VENON: First Rust-Based Banking Malware Strikes Brazil, Apple Patches Coruna WebKit Exploit, Russian Hackers Target Signal & WhatsApp

VENON banking trojan — the first Rust-based malware targeting Latin American banks — hits 33 Brazilian financial institutions. Apple releases emergency patches for the Coruna WebKit exploit on legacy iOS. Russian hackers target Signal and WhatsApp accounts of government officials and journalists worldwide. Wiz warns of large-scale OAuth consent abuse. Plus: Cisco IOS XR patches, n8n server takeover, Polyfill supply chain attack linked to North Korea, and Meta disrupts 150K scam accounts.

🦀 VENON: First Rust-Based Banking Trojan Targets 33 Brazilian Banks

The Latin American banking malware landscape has been dominated by Delphi-based trojans for over a decade — families like Grandoreiro, Casbaneiro, and Mekotio. VENON represents a fundamental paradigm shift: a banking trojan written entirely in Rust, demonstrating that threat actors are modernizing their toolkits with memory-safe, high-performance languages.

Discovered by researchers at ZenoX, VENON employs a sophisticated multi-stage attack chain:

• Initial access: Phishing emails with malicious attachments or links
• Persistence: LNK file hijacking to ensure the malware survives reboots
• Execution: DLL side-loading using legitimate applications to bypass security controls
• Payload: Banking overlay windows that mimic legitimate banking interfaces to steal credentials

Why Rust Matters for Malware

The shift to Rust is strategically significant for several reasons:

• Detection evasion: Most AV/EDR signatures are tuned for Delphi and C++ malware — Rust binaries have different characteristics that evade pattern-based detection
• Memory safety: Rust's ownership model means fewer crashes and more reliable malware execution
• Cross-platform potential: Rust compiles to multiple targets, suggesting VENON could be adapted for macOS or Linux in the future
• AI-assisted development: Evidence suggests the Rust rewrite was assisted by AI coding tools, lowering the barrier for threat actors to adopt new languages

The leak of the developer username "byst4" provides a potential attribution lead, but also suggests operational security failures within the malware development team.

🍎 Apple Patches Coruna WebKit Exploit for Legacy iOS Devices

Apple has released emergency security updates for legacy iOS devices — those still running iOS 15 and iOS 16 because they cannot support newer versions. The patches address WebKit vulnerabilities that were actively exploited through what researchers call the Coruna exploit chain.

This is particularly significant because it affects devices that many organizations assume are "too old to matter" — but in practice, millions of iPhones and iPads in enterprise environments, especially in education, healthcare, and government sectors, still run iOS 15 or 16.

Affected Devices

• iOS 15.8.7: iPhone 6s, iPhone 7, iPhone SE (1st gen), iPod touch (7th gen), and older iPads
• iOS 16.7.15: iPhone 8, iPhone X, and certain iPad models not eligible for iOS 17

Why Legacy Device Patching Matters

WebKit vulnerabilities are particularly dangerous because exploitation requires nothing more than visiting a malicious webpage. No app installation, no user interaction beyond clicking a link. The Coruna exploit leverages this to achieve remote code execution on unpatched devices.

🕵️ Russian Hackers Target Signal & WhatsApp Accounts Globally

Dutch intelligence agencies have revealed a coordinated campaign by Russian state-linked actors to compromise secure messaging accounts. The attackers are using two primary techniques:

Attack Method 1: Fake Signal Support Chatbot

Attackers create a fake Signal Support chatbot that contacts targets claiming to verify their account or assist with a "security issue." The chatbot requests the victim's verification code or PIN, which is then used to register the victim's Signal account on the attacker's device. Once registered, the attacker has full access to all incoming messages.

Attack Method 2: Linked Devices Abuse

Signal's "linked devices" feature — designed to let users access Signal on multiple devices — is being exploited. Attackers trick victims into scanning a QR code that links the attacker's device to the victim's Signal account. This gives the attacker real-time access to all messages without the victim losing access, making detection much harder.

Germany's BSI issued a similar warning last month, confirming this is a Europe-wide campaign with global reach. The targets include diplomats, defense officials, journalists, and NGO workers — anyone whose communications would be of interest to Russian intelligence.

🔑 OAuth Consent Abuse Campaign — Wiz Warns of Large-Scale Token Theft

Wiz researchers have uncovered an active and large-scale OAuth consent abuse campaign that exploits a fundamental weakness in cloud identity: users have been trained to click "Accept" on consent prompts without reading them.

The attack works as follows:

1. Victim receives a legitimate-looking email or message referencing a shared document or required application
2. Clicking the link presents an OAuth consent screen for an app impersonating Adobe Acrobat, DocuSign, or Microsoft OneDrive
3. The consent screen requests permissions including email access, file read, and profile information
4. Once the user clicks "Accept," the OAuth access token is sent to the attacker's redirect URL
5. The attacker now has persistent API access to the victim's cloud account — no password, no MFA bypass needed

This attack is particularly dangerous because it bypasses MFA entirely. The victim authenticates with their own credentials and MFA, then grants the malicious app an access token. The attacker never needs the password.

NIS2 & DORA Implications

• Identity governance: NIS2 Article 21 requires access control measures — OAuth token management is a gap in many organizations
• DORA Article 9: Financial entities must protect against unauthorized access through API tokens and OAuth grants
• Audit OAuth grants: Most organizations have no visibility into which third-party apps have been granted access to their Microsoft 365 or Google Workspace environments

🌐 Cisco Patches High-Severity IOS XR Vulnerabilities

Cisco has published security advisories addressing multiple high-severity vulnerabilities in IOS XR, the operating system powering Cisco's carrier-grade and enterprise routing platforms. These vulnerabilities affect devices at the core of network infrastructure — routers and switches that handle critical traffic flows.

The vulnerabilities could allow attackers to:

• Crash routing processes: Causing denial of service and network outages
• Execute arbitrary commands: Gaining control of the routing platform
• Take over devices entirely: Establishing persistent access to core network infrastructure

Impact on Critical Infrastructure

IOS XR powers Cisco ASR, NCS, and CRS series routers — devices deployed by ISPs, telecoms, data centers, and large enterprises. A successful exploit could disrupt backbone connectivity affecting thousands of downstream users and services.

🔧 Splunk & Zoom Patch Severe Vulnerabilities

Splunk — used by security operations centers worldwide for log management and SIEM — has patched vulnerabilities that allow authenticated attackers to execute arbitrary shell commands on the Splunk server. Given that Splunk instances typically have access to logs from across the entire infrastructure, a compromised Splunk server gives attackers visibility into the entire security posture.

Zoom has simultaneously released patches for privilege escalation vulnerabilities. With Zoom deployed across virtually every organization for video conferencing, these flaws represent a broad attack surface.

⚡ n8n Critical Vulnerabilities Allow Unauthenticated Server Takeover

The n8n open-source workflow automation platform — used for API integration, data pipelines, and business process automation — has critical vulnerabilities that allow unauthenticated attackers to completely compromise n8n servers.

This is particularly dangerous because n8n instances are typically configured with credentials for dozens of connected services — databases, cloud APIs, email servers, CRM systems, and more. A single compromised n8n instance can cascade into breaches across the entire connected infrastructure.

Attack Surface

• Arbitrary code execution: Attackers can run commands on the n8n server without any authentication
• Credential theft: All stored workflow credentials (API keys, database passwords, OAuth tokens) can be extracted
• Lateral movement: Stolen credentials enable immediate access to connected internal and cloud services

💉 Ally WordPress Plugin SQL Injection — 200K+ Sites Exposed

A critical SQL injection vulnerability has been discovered in a popular WordPress plugin installed on over 200,000 websites. The flaw allows attackers to inject malicious SQL queries to extract sensitive database information — including admin credentials, user personal data, and configuration secrets.

WordPress plugins remain one of the most exploited attack vectors on the web. Many organizations treat their WordPress sites as "just a website" without applying the same security rigor as their core infrastructure — a dangerous oversight given that these sites often process customer data, lead generation forms, and payment information.

🇰🇵 Polyfill Supply Chain Attack Now Linked to North Korea

The Polyfill.io incident was one of the most significant software supply chain attacks of 2024. The Polyfill.io CDN — used by over 100,000 websites to provide JavaScript polyfills for browser compatibility — was taken over by malicious actors who injected malicious code into the JavaScript served to visitors.

The attack was initially attributed to Chinese entities after the Polyfill.io domain was acquired by a Chinese company. However, new intelligence from an infostealer infection on a device connected to the operation has revealed North Korean involvement — suggesting the campaign may have been a collaboration or that North Korean actors were behind the Chinese front company.

Implications

• North Korean revenue generation: This aligns with North Korea's documented strategy of using cyber operations to generate revenue, including through compromised web infrastructure
• Attribution complexity: The use of Chinese intermediaries demonstrates the difficulty of accurate cyber threat attribution
• CDN supply chain risk: Any JavaScript loaded from third-party CDNs represents a supply chain risk — organizations should self-host critical libraries

🚔 Meta Launches New Protection Tools, Disrupts 150K Scam Accounts

Meta has announced the disabling of over 150,000 accounts powering scam centers primarily operating out of Southeast Asia. These accounts were linked to pig-butchering scams, romance fraud, and investment fraud operations that have caused billions in losses worldwide.

Alongside the account disruptions, Meta is launching new protection tools designed to identify and warn users about potential scam interactions in real-time. The tools use AI to detect patterns consistent with scam operations, including unusual messaging patterns and financial solicitations.

Enterprise Relevance

• Employee risk: Staff targeted by scams on personal accounts may carry compromised devices into the workplace
• Brand impersonation: The same infrastructure used for romance scams is used for business impersonation and invoice fraud
• Awareness training: Include social media scam awareness in regular security training programs

🏥 Bell Ambulance Data Breach — 238,000 Individuals Impacted

Bell Ambulance, an emergency medical services provider, has confirmed a significant data breach that exposed sensitive personal information of 238,000 individuals. The compromised data includes:

• Social Security numbers
• Driver's license numbers
• Personal and demographic information
• Health information related to emergency medical services

This breach highlights the ongoing vulnerability of healthcare organizations to cyber attacks. Ambulance services and emergency medical providers often operate with legacy IT systems, limited cybersecurity budgets, and high-pressure operational environments that prioritize availability over security.

🏛️ Senate Confirms Joshua Rudd to Lead NSA and US Cyber Command

The U.S. Senate has confirmed Joshua Rudd as the new head of both the National Security Agency (NSA) and U.S. Cyber Command — the "dual-hat" role that combines signals intelligence with military cyber operations. Rudd takes command at a critical time as nation-state cyber threats escalate.

The confirmation comes amid heightened concerns about:

• Chinese cyber espionage: The Volt Typhoon and Salt Typhoon campaigns targeting US critical infrastructure
• Russian hybrid warfare: Ongoing targeting of NATO allies' communications (as detailed in today's Signal/WhatsApp story)
• North Korean cyber operations: Revenue-generating attacks including supply chain compromises (Polyfill.io) and cryptocurrency theft

For European organizations, the change in US cyber leadership is relevant because NSA and Cyber Command intelligence sharing with allied nations (through Five Eyes and NATO) directly impacts threat intelligence feeds and defensive capabilities available to European CERTs and security teams.