[gigabud]

September 13, 2026

• Gigabud now installs a second app that creates an Android work profile and drops a tampered banking app inside it, using the profile boundary to keep the real app's security checks from seeing the modified copy (The Hacker News). · Threat Intelligence & Incidents

in Artifactory Chains Give Attackers Admin in Under Five Minutes

September 11, 2026

• Mantax Otax is an Indonesian-linked Android strain that fuses spyware and ransomware: real-time screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, file exfil and covert photos, followed by encryption on older Android versions and an on-screen chat portal for live extortion. Sideloaded as an APK from a file-sharing host, it resolves its live C2 domain from a GitHub repo and brokers traffic through Firebase (Zimperium, BleepingComputer). Separately, GoldFactory is abusing Android Work Profile to deliver Gigabud in the same country (Dark Reading). · Threat Intelligence

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign