FlagThis — Daily Cybersecurity Intelligence Briefing

Android attackers are utilizing a dual-payload chain, combining the SpyNote Remote Access Trojan (RAT) with the WindRelay module to perform real-time Near Field Communication (NFC) relay attacks. Initial access is achieved via vishing and the sideloading of malicious APKs. Following deployment, SpyNote provides remote administrative control to install WindRelay, which intercepts contactless payment credentials through Host Card Emulation (HCE) manipulation or NFC stack hooking. These credentials are relayed via Command and Control (C2) infrastructure to remote attackers, enabling unauthorized physical transactions at POS terminals and ATMs. This chain bypasses proximity requirements and facilitates multi-factor authentication (MFA) bypass through concurrent SMS interception and Accessibility Service abuse.

The Kimwolf (AISURU) botnet has transitioned to a highly resilient v7 architecture, specifically engineered to bypass law enforcement-led infrastructure takedowns. By shifting from centralized servers to a decentralized command-and-control (C2) model utilizing the Ethereum blockchain and Ethereum Name Service (ENS), the botnet achieves significant persistence against domain and IP seizures. Targeting the Android IoT ecosystem—primarily Android TV boxes—the malware leverages HTTP/2 protocol multiplexing and Chrome browser fingerprint mimicry to evade Web Application Firewalls (WAFs) and Layer 7 DDoS mitigation. This evolution enables massive volumetric attacks while maintaining high operational stealth within legitimate web traffic streams.

The "Flying Eagle" Android Remote Access Trojan (RAT) has evolved into a commoditized surveillance ecosystem, utilizing a massive infrastructure of over 170 identified command-and-control (C2) servers. The campaign primarily targets Android users in China via social engineering, distributing malicious payloads disguised as legitimate "Public Security service" applications. Technically, the malware facilitates remote command execution, extensive device surveillance, and the interception of sensitive financial data, including payment passwords. The recent leak of the framework's source code on criminal Telegram channels signals a transition from targeted operations to broad, large-scale availability for diverse threat actors.

Threat actors are exploiting the Meta advertising ecosystem to execute sophisticated malvertising campaigns targeting macOS and Android users globally. By masquerading as legitimate software through trusted Meta ad placements, attackers bypass traditional web-based security perimeters to deliver the MacSync Stealer RAT on macOS and specialized Android-based APKs. These payloads utilize wallet-searching scripts and credential harvesters to identify and exfiltrate cryptocurrency wallets, private keys, and sensitive credentials to attacker-controlled Command and Control (C2) infrastructure. This campaign represents a significant escalation in leveraging high-trust advertising platforms to facilitate large-scale financial theft through cross-platform exploitation.

CVE-2026-46242, dubbed "Bad Epoll," is a critical local privilege escalation (LPE) vulnerability residing in the Linux kernel's epoll subsystem within fs/eventpoll.c. The flaw allows an unprivileged local attacker to trigger a memory corruption primitive, granting full root-level access to the host system. This vulnerability impacts a vast ecosystem, including enterprise Linux servers, desktop distributions, and the Android mobile operating system. Remediation requires applying the official patches from the Linux kernel stable tree. This case notably highlights the limitations of AI-driven vulnerability research, as the 'Mythos' AI model failed to detect this specific flaw despite auditing the same code segment.

A critical integer overflow vulnerability in the Android Framework, identified as CVE-2025-48595, is being actively exploited in the wild to achieve unauthorized privilege escalation. Threat actors utilize this flaw to deploy "Landfall," a sophisticated commercial-grade spyware suite designed for clandestine surveillance and data exfiltration. By leveraging this zero-day alongside CVE-2025-48593, attackers can bypass security boundaries to gain system-level access and complete device control. This exploitation allows for the interception of sensitive personal and enterprise data, bypassing traditional network-level security controls. Google addressed these vulnerabilities in the June 2026 Android Security Bulletin.

Google has remediated CVE-2025-48595, a high-severity integer overflow vulnerability within the Android Framework currently leveraged in limited, targeted attacks. The flaw enables local privilege escalation (LPE) by allowing an attacker—who has already achieved initial code execution via a malicious application or browser exploit—to break the Android security sandbox and gain full system or root-level access. With a CVSS score of 8.4, the exploit requires no user interaction for the escalation phase. Due to its active exploitation, CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agency remediation by June 5, 2026.

Threat actors and commercial entities are leveraging Smart TV ecosystems—specifically Samsung Tizen, LG WebOS, and Android TV—to establish massive residential proxy networks. Attackers exploit OS-level vulnerabilities in Tizen (versions through 9.0) and WebOS, alongside exposed Android Debug Bridge (ADB) ports on Android TV devices, to deploy botnets like Kimwolf. Concurrently, "gray-market" commercial actors embed SDKs (e.g., Bright Data/Luminati) within free consumer applications to hijack outbound bandwidth. This dual-vector approach enables large-scale web scraping, unauthorized monetization of consumer IP reputation, and significant privacy erosion by transforming always-on residential devices into high-bandwidth proxy exit nodes.

A production misconfiguration in six Microsoft 365 Android applications—Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote—exposed billions of installations to unauthorized Microsoft account (MSA) token theft. The vulnerability stemmed from a debug flag, IsDebugMode(true), erroneously shipped in production binaries. This setting disabled critical isolation mechanisms designed to restrict OAuth 2.0 tokens to authorized Microsoft applications, allowing malicious third-party apps on the same device to intercept sensitive tokens via Android Inter-Process Communication (IPC) and Intents. Successful exploitation enables full Account Takeover (ATO), bypassing authentication boundaries to grant unauthorized access to sensitive cloud data, including Outlook emails and OneDrive documents.