Glitch SPY RAT Distributed Via Fake Polish Rental App cyble.com/blog/glitch-spy-ra…

acrobatreaderonline.com is not Adobe Acrobat Reader Online. Open-source review on 23 August 2026 shows a live malware-as-a-service panel behind an Adobe-themed domain. The page title is SecureWorkspace WebPanel; /api/ renders as Kaido Panel. The stack is Vite/React, Tailwind 4.3.3, SignalR and JWT Bearer. There is no PDF viewer and no Document Cloud. The same origin is not a static brochure. Unauthenticated GET requests return HTTP 401 with WWW-Authenticate: Bearer on /hub and /api/loot/. A command-and-control API and SignalR hub are therefore live behind Cloudflare. The landing was last modified on 22 August 2026, 17:17 UTC. Public JavaScript on the homepage (~1 MB) includes panel routes (/api/auth/refresh, builder, file manager, loot), a kaido_token session artifact, and a module catalog covering stealers, banking overlays, PIX and boleto lures. Registrar: Tucows / Hover. Created 17 June 2026, expires 17 June 2027. Nameservers: aarav.ns.cloudflare.com and may.ns.cloudflare.com — the same pair as kaido.sh. Anycast: 104.21.2.104 / 172.67.129.21. No MX, SPF, DMARC or DKIM; the domain does not send mail and appears in campaigns as a URL. Certificate Transparency records a wildcard on kaido.sh from 2 June 2026 and on acrobatreaderonline.com from 17 June 2026 (GTS WE1). The live certificate is GTS WE1, 16 August–14 November 2026, SAN apex plus *. Only www resolves today. api, panel, c2, loot, builder, hub, free and bt are NXDOMAIN. Any new A/AAAA on a subdomain should be treated as C2 rotation. Historical public sandboxes (March–April 2026) documented a WebDAV loader on free.kaido.sh (now NXDOMAIN): UNC on port 80, a .bat dropper, TfsStore\Tfs_DAV cache, and 185.208.158.27 (AS42624). The PDF/boleto theme remains; current C2 is HTTPS on this FQDN. Blocklist: acrobatreaderonline.com · acrobatreaderonline.com · kaido.sh · kaido.sh · *.kaido.sh · x4m1k.com Actions: block the cluster in DNS, proxy and mail; hunt queries to these FQDNs, unexpected WebClient activity, Tfs_DAV, and kaido_token; official Reader is only on adobe.com; report abuse to Tucows, Cloudflare, CERT.br and Adobe brand protection. Do not authenticate to the panel. Do not run artifacts. Passive collection only. TLP:AMBER. #CyberSecurity #InfoSec #Malware #Cybercrime #Phishing #OnlineSafety #DataProtection #TechNews #Security #DigitalSecurity #ThreatIntel #OSINT #SOC #Brazil #PIX #RAT #C2

Threat Intelligence Alert | Active Android FUD Service on Telegram During recent analysis of malware distribution infrastructure, we identified the Telegram bot @sxfudbot (sxFUD) operating as a Fully Undetectable (FUD) service for Android APKs. Key characteristics observed on 20 August 2026: • Claim of 0/67 detections on VirusTotal (as of 16/08/2026) • Direct delivery of dropper APK (“Normal FUD”) • “Server FUD” option offering 30-day hosting, unlimited installs, and alleged zero detection (paid plan only) • Credit-based system with paid tiers This is a classic obfuscation and payload distribution service, commonly used to deliver Android bankers, stealers, RATs, and other mobile malware. The low public footprint of the operator (@sxploito / @sxploitobot) and complete lack of legitimate documentation reinforce its underground profile. Recommendations: • Monitor the username and associated APKs/hashes • Implement preventive blocking in corporate and mobile environments • Correlate with Telegram-based phishing and social engineering campaigns Shared for the awareness of the CTI and defensive security community. Detailed technical analysis available upon authorized request. #ThreatIntel #CyberSecurity #Malware #AndroidMalware #CTI #InfoSec #MobileSecurity #VirusTotal #FUD

BTMOB Exposed: Inside a Fraud-as-a-Service Platform with 1400+ live servers blog.quimerax.com/btmob-expo…