Npav Lab

A dangerous new version of the Android Remote Access Tool (RAT), called AndroRAT, is being used by hackers to steal unlock patterns, PINs, and passcodes from Android devices. Originally an open-source university project in 2012, AndroRAT has now evolved into a powerful malware that bypasses security defenses up to Android 15. This latest variant spreads through fake apps and phishing links, using advanced techniques to hijack device controls, steal biometric data, and break into locked smartphones.

Indian tech giant Tata Technologies, a key player in automotive and aerospace engineering, has allegedly fallen victim to a massive ransomware attack. The Hunters International ransomware group claims to have stolen 1.4 TB of sensitive data, potentially impacting major clients like Ford, McLaren, Honda, and Airbus.

A new phishing campaign is targeting Windows users with a deceptive technique called ClickFix, tricking victims into executing malicious PowerShell commands. The attack, active since March 2025, deploys a modified version of the Havoc command-and-control (C2) framework through SharePoint abuse, allowing attackers to take full control of compromised systems.

Angel One, a leading financial services platform, has confirmed a data breach impacting 8 million users after hackers gained unauthorized access to its Amazon Web Services (AWS) resources. The breach was discovered when dark web monitoring alerts signaled potential data leakage. While the company acted quickly to secure its systems, concerns remain about how the breach occurred and its long-term implications.

A dangerous phishing campaign is targeting job seekers in the Web3 and cryptocurrency industry. Attackers are using fake job listings and fraudulent interview invites to trick victims into downloading a malicious video meeting app called GrassCall. Once installed, the malware steals login credentials, authentication data, and cryptocurrency wallets.

A new phishing attack is targeting Amazon Prime users, tricking them with fake renewal notifications to steal login credentials, personal details, and payment information. Discovered by the Cofense Phishing Defense Center on February 18, 2025, this attack uses advanced social engineering techniques and multiple layers of deception.

A new phishing campaign is targeting industrial organizations in the Asia-Pacific (APAC) region using a dangerous malware called FatalRAT. Hackers are using Chinese cloud services to deliver the malware, making it harder to detect. The attack mainly targets government agencies, manufacturing, IT, telecommunications, healthcare, energy, and logistics companies in countries like Taiwan, Malaysia, China, Japan, and more.

Cybercriminals are using stolen browser fingerprints to bypass security checks and impersonate users. The ScreamedJungle attack targets outdated Magento e-commerce platforms to inject malicious scripts that steal unique digital identifiers. This allows hackers to evade security systems, including multi-factor authentication (MFA) and device reputation checks.

A dangerous Android malware app, SpyLend, was downloaded 100,000+ times from Google Play, pretending to be a financial tool. Instead, it stole user data and was used for predatory loan scams in India. Users were harassed, blackmailed, and threatened if they failed to repay high-interest loans.

Cybercriminals are abusing PayPal’s address settings to send scam emails that look like official notifications. These emails claim a new shipping address has been added to your PayPal account and include a fake purchase confirmation for a MacBook M4. The goal is to trick users into calling a fake PayPal support number, where scammers try to gain remote access to their devices.