Abnormal AI has released a comprehensive report detailing the ZeroTokens platform, a sophisticated live-operator phishing infrastructure that has evolved significantly since its initial disclosure in August 2026. The expanded investigation reveals the scope of operations, resilience, and technical sophistication, showing how threat actors have systematically targeted financial institutions globally. Since Abnormal's initial disclosure (below), the scope of the ZeroTokens campaign has expanded
credentialtheft (4)
The zLabs team recently identified an updated variant of ToxicPanda, the Android banking Trojan known to have primarily targeted Europe, that introduces significant enhancements, including a comprehensive command set of 167 remote commands and substantially expands its targets globally. Among the newly added capabilities is a PIN theft mechanism targeting more than 140 banking and cryptocurrency applications. By abusing the Android Accessibility Service, threat actors can steal every UI element
On 28 April 2026, SentinelLABS located a script through a Kubernetes-focused VirusTotal hunting rule that stood out from known cloud hack tools: the script’s first actions are to evict and delete tools associated with the TeamPCP attack group, leading us to call the toolset PCPJack. Analyzing this script led researchers to discover a comprehensive framework for cloud credential harvesting and propagation to internal and external systems.
TeamPCP stood out in early 2026 following the group’s Feb
Many malware attacks against open-source software components have compromised thousands of software packages and repositories, but the practical damage these attacks have caused organizations is harder to quantify. The longer-term and indirect costs of these attacks may prove most significant for organizations. Open-source components and software have long been a well-established source of threat activity. The widespread use, combined with the broad variance in how well-supported different pro
