"The malware abuses Android's Accessibility Service to inject phishing overlays over legitimate banking applications, stream the device screen in real time, log keystrokes, and provide the operator with full remote control over infected devices," Group-IB said.
RemControl banking trojan: AI-assisted overlays, Telegram dead-drops, and regional targeting
Security firm Group-IB described a previously undocumented Android banking trojan, RemControl, first observed in July 2026. Operators distribute the malware via fake Google Play Store pages impersonating the TVTap IPTV application; victims are routed to those pages through Meta ads. Group-IB says the malware uses Android's Accessibility Service to inject phishing overlays over legitimate banking apps, stream the device screen in real time, log keystrokes, and give an operator full remote control.
The campaign resolves its command-and-control (C2) dynamically through "an encrypted Telegram dead-drop," a configuration that supports infrastructure rotation without recompiling the malware. Group-IB also reported "artifacts of AI-assisted development," including an AI assistant response left verbatim in a live phishing page served to victims. Russian-language code comments in overlay HTML files point to involvement by a Russian speaker, and campaign similarities — naming conventions, delivery mechanisms, Telegram dead-drops, and affiliate tags — suggest a possible link to the Medusa UNKN affiliate botnet. Targeted regions include Western Europe (Italy, France, Spain, Poland, Portugal), the Middle East, and Canada.
AI search poisoning campaign: fraudulent answers inside ChatGPT, Gemini and Google AI Overviews
Vigilance Security researcher Ariel Simon warned that attackers are "flooding the web with carefully optimized posts, PDFs, reviews, and fake support pages" to poison AI search answers. The campaign has produced fraudulent phone numbers, email addresses, and login pages that appear inside ChatGPT, Gemini, and Google AI Overviews. Simon listed corporate targets including Delta, Lufthansa, Qatar Airways, Chase, Bank of America, Airbnb, and TripAdvisor.
Attackers upload the fake content across a broad set of channels: social media, file-upload sites, and hosting platforms such as Google Sites, GitHub Pages, WordPress, and Blogger, plus fundraisers, job and event platforms including Posh.vip, onecause.com, bebee.com, and raiselysite.com, and even user-review surfaces like Yelp and Apple Maps. The result, Vigilance Security says, is trusted-looking AI answers that can hide phishing traps and false contact details behind the veneer of an "Overview."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildZ.ai, Grok Build, and supply chain alarms: local repos sent to cloud, malicious dependencies added
Tooling and supply chain failures showed up in two distinct but related ways. Chinese AI vendor Z.ai disabled ZCode features after its default setting sent users' local code repositories to Alibaba Cloud servers in China without consent. The bulletin notes this followed an earlier incident in which SpaceXAI's Grok Build CLI uploaded entire Git repositories to a Google Cloud Storage bucket under its control. Z.ai has disabled the workflow that generated and uploaded local repository snapshots and opened its codebase for scrutiny.
Separately, supply chain monitoring firm SafeDep disclosed malicious activity inside developer ecosystems. On September 8, 2026, an unknown actor added a malicious source dependency to Deep-Live-Cam, a Python face-swapping application with 96,600 GitHub stars; the loader downloads a cryptocurrency clipboard hijacker for Windows and macOS and registers itself to run at login. SafeDep also found an npm typosquat (ulid-xyz impersonating ulidx) that triggers a cross-platform remote access trojan via a postinstall hook, installing a payload dubbed MicrosoftSystem64 that fingerprints hosts, accesses files, and runs arbitrary code. In response to cache-based supply chain attacks, GitHub announced a cache-mode to apply least-privilege access to the Actions cache at workflow or job level to help prevent cache poisoning.
Remedio's VS Code vector and Process Parameter Poisoning: developer tools and endpoints under siege
Security researcher Remedio disclosed a Visual Studio Code vulnerability that defeats Workspace Trust and enables remote code execution "with just one click." According to the write-up, the attack bypasses the editor's security decision, allowing an attacker to run code as the user with access to files, SSH keys, cloud tokens, and source code; the compromise persists each time the editor reopens.
At the endpoint level, researchers Max Hirschberger and Ogulcan Ugur described Process Parameter Poisoning, an EDR-evasion technique that embeds payloads inside standard process initialization structures to avoid API-hooking detection. Flashpoint released a Rust proof-of-concept demonstrating the technique; it combines process parameter spoofing with thread execution hijacking to inject code into foreign processes without the usual memory-allocation APIs, which "effectively blinds traditional, API-hooking EDR agents during the initial stages of code execution," Flashpoint said.
What this means for technologists, procurement teams, and end users
- Technologists and security teams: Expect deceptively small attack surfaces — a default setting, a hosted file, or a single click — to be the initial vector. Monitor supply-chain feeds and enforce least-privilege settings like GitHub's cache-mode and the principle of least privilege (PoLP) urged in the FBI/CISA fact sheet for critical infrastructure.
- Procurement and platform owners: Look for tooling defaults that exfiltrate data (ZCode, Grok Build) and demand transparency from vendors about repository handling; verify update servers and signing after incidents like the Admin Menu Editor Pro compromise, which involved a malicious update pushed on September 14, 2026 and a traced compromise beginning September 13 at 7:40 p.m. UTC.
- End users and operators: Treat AI-generated overviews and in-app prompts with skepticism. Fake sign-in windows and browser-in-the-browser attacks — such as the fake Claude Max giveaway described by Malwarebytes — can look authentic and collect credentials without card details or downloads.
The week’s briefings repeat the same lesson: the most effective attacks now often exploit trust, defaults, and expected behaviors rather than exotic zero-days. Defenders should prioritize eliminating easy mistakes — unsafe defaults, excessive privileges, and unverified update paths — because once those openings are closed, many of today's campaigns lose their simple paths to success.
