra web application directories, given the platform’s long history as a target for state-linked espionage groups.
Rust Supply Chain Attack Linked to North Korean Hackers
A poisoned release of arrayref, a Rust crate with over 245 million downloads used in roughly three-quarters of Rust environments, briefly introduced a malicious dependency designed to fetch a second-stage payload from a remote server after disabling certificate validation. Two related crates from the same maintainer account were also compromised in the same window, and the Rust Security Response Team pulled all the tainted packages within about 86 minutes, finding no evidence they were actually used before removal. Infrastructure overlaps point to the North Korean threat actor Sapphire Sleet, previously linked to similar npm supply chain attacks against the Axios and Mastra packages earlier this year.
