In today’s cybersecurity news…

New Android malware types like a human

Researchers at Dutch cybersecurity firm ThreatFabric identified an Android banking malware called Herodotus, which evades detection by mimicking human typing during remote control of infected devices. It’s said to be developed by an attacker known as K1R0, and can steal credentials and intercept one-time passcodes from banking and crypto apps.In Italy, Herodotus disguised itself as an app called Banca Sicura (“Safe Bank”), while in Brazil it posed as Modulo Seguranca Stone, likely pretending to be a security module for a local payment provider. The human-like nature makes automated detection that much harder. (The Record)

Sanctions weaken nation-state cyber ecosystems

A new report from the Royal United Services Institute (RUSI) finds cyber-related sanctions alone rarely stop attacks, but can “toxify” threat networks by making operations more expensive, and complicating collaboration. RUSI says sanctions are most effective when paired with diplomatic, law enforcement, and intelligence actions. Recommendations include clarifying goals, targeting enablers, integrating sanctions cross-domain, and improving transparency on impact. (Infosecurity Magazine)

Side-channel attack extracts Intel, AMD secrets

Researchers from Georgia Tech, Purdue, and Synkhronix have developed TEE.Fail, a side-channel attack that extracts secrets from DDR5-based trusted execution environments (TEEs) on Intel and AMD processors, including SGX, TDX, and SEV-SNP with Ciphertext Hiding. Using less than $1,000 of off-the-shelf equipment, the attack can capture cryptographic keys and compromise confidential virtual machines. The researchers recommend software countermeasures. AMD and Intel both say they consider physical attacks like this out of scope for mitigation. (The Hacker News)

F5 claims limited impact from attack

Multicloud security and application delivery company F5 says a recent nation-state breach had limited customer impact. Attackers accessed source code, configuration data, and 44 undisclosed vulnerabilities, but most affected customers report the stolen data isn’t sensitive. F5 says it’s continuing code scans with third-party experts, expanding its bug-bounty program, and adding endpoint detection via CrowdStrike. The company does say it expects short-term revenue disruption in the first half of fiscal 2026. (CyberScoop)

Huge thanks to our sponsor, Conveyor

Oracle EBS attack victims may be more than expected

More companies may have been hit by the Oracle E-Business Suite zero-day vulnerability, including Schneider Electric, Cox Enterprises, and Pan American Silver. The Clop ransomware group has exploited the flaw to steal and leak data, and some victims like Harvard University have already confirmed breaches. The vulnerability lets unauthenticated attackers remotely execute code over HTTP, prompting the FBI to warn that unpatched EBS systems are at immediate risk of full compromise. Oracle has released patches and urged customers to update immediately. (Dark Reading)

FCC adopts new rule targeting robocalls

The FCC has adopted a new rule to combat robocalls, especially from overseas, by expanding what counts as “caller identity information” and requiring providers to verify and display accurate caller names. The rule mandates alerts for calls from foreign sources and blocks U.S. area codes on foreign-origin calls. Providers also need to offer things like brand logos or call purpose, to help consumers make informed decisions. (The Record)

Attackers sell turnkey RAT

A new remote access Trojan called “Atroposia” is being sold as a plug-and-play malware kit, giving lower-skill attackers access to enterprise systems. It features hidden remote desktop sessions, credential and cryptocurrency theft, DNS hijacking, vulnerability scanning, and persistent backdoors. Sold anywhere between $200–$900 depending on subscription, Atroposia lets attackers exfiltrate data filelessly and manipulate systems undetected. Defenders are advised to focus on anti-phishing measures, system patching, multifactor authentication, and monitoring user activity and network signals to detect post-compromise activity. (Dark Reading)

Palo Alto Networks’ AI agents fight cyberattacks

Palo Alto Networks launched Cortex AgentiX, a new suite of AI agents that automate cybersecurity actions like investigating threats and responding to email breaches. CEO Nikesh Arora told CNBC the tools are designed to meet rising demand for automation amid increasingly complex attacks, with most agents still needing human review. This comes after Palo Alto’s $25 billion acquisition of Israeli identity security firm CyberArk. (CNBC)

Truck connections expand cybersecurity need

At the American Trucking Association’s 2025 conference, fleet technology leaders warned that trucking’s growing reliance on digital platforms has amped cybersecurity risks. Roehl Transport and ISAAC Instruments executives said fleets need to simplify tech stacks, continuously audit vendors, and treat cybersecurity as shared accountability across partners. Fragmented systems and weak third-party security are still major vulnerabilities, while consolidating integrations and maintaining active vendor oversight were cited as the most effective defenses. (Fleet Equipment)