Verified X accounts are distributing malware through AI-generated personas and fake optimization tutorials.vx-underground reports seeing roughly a dozen accounts using locked-comment posts that direct users to obfuscated PowerShell. The observed chain encoded its download host as a decimal IPv4 address before delivering multiple stages and a Node.js payload.
· Threat Activity & Operations
· also via messaging app
September 25, 2026
Scattered Spider member Ahmed Hossam Eldin Elbadawy sentenced to 45 months after guilty pleas to wire fraud conspiracy and aggravated identity theft, over phishing texts impersonating employers and IT providers from September 2021 to April 2023 used to reach cryptocurrency accounts. DarkWebInformer
· Industry & Policy
September 18, 2026
Revolut's breach is now reported as a five-month run of fraudulent information requests sent from an email address on a legitimate government agency domain, impersonating an Italian agency, with roughly 680 high-profile accounts affected and a $3M ransom demand (SecurityWeek). Affected customers began receiving phishing SMS on 14 September, two days after disclosure, landing in the same thread as genuine Revolut messages; one link requested camera access and imitated Revolut's "turn your head" liveness check before asking for a password (Malwarebytes) (earlier coverage).
· Supply Chain & Breaches
· also via phishing email
August 25, 2026
Citizen Lab documents two covert global telecom surveillance campaigns abusing inter-operator signalling: combined 3G SS7 and 4G Diameter techniques, plus crafted SMS carrying hidden SIM commands to extract subscriber location. Rare real-world visibility into commercial surveillance vendors operating on trusted carrier infrastructure (Citizen Lab) (discussion). One commenter pushes back on the framing, noting SS7 and MAP have "basically zero security measures whatsoever" — abuse, not exploitation.
· Surveillance & Privacy
August 20, 2026
Slovakia's NBU found an undocumented module in NERO R-ONE traffic cameras tied to 12 Russian phone numbers, assessed as a backdoor capable of executing code delivered via SMS from that number list (Cybernews).
· Breaches & Regional
July 16, 2026
Iran abused long-known SS7 telecom vulnerabilities to geolocate U.S. military and contractor personnel in the Middle East in the run-up to and early days of the conflict, according to FT reporting on Mobile Surveillance Monitor research. Finland's NCSC flagged the report. NCSC-FI/TechCrunch, SC World
· Threat Activity