A curated dispatch from GajShield

The GajShield Gazette

Lead story

BTMOB Android malware service generates custom phishing payloads

The BTMOB Android malware service shows how mobile malware is becoming easier for criminals to deploy at scale. According to the report, BTMOB is being sold as a malware-as-a-service platform with a builder that lets attackers generate customized phishing payloads without need…

Also today
In brief

Charter Communications data breach affects 4.9 million accounts

The Charter Communications breach update shows why early breach claims and final exposure counts need careful handling. Have I Been Pwned n…

May 29, 2026

Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit

The Marimo CVE-2026-39987 incident is a major warning sign for defenders: attackers are now using LLM agents not just for research or phish…

May 29, 2026

Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets

The malicious Sicoob.Sdk NuGet package is another reminder that software supply-chain attacks are now targeting business integrations, not …

May 29, 2026

Google Chrome adds session cookie theft protection for all users

Google Chrome’s rollout of Device Bound Session Credentials is an important step against one of the most damaging modern attack techniques:…

May 29, 2026

Carnival Cruise confirms data breach affecting nearly 6 million people

Carnival Cruise confirming a data breach affecting nearly 6 million people is another reminder that large customer-facing businesses remain…

May 28, 2026

JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS Malware

The JINX-0164 campaign is another reminder that cryptocurrency firms are being targeted through people and developer workflows, not just th…

May 28, 2026

Malicious npm Package Stole Files From Claude AI User Directory via GitHub

The malicious npm package mouse5212-super-formatter is another reminder that developer environments and AI workspaces are now active target…

May 28, 2026

MediaArea heap-based buffer overflow vulnerabilities

Cisco Talos’ disclosure of four heap-based buffer overflow vulnerabilities in MediaArea’s MediaInfoLib is a reminder that file-parsing libr…

May 28, 2026

Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

The Grandoreiro and BTMOB campaigns show how financial malware is expanding across both desktop and mobile environments. Grandoreiro contin…

May 28, 2026

GPU mining malware spreads via SEO poisoning, AI chatbots

The GPU mining malware campaign reported by Microsoft is a clear reminder that attackers are now manipulating both search engines and AI ch…

May 28, 2026

FBI warns of in-person data theft attacks from extortion gang

The FBI’s warning about Silent Ransom Group shows how data-theft extortion is moving beyond traditional malware and ransomware playbooks. T…

May 27, 2026