Dysphoria Botnet Hijacks 296,000 IoT Devices for DDoS Attacks

The Dysphoria botnet has taken over nearly 296,000 internet-connected devices, often called IoT devices, the Shadowserver Foundation reported this week. The botnet's main purpose appears to be launching distributed denial-of-service attacks, which flood a target with traffic until it goes offline. Shadowserver added that Dysphoria recently gained residential proxy functionality, meaning infected devices can relay traffic and make attacks harder to trace.

In a separate incident, security company ReliaQuest confirmed that one of its employees was caught in a failed extortion attempt on August 22, 2026. A person impersonated a member of the security team, registered a lookalike domain, and set up a fake single sign-on page behind a content delivery network. The attacker then called multiple ReliaQuest employees and persuaded one to enter a password and approve a multi-factor authentication push notification, which let the attacker into a brief, view-only session on an identity dashboard. ReliaQuest said no applications, systems, or customer data were accessed. The company did not attribute the attack but noted the playbook matches ShinyHunters and similar groups, including a disposable domain, a harvesting page behind a content delivery network, and rapid attempts to enroll a new authenticator.

Fake websites advertising productivity software are being used to deliver malware disguised as working Electron-based applications. Researchers observed programs such as Kitchen Canvas, Food or Meal Formula, and DocConvertWizard that can dynamically execute injected scripts and capture the desktop through Electron APIs. Cisco Talos also documented an operator-driven phishing framework called JWR that impersonates checkout and login pages across major payment and shopping platforms. Instead of just logging form submissions, JWR keeps an AES-CTR encrypted WebSocket open so an attacker can steer each victim's session live. It collects payment data, identity documents, Social Security numbers, passport and driver's license images, website and PayPal credentials, two-factor authentication codes, and full device fingerprints. Talos assessed JWR as a variant of The Outsider phishing-as-a-service platform.

iVerify disclosed Octagon, an Android on-device fraud bot sold as malware-as-a-service by the Russian-speaking actor AndroidKitKat for $1,400 a month. It offers accessibility overlays, hidden remote desktop, SMS and one-time password interception, unlock pattern capture, and on-screen balance reading, and it targets crypto wallets and banking apps. Zscaler ThreatLabz said it discovered a Rust-based backdoor called C2Looper in July 2026, likely used by a ransomware-related threat actor and delivered through a multi-stage ClickFix infection chain. C2Looper supports remote shell execution, reconnaissance, and deploying extra malware, and a variant uses GitHub for command-and-control communications.

LevelBlue described a previously undocumented remote access trojan called CNCMachineRMS delivered by BabaDeda Loader. The infection starts with a ClickFix lure that launches a legitimately signed IBM SPSS IDE executable, WinWrapIDE.exe, whose scripting engine is abused to load a malicious DLL. Four decoy DLLs load through normal Windows imports, then the final stage hides shellcode inside a benign date-formatting function. The trojan gives an operator remote administration, including an interactive shell, a file manager, screen capture, a local account backdoor, seven persistence mechanisms, and twenty commands for downloading more payloads. Zscaler also found Abyssos, a modular C++ remote access trojan first detected in June 2026 that uses a custom TCP protocol and supports credential theft, file exfiltration, and remote access through VNC.

Palo Alto Networks Unit 42 reported that a C++ botnet loader called Aeternum has moved its command infrastructure entirely to the Polygon blockchain. Infected devices read encrypted and plaintext instructions from smart contracts by querying public remote procedure call endpoints, which makes takedowns much harder. Joe Security examined ToxNetV2, an AArch64 Linux peer-to-peer botnet that has integrated a large language model into its controller. The controller uses NVIDIA NIM with the z-ai/glm-5.2 model to turn host telemetry into possible actions, but a human operator remains the final approval point for high-impact steps. ToxNetV2 also includes encrypted peer-to-peer control, scanning workers, self-propagation, and 17 network attack launchers.

Multiple information stealers surfaced this week. Splunk reported Phantom Stealer, which harvests browser credentials, saved passwords, session cookies, cryptocurrency wallet files, and system fingerprints and has been spread through phishing lures, cracked software, and links on Discord and Telegram. A second Go-based stealer called Salat Stealer performs system reconnaissance, credential theft, and desktop streaming with audio and video capture. Point Wild discovered Vanta Stealer, a Python-based tool that targets Chromium browsers, Discord, Telegram, Steam, gaming platforms, VPNs, cryptocurrency wallets, and locally stored sensitive documents. It collects passwords, cookies, payment information, authentication tokens, gaming data, wallet files, screenshots, webcam captures, and documents containing recovery phrases, but exactly how it is delivered is not yet known. Malicious shortcut files disguised as PDF documents launch a multi-stage chain through cmd.exe, legitimate Windows utilities, AutoIt, and PowerShell to install DARTHVADER Stealer, while DestinyStealer has targeted Europe and the US and shares code lineage with StormKitty Stealer. Joe Security also detailed ScarfaceStealer, delivered through Electron-based apps masquerading as AI tools; the malware checks 11 environment indicators and only runs if a weighted suspicion score stays below 7, otherwise it enters a decoy loop.

Malwarebytes warned about a scam campaign using 11 fake websites that claim to check whether antivirus tools are working. The sites carry Microsoft branding and names such as SysScan, show a convincing-looking fake security scan, tell victims their antivirus is causing problems, collect their information, and prepare them for a supposed refund call, which leads to uninstalling real antivirus software. Malwarebytes also observed ClickFix lures and fake software downloads delivering PavinLoader, which appears to be offered as a loader-as-a-service and uses legitimate Windows tools alongside malicious .NET files, including a blockchain-based technique called EtherHiding to hide instructions.

AmberWolf disclosed a zero-day boot-chain weakness in HP ThinPro 8 and 9 that lets an attacker with physical access bypass TPM-based full-disk encryption and recover LUKS keys. The flaw comes from an incomplete measured-boot policy that omits the Linux kernel and initramfs. AmberWolf recommended enabling Secure Boot and setting a BIOS password,