Javier Conejo del Cerro

Mobile banking malware continues to evolve, but RedWing represents a significant shift in accessibility rather than technical sophistication. Instead of requiring operators to build or customize malware themselves, RedWing is offered as a subscription-based Malware-as-a-Service (MaaS) platform through Telegram, providing criminals with ready-to-use Android banking malware, documentation, video tutorials, and automated malware builders. The result is a scalable criminal ecosystem where...

Citizen Lab has revealed that former Member of the European Parliament Stelios Kouloglou was repeatedly infected with the Pegasus spyware while serving on the PEGA Committee, the parliamentary body created to investigate the misuse of commercial surveillance technologies across the European Union. The findings highlight the growing concern that highly sophisticated spyware is being deployed not only against journalists and activists, but also against lawmakers responsible for overseeing and...

Researchers at Kaspersky have uncovered Umbrij, a new malware attributed to the ToddyCat advanced persistent threat (APT). Instead of stealing passwords or bypassing authentication directly, Umbrij abuses Google’s OAuth authorization process to obtain legitimate access tokens, allowing attackers to access corporate Gmail accounts through official Google APIs. The technique, dubbed Shadow Token via Remote Debug (STRD), demonstrates how trusted authentication mechanisms can be weaponized once...