Kategorie

Binance is warning about a vulnerability in Apple's iOS 26.7.1, 27.0.1, and 27.2 that could allow third-party apps to read private files stored by other apps, including cryptocurrency seed phrases, secret keys, and login credentials. [...]

Recovering from ransomware doesn't guarantee an MSP will retain its clients, especially when delays, poor communication, and unexpected costs undermine trust. Kaseya examines how disconnected recovery tools create these problems and how integrated workflows can improve response times, transparency, and client retention. [...]

An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix. A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. [...]

At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in. After the alert The alert tells you something happened. However, gaining [email protected]

IT leaders need to quickly adapt IT strategies as AI and data centers will face more scrutiny following the US midterm elections, analysts said.

Concerns around AI and data centers helped Democrats sweep the US House and Senate. Tighter restrictions, more oversight and slower approvals could slow AI deployment and raise costs.

An exit poll conducted by SSRS and shared by NBC News showed that 56% of voters considered AI and data centers a major factor in their vote.

The voter concerns revolve around AI data centers consuming electricity, water, and other resources, with the costs being passed on to consumers and local municipalities, said Jack Gold, principal analyst at J. Gold Associates.

“There is not so much a backlash against the IT industry itself, but more against the thought that increased data centers will raise costs for normal consumers and do things to home values and land use,” Gold said.

Over the next two years, there will be more pressure to show who benefits, who pays, and who answers when something goes wrong, said Stephanie Walter, practice leader for the AI stack at HyperFRAME Research.

IT leaders should keep deploying AI where it improves the work, while building the evidence to defend those decisions, Walter said. “A new Congress will not fix poor data, unreliable answers, or an application nobody needs,” Walter said.

“Do not assume AI services will always get cheaper just because technology usually does,” said David Linthicum, founder of Linthicum Research, in a LinkedIn post titled “The Midterms Put the AI Industry on Notice.”

The election showed that AI isn’t just an enterprise issue anymore, but a kitchen table conversation. AI will face more resistance, scrutiny, and hearings, and “more demands to justify the resources it consumes,” Linthicum said.

Building out AI infrastructure could get more expensive, and the costs will show up somewhere. “They may show up in token pricing. They may show up in enterprise contracts. They may show up in limited availability. They may show up in stricter usage policies,” Linthicum said.

Enterprises will need to rethink how they build AI systems, Linthicum said. CIOs could adopt smaller models, use tokens more efficiently, and make more careful decisions about what runs in the public cloud, he said.

Many Democrats campaigned on fighting AI, but AI companies and their capital spending have been keeping the economy afloat, said Anshel Sag, principal analyst at Moor Insights & Strategy.

The industry waited too long to address public sentiment around data centers and AI, and could now be stuck with “spiteful legislation that makes it harder to remain a competitive economy,” Sag said.

“I think right now CIOs need to think about their compute needs for the future, whether they have planned well enough, and whether they can continue to scale with the existing data centers and power they have today,” Sag said.

There may be a shift in AI towards performance per watt, with total wattage making more of a difference, Sag said.

Gartner analysts, in multiple research notes, advised companies to “reassess AI business cases under increased compute-cost and reduced infrastructure-availability scenarios.”

US President Donald Trump, a Republican, has been hands-off with AI regulation. He has said he is willing to work with the Democrats in passing legislation but has also expressed his willingness to veto legislation.

“A Democratic majority in the US House and Senate and a Republican presidency will likely result in legislative gridlock as the president uses his veto power,” the Gartner analysts wrote.

Federal inaction could result in states taking action in areas such as AI governance, data center development, energy infrastructure, and environmental regulation, the analysts wrote.

AI vendors should “be prepared for increased requests for disclosure of testing, safety controls, privacy practices, data provenance, bias management methods, human oversight, and procurement justifications,” Gartner analysts wrote.

Non-US CIOs should not pursue a “wait-and-see” approach, the analysts noted. “Instead, they must proactively conduct scenario analysis as geopolitical friction becomes part of regular business operation,” the analysts wrote.

IT leaders outside the US should diversify their systems so they don’t depend on one country, one provider, or one AI model ecosystem. “For CIOs outside the US, Kubernetes and multivendor cloud environments will become increasingly important because they can support both local and global deployments,” the analysts wrote.

HyperFRAME’s Walter said IT leaders should also tighten governance over the AI they already run.

“Know which systems are in use, what they can access, what actions they can take, and who owns the result. Ask vendors for test results, incident information, and clear contractual responsibilities,” Walter said.

Some things won’t change regardless of who controls Congress, Walter said. “Enterprises still have to establish whether AI produces better work after accounting for review, corrections, and operating costs,” she said.

An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...]

The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft Exchange servers at government organizations. [...]

Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server. The flaws in the Web Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Anthropic has introduced Claude Fable 5.2 and Mythos 5.2, claiming significant improvements in handling complex software engineering tasks while cutting API prices by 20% compared with the previous versions.

Fable 5.2 and Mythos 5.2 share the same underlying model but have different safeguards. Fable is broadly available, while direct access to Mythos is restricted to vetted cybersecurity and life sciences organizations to limit potential misuse.

The models are both priced at $8 per million input tokens and $40 per million output tokens, down from $10 and $50, respectively. Anthropic said the newer versions can generate output up to 30% faster than their predecessors.

The company reported substantial gains in coding performance. Fable 5.2 scored 49.1% on the FrontierCode 2.0 benchmark at its Xhigh effort setting, compared with 32.4% for Fable 5.1. The benchmark assesses whether maintainers of open-source projects would accept AI-generated changes to their code.

Performance and costs could entice enterprises

The models’ improved performance and lower prices could make long-running AI agents viable for software migrations and scientific research, according to Lian Jye Su, chief analyst at Omdia. Higher task completion rates could further reduce deployment costs, he said.

Anthropic said Fable 5.2 at its “High effort” setting achieved a coding benchmark score comparable to Opus 5.5 at its highest setting, at roughly half the cost per task. The comparison suggests that Fable could be more economical for some demanding assignments, although the savings would depend on the workload and effort setting.

“Anthropic has cut the price of a token, not the price of a thought,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. He urged CIOs to treat AI processing effort as a budget consideration and measure costs against successfully completed tasks.

Anthropic also recommends Opus 5.5 for most coding and knowledge work, with Fable and Mythos intended for more demanding assignments.

Reliability challenges persist

In an internal experiment, an Anthropic engineer tasked Fable 5.2 with building a prototype operating system. The model coordinated more than 1,000 subagents over eight days and produced software that could boot on a laptop.

Su said the improvements bring enterprises closer to highly autonomous software development, although widespread deployment will depend on addressing persistent operational limitations.

“Reliability remains an issue without human supervision,” Su said.

Coordinating multiple AI agents across enterprise tools and internal teams also remains difficult, he added. Organizations will need to monitor agent activity and run these systems in appropriately isolated environments. Critical changes should remain subject to human approval, with sufficient visibility into agent behavior to support audits.

Pareekh Jain, CEO of Pareekh Consulting, said complex legacy systems and the need to meet business requirements could limit how much software development enterprises can delegate to AI agents.

Faster vulnerability discovery raises concerns

Anthropic said Mythos 5.2 identified 89.6% of vulnerabilities in its internal CVE Rediscovery evaluation, compared with 78.3% for Mythos 5.1.

Conducted against 1,829 previously disclosed vulnerabilities, the test assessed whether models could independently rediscover flaws in software snapshots taken before the vulnerabilities were fixed. The company said Mythos 5.2 was also better at reproducing vulnerabilities and developing fixes.

Anthropic has restricted direct access to Mythos 5.2 through its verification programs. However, Claude Enterprise customers can use the model’s vulnerability detection capabilities through Claude Security without joining those programs, the company said.

According to Su, “Mythos 5.2 shifts the balance towards defenders in controlled enterprise settings.”

Jain, however, cautioned that advances in AI-powered vulnerability discovery could also help attackers identify software weaknesses more quickly. “This creates an AI-powered race between attackers and defenders,” he said.

Data retention raises compliance questions

Anthropic said customers eligible for zero data retention can continue using Fable 5.2 and Mythos 5.2 under those arrangements, while other customers face 30-day retention for safety monitoring.

The company has also introduced Enterprise Frontier Safeguards, currently in private beta, which allows automated safety monitoring to run on prompts and responses stored within customers’ infrastructure.

Gogia said data retention requirements could outweigh the benefits of lower API prices for regulated enterprises. He urged procurement teams to obtain written confirmation of zero-retention arrangements before deploying the models for sensitive workloads.

The article originally appeared on InfoWorld.

An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires. The unit Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Apple signaled its intention to build its business in India 10 years ago. A decade later, Apple Chairman Tim Cook is in the Republic of Türkiye for a flurry of appearances and announcements that signify Türkiye’s importance to the company.

Apple announced plans to open five new Apple Developer Academies, one Apple Developer Center, and one Apple Manufacturing Academy in Türkiye. This is the first manufacturing academy the company will open outside the US, which is worth mentioning on its own account.

Türkiye has its own ambitions

Apple’s move reflects Türkiye’s ongoing attempt to build up its manufacturing industry. The country recently announced a $5 billion preferential financing system to provide targeted support at the manufacturing industry there. That package sees funds made available to business in the form of long-term loans and comes within a broader policy of supporting Turkish manufacturers and exporters and facilitating the implementation of industrial investment projects.

While the manufacturing academy won’t open its doors before 2028, Apple’s decision to open its academy echoes the national ambition. The World Bank has also turned its attention there.

What did Apple say about the academy? “The academy, which will invest in individuals and institutional knowledge, aims to increase the speed of innovation and adopt advanced technologies by supporting Türkiye’s production sector,” the company says. Courses will cover machine learning technology, predictive maintenance, advanced automation, and robotics, along with interactive workshops on operational and production efficiency.

What does Apple want?

Türkiye sits where Europe meets the Middle East and Asia, so is a great location to attract talent from all those locations, as well as being in a customs union with the EU. Apple’s intentions won’t be philanthropic; it’s most likely the company hopes to identify hot new talent from across the region, presumably tempting the best workers to join its ongoing effort to build manufacturing in the US. Apple knows it needs to cast an incredibly wide net to find the best possible talent to run the manufacturing facilities for the products it hopes to make in the next decade. 

Apple being Apple, it may also be part of its attempt to navigate Türkiye’s tax structure, which currently means someone purchasing an iPhone there must pay around the same price as the device again in various forms of tax. Türkiye is one of the most expensive places to purchase iPhones on Earth, and these new investments may become leverage for future tax concessions.

Bugün Apple Yönetim Kurulu Başkanı @tim_cook ile gerçekleştirdiğimiz görüşmede, küresel düzeyde dijital teknolojinin geleceğini ve Apple’ın Türkiye’deki dijital uygulama ekonomisine yönelik desteğini konuştuk.

Görüşmemizin Türkiye ve Apple şirketi için hayırlara vesile olmasını… pic.twitter.com/y3sLlZTJyc

— Recep Tayyip Erdoğan (@RTErdogan) November 9, 2026 What’s Türkiye got that other regions don’t? 

The US International Trade Administration (ITA) points to the nation’s “young, sizeable population, dynamic entrepreneurial class, and advantageous geographic position as a bridge between Europe and Asia.” It points out that manufacturing accounts for 16.8% of the nation’s GDP and tells us 40.3% of Türkiye’s manufacturing exports consisted of medium-tech products and 5.1% consisted of high-tech products.

Türkiye also has other advantages. Despite having a skilled workforce with technical education, labor costs are 40%-60% lower than in Western Europe. It has energy capacity, modern infrastructure and reliable telecoms, and is already a base for electronics production from the likes of Vestel and Samsung. It is also Europe’s largest exporter of household appliances.

Building tomorrow’s industrial production

But where Apple’s ideas and Türkiye’s ambitions may mesh most deeply is that as it seeks to build its manufacturing business, the nation seems keen to invest in the industry 4.0 technologies that Apple is also investing in across its existing supply chain.

The advantage Türkiye has is that it needs a lot more investment in the digital technologies required to build that kind of future, which makes it a perfect example of a high-tech customer with ambitions to become a high-tech player in the manufacturing space, one which is not held back by existing legacy manufacturing investments to the same extent as some other nations. 

That also means Türkiye is keen on facilitating big investments in the country. “The Government is supporting the establishment of digital transformation centers and model factories, piloting emerging technologies and advanced manufacturing solutions within organized industrial zones and technology development zones (Technoparks) across Türkiye,” wrote the ITA. 

What’s the playbook again?

It’s not a new opportunity. Cook mentioned that Apple has done business in Türkiye for 35 years. It already runs three retail stores there, and I suspect that the scale of Apple’s business will expand following these investments there.

We’ve seen this playbook before. Apple identifies a country with potential, invests in it, and a few years later the industry notices that it has built a thriving business there. We saw this most recently in India, which at this point makes over 25% (and possibly more) of all iPhones sold globally and is among Apple’s fastest-growing markets.

Speculate to accumulate, as they say.  And no one accumulates quite like Apple.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...]

Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

IT threat evolution in Q3 2026. Non-mobile statistics
IT threat evolution in Q3 2026. Mobile statistics

The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing statistical data.

Quarterly figures

In Q3 2026:

• Kaspersky products blocked more than 311 million attacks launched from online resources.
• Web Anti-Virus responded to 47 million unique links.
• File Anti-Virus blocked more than 23 million malicious and potentially unwanted objects.
• There were 4470 new ransomware variants discovered.
• More than 81,000 users experienced ransomware attacks.
• 15% of all ransomware victims whose data was published on threat actors’ data leak sites (DLSs) were victims of Qilin.
• More than 217,000 users were targeted by miners.

Ransomware Quarterly trends and highlights Threat actor disruption

In August, the creator and lead administrator of the Ransom Cartel ransomware-as-a-service (RaaS) operation was sentenced to 16 years in prison. The convict developed the ransomware Trojan and at the time of his arrest played a central role in the RaaS operation: running the affiliate program, recruiting affiliates, supplying them with information and attack tools, working with initial access brokers, communicating with victims, and processing payments.

In September, a member of the Ryuk RaaS group was sentenced to two years in prison and three years of supervised release. In 2019 and 2020, he and his accomplices breached organizations’ networks and encrypted data with the Ryuk Trojan. According to public reports, hundreds of workstations and servers were compromised. According to the prosecution, the attacker received a total of about 1610 BTC in ransom payments from victims.

Also in September, a member of the Conti RaaS group was sentenced to four years in prison. He was charged with attacking companies in 2021 and 2022. In addition to carrying out attacks, he developed part of the group’s malware toolkit.

Vulnerabilities and attacks

In July, researchers published a report on the Qilin group exploiting the CVE-2026-0257 vulnerability in Palo Alto Networks firewall software. The vulnerability allowed attackers to bypass authentication and compromise victims’ networks without valid accounts.

CISA published information in its Known Exploited Vulnerabilities Catalog (KEV) on several CVEs actively exploited by ransomware groups:

• CVE-2026-15409/CVE-2026-15410 in SonicWall SMA1000 remote access gateways. CISA doesn’t specify which groups exploited these vulnerabilities, but researchers have linked this activity to INC Ransom.
• CVE-2026-45659 in Microsoft SharePoint Server allowed an authenticated, low-privileged attacker to achieve remote code execution.
• CVE-2025-60710 in Microsoft Windows allowed attackers to escalate privileges locally.
• CVE-2026-59310 in VMware vCenter enabled unauthenticated remote code execution.
• CVE-2025-14733 in WatchGuard Firebox also enabled unauthenticated remote code execution.
• CVE-2026-63077 in JetBrains TeamCity allowed OS commands to run with the privileges of the TeamCity server process by way of an authentication bypass through the agent polling protocol. Command execution at that level could give access to configurations, credentials, CI/CD pipelines, and more.

The most prolific groups

This section highlights the most prolific ransomware gangs by number of victims added to each group’s DLS. Qilin (15.39%) holds first place, as it did last quarter. Qilin is followed by The Gentlemen (7.89%), which was especially active in Q1 but did not make the list in Q2. A notable newcomer on the list is Deadlock (4.46%), a relatively young ransomware family first reported in July 2025.

Number of each group’s victims according to its DLS as a percentage of all groups’ victims published on all the DLSs under review during the reporting period (download)

Number of new ransomware variants

In Q3, Kaspersky products detected three new ransomware families and 4470 new variants, more than 1.5 times last quarter’s count.

Number of new ransomware modifications, Q3 2025 – Q3 2026 (download)

Number of users attacked by ransomware Trojans

During the reporting period, our products protected 81,556 unique users from ransomware attacks. Users encountered ransomware most often in September.

Number of unique users attacked by ransomware Trojans, Q3 2026 (download)

TOP 10 countries and territories attacked by ransomware Trojans Country/territory* %** 1 China 0.83% 2 South Korea 0.65% 3 Cameroon 0.51% 4 Pakistan 0.47% 5 Tajikistan 0.45% 6 Iraq 0.43% 7 Hong Kong 0.41% 8 Uzbekistan 0.40% 9 Bangladesh 0.33% 10 Turkmenistan 0.32%

* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by ransomware Trojans as a percentage of all unique Kaspersky users in the country/territory.

TOP 10 most common families of ransomware Trojans Name Verdict %* 1 (generic verdict) Trojan-Ransom.Win32.Gen 32.48% 2 (generic verdict) Trojan-Ransom.Win32.Crypren 6.31% 3 WannaCry Trojan-Ransom.Win32.Wanna 4.90% 4 (generic verdict) Trojan-Ransom.Win32.Encoder 4.39% 5 (generic verdict) Trojan-Ransom.Win32.Agent 4.33% 6 (generic verdict) Trojan-Ransom.Python.Agent 3.09% 7 (generic verdict) Trojan-Ransom.PowerShell.Agent 2.79% 8 (generic verdict) Trojan-Ransom.Win32.Phds 2.73% 9 (generic verdict) Trojan-Ransom.Win32.Phny 2.20% 10 (generic verdict) Trojan-Ransom.MSIL.Agent 2.10%

* Unique Kaspersky users attacked by the specific ransomware Trojan family as a percentage of all unique users attacked by this type of threat.

Miners Number of new miner variants

In Q3 2026, Kaspersky solutions detected 2197 new miner variants. After the spike in the second quarter, it’s fair to say the pattern has returned to the calmer one typical of last year.

Number of new miner modifications, Q3 2026 (download)

 

Number of users attacked by miners

In Q3, we detected miner attacks on the computers of 217,024 unique Kaspersky users worldwide.

Number of unique users attacked by miners, Q3 2026 (download)

TOP 10 countries and territories attacked by miners Country/territory* %** 1 Turkmenistan 2.32% 2 Tanzania 1.43% 3 Mali 1.21% 4 Senegal 1.05% 5 China 1.03% 6 Bangladesh 0.98% 7 Portugal 0.7% 8 Côte d’Ivoire 0.68% 9 Costa Rica 0.65% 10 Ethiopia 0.61%

* Excluded are countries and territories with relatively few (under 50,000) Kaspersky users.
** Unique users whose computers were attacked by miners as a percentage of all unique Kaspersky users in the country/territory.

Attacks on macOS Quarterly highlights

At the beginning of the third quarter, Jamf researchers discovered a new stealer, PamStealer. What sets it apart is its use of Pluggable Authentication Modules (PAM) to verify the administrator password the user enters.

During the quarter, Socket researchers discovered several supply chain attacks that compromised popular npm, PyPI and Cargo (the Rust package manager) packages. The malicious payloads in these packages targeted macOS systems along with others. For example, on July 11, an infected npm package, jscrambler, was published. Its malicious module was an infostealer written in Rust. The infostealer targeted crypto wallets, secrets from various services and browsers, MCP server configurations, and API keys for AI agents. In August, an attack was detected on the arrayref, internment, and append-only-vec Rust crates; it delivered a Rust backdoor to the victim’s device. In September, malicious versions of the MemTensor npm and PyPI packages were published. They delivered a Go backdoor that targeted secrets, configurations, and API tokens of various services.

In August, Jamf researchers also reported discovering a new backdoor, Overlord. It was distributed as fake Zoom installers and had fairly broad spyware functionality, which is not often seen in macOS backdoors: it could eavesdrop through the microphone, watch the user through the camera, capture the screen, and log keystrokes.

In the third quarter, we discovered an updated version of the MacSync crypto stealer and backdoor with a significantly changed payload delivery method.

TOP 20 threats to macOS

Unique users who encountered this malware as a percentage* of all attacked users of Kaspersky security solutions for macOS (download)

* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.

The share of Ngrok, a network tunneling tool suite with both legitimate and malicious uses, continued to grow, bringing it to the top of the list. We’re also seeing more detections of the well-known Amos malware, both the traditional stealer and a version with backdoor functionality.

TOP 10 countries and territories by share of attacked users Country/territory %* Q2 2026 %* Q3 2026 Brazil 1.14% 1.13% Hong Kong 0.59% 0.92% China 0.55% 1.04% India 0.55% 0.41% Germany 0.36% 0.33% Singapore 0.30% 0.85% Russia 0.21% 0.24% Japan 0.18% 0.21% Netherlands 0.16% 0.31%

* Unique users who encountered threats to macOS as a percentage of all unique Kaspersky users in the country/territory.

IoT threat statistics

This section presents statistics on attacks targeting Kaspersky IoT honeypots. The geographic data on attack sources is based on the IP addresses of attacking devices.

Distribution by protocol

In Q3 2026, the share of devices attacking Kaspersky honeypots over SSH grew to 18.42%.

Distribution of attacked services by number of unique IP addresses of attacking devices (download)

The distribution of attacks over the Telnet and SSH protocols shows the same trend.

Distribution of cybercriminal sessions in Kaspersky honeypots (download)

TOP 10 threats delivered to IoT devices

Share of each threat delivered to an infected device as a result of a successful attack, out of the total number of threats delivered (download)

Mirai’s share of the overall IoT threat distribution declined, while other botnet threats that deliver malware grew.

Attacks on IoT honeypots

In the distribution of SSH attacks, the Netherlands, Bulgaria, and the US accounted for the largest shares, with the share of attacks originating from Bulgaria having grown fourfold. Germany comes next, with its share down by about half.

Country/territory Q2 2026 Q3 2026 Netherlands 21.18% 27.70% Bulgaria 5.50% 20.05% United States 6.76% 10.17% Germany 16.73% 8.36% Romania 4.06% 4.20% India 2.78% 3.52% Panama 4.67% 2.19% Indonesia 1.54% 2.06% Vietnam 3.91% 2.01% Singapore 1.99% 1.42%

Pakistan’s share of Telnet attacks kept growing, reaching 47.73%.

Country/territory Q2 2026 Q3 2026 Pakistan 36.60% 47.73% China 35.62% 33.83% Russia 8.75% 4.65% India 4.19% 2.77% Taiwan 0.47% 1.64% Argentina 0.12% 1.45% Philippines 0.95% 1.08% United States 3.03% 0.90% Indonesia 1.52% 0.81% Germany 0.05% 0.75% Attacks via web resources

The statistics in this section are based on detection verdicts by Web Anti-Virus, which protects users when suspicious objects are downloaded from malicious or infected web pages. These malicious pages are purposefully created by cybercriminals. Websites that host user-generated content, such as message boards, as well as compromised legitimate sites, can become infected.

TOP 10 countries and territories that served as sources of web-based attacks

The following statistics show the distribution by country/territory of the sources of internet attacks blocked by Kaspersky products on user computers (web pages redirecting to exploits, sites containing exploits and other malware, botnet C&C centers, and so on). One or more web-based attacks could originate from each unique host.

To determine the geographic source of web attacks, we matched each domain name to the actual IP address hosting it, then geolocated that address (GeoIP).

In Q3 2026, Kaspersky solutions blocked 311,083,655 attacks launched from online resources across the globe. Web Anti-Virus was triggered by 46,936,926 unique URLs.

Web-based attacks by country/territory, Q3 2026 (download)

Countries and territories where users faced the greatest risk of online infection

To assess the risk of malware infection via the internet for users’ computers in different countries and territories, we calculated the share of Kaspersky users in each location on whose computers Web Anti-Virus was triggered during the reporting period. The resulting data provides an indication of the aggressiveness of the environment in which computers operate in different countries and territories.

This ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out Web Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.

Country/territory* %** 1 Bangladesh 12.03 2 Taiwan 8.06 3 Venezuela 7.92 4 Vietnam 7.71 5 India 7.61 6 Belgium 6.80 7 France 6.54 8 Nepal 6.48 9 Greece 6.22 10 UAE 6.13 11 Portugal 6.10 12 Germany 5.75 13 China 5.71 14 Qatar 5.70 15 Serbia 5.58 16 Austria 5.57 17 Sri Lanka 5.40 18 Australia 5.32 19 Italy 5.31 20 Morocco 5.27

* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users targeted by web-based Malware attacks as a percentage of all unique users of Kaspersky products in the country/territory.

On average over the quarter, 4.34% of internet users’ computers worldwide were targeted by at least one web-based Malware attack.

Local threats

Statistics on local infections of user computers are an important indicator. They include objects that penetrated the target computer by infecting files or removable media, or initially made their way onto the computer in non-open form. Examples of the latter are programs in complex installers and encrypted files.

Data in this section is based on analyzing statistics produced by anti-virus scans of files on the hard drive at the moment they were created or accessed, and the results of scanning removable storage media. The statistics are based on detection verdicts from the On-Access Scan (OAS) and On-Demand Scan (ODS) modules of File Anti-Virus and include detections of malicious programs located on user computers or removable media connected to the computers, such as flash drives, camera memory cards, phones, or external hard drives.

In Q3 2026, our File Anti-Virus recorded 23,733,652 malicious and potentially unwanted objects.

Countries and territories where users faced the highest risk of local infection

For each country and territory, we calculated the percentage of Kaspersky users whose computers had the File Anti-Virus triggered at least once during the reporting period. These statistics reflect the level of personal computer infection in different countries and territories worldwide.

Note that this ranked list includes only attacks by malicious objects classified as Malware. Our calculations leave out File Anti-Virus detections of potentially dangerous or unwanted programs, such as RiskTool or adware.

Country/territory* %** 1 Turkmenistan 45.68 2 Burundi 31.54 3 Yemen 30.31 4 China 29.93 5 Afghanistan 29.41 6 Mozambique 26.61 7 Tajikistan 26.29 8 Republic of the Congo 25.51 9 Uzbekistan 25.25 10 Cameroon 24.08 11 Democratic Republic of the Congo 23.55 12 Uganda 21.81 13 Cambodia 21.74 14 Chad 21.60 15 Syria 21.43 16 Nicaragua 21.02 17 South Sudan 20.72 18 Bangladesh 19.78 19 Mali 19.59 20 Angola 18.25

* Excluded are countries and territories with relatively few (under 10,000) Kaspersky users.
** Unique users on whose computers Malware local threats were blocked, as a percentage of all unique users of Kaspersky products in the country/territory.

On average worldwide, Malware local threats were detected at least once on 10.88% of users’ computers during Q3.

Russia scored 9.37% in these rankings.

IT threat evolution in Q3 2026. Non-mobile statistics
IT threat evolution in Q3 2026. Mobile statistics

The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats for Android and iOS discovered during the reporting period. These statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network.

The quarter in figures

According to Kaspersky Security Network, in Q3 2026:

• More than 1.66 million attacks involving mobile malware, adware, or unwanted software were blocked.

• The Trojan-Banker category was the prevalent mobile malware threat with a 31.63% share of all detected malicious apps.
• Over 378,000 malicious installation packages were detected, including 119,688 mobile banking Trojan packages.

Quarterly highlights

In July, we discovered a malicious app targeting Brazilian users that may have used AI to automate fraud. The app was disguised as Google Play Protect, a suite of security services for Android devices.

Malicious app imitating Google Play Protect

The app’s code used the DistilBERT model to interpret natural-language commands sent from the C2 server. Traces left in the code suggest the server-side commands may also have been generated by a large language model (LLM).

In August, we discovered a Trojan that analyzed images saved in the device’s gallery and took screenshots to look for banking data, including CVV codes. The malware used an on-device AI model to classify images. The app could also update this model, which gave the scammers a way to expand the Trojan’s functionality.

In the third quarter, the infamous subscription Trojan detected as Trojan.AndroidOS.Subscriber.bh made it into Google Play again. This time, it was disguised as an app for creating keyboard themes.

Subscription Trojan disguised as a keyboard theme app

The Trojan opened a subscription link in a hidden WebView and intercepted the message containing the confirmation code. According to our data, the scammers mainly targeted users in Thailand.

There were also new attacks on iOS users. In August, researchers at Socket discovered 13 infected PHP packages in the Packagist repository. The malicious payload injected links to fraudulent casinos into sites that used these packages and, on iOS devices only, a hidden iframe that loaded the DarkSword exploit kit. The attack delivered a spyware module that stole keychain contents, Wi-Fi passwords, SMS messages, photos, and other personal data. Other modules found in this campaign were used to steal crypto wallet data and the seed phrases used to recover them.

SlowMist researchers found the same DarkSword exploit chain used in a fake app, FomoPeek. FomoPeek was published in the App Store, presenting itself as a crypto wallet tracker. The malware was designed to steal data from notes and crypto wallet apps.

Also in August, we discovered infected versions of popular iOS apps distributed through Telegram (link in Russian). To install such an app, the attackers asked users to buy a developer certificate. The modified versions contained a malicious module that collected device information, took screenshots, and sent this data to a server.

Mobile threat statistics

The downward trend in attacks on mobile devices involving malware, adware, or unwanted software continued: the number fell to 1,668,368 in Q3 from 1,996,823 in Q2.

Attacks on users of Kaspersky mobile solutions, Q1 2025 – Q3 2026 (download)

In the third quarter, this decline was driven in part by fewer adware attacks, which we examine in more detail below.

The number of Android malware samples grew compared to the previous reporting period, reaching 378,456.

Detected malicious and potentially unwanted installation packages, Q3 2025 – Q3 2026 (download)

The distribution of detected installation packages by type was as follows:

Detected mobile apps by type, Q2*–Q3 2026 (download)

* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.

The sharp rise in Trojan-Dropper apps comes from more droppers delivering known banking Trojans such as Mamont and Creduz. In the previous quarter, we described the trend of attackers “packaging” banking Trojans. The resulting malware is classified as droppers, which explains the growth. Note that standalone banking Trojans still rank first. Together with droppers, they account for more than half of all detected malicious apps.

Share* of users attacked by the given type of malicious or potentially unwanted apps out of all targeted users of Kaspersky mobile products, Q2–Q3 2026 (download)

* The total percentage may exceed 100% if the same users encountered multiple attack types.

The number of AdWare.AndroidOS.HiddenAd and AdWare.AndroidOS.MobiDash attacks continued to decline, although adware traditionally ranks first by the number of attacked users. The growing share of Trojan-Dropper correlates with the increase in packaged banking Trojans described in the previous section. Among Trojan-Spy attacks, the biggest growth came from the BTMOB and SpyNote RAT Trojans, which are used to steal money.

TOP 20 types of mobile malware

Note that the malware rankings below exclude riskware or potentially unwanted software, such as RiskTool or adware.

Verdict %* Q2 2026 %* Q3 2026 Difference in p.p. Change in ranking Backdoor.AndroidOS.Triada.ag 9.35 13.14 +3.79 0 Trojan.AndroidOS.Boogr.gsh 3.33 5.21 +1.87 +2 DangerousObject.AndroidOS.GenericML. 5.25 4.61 -0.63 0 DangerousObject.Multi.Generic. 5.65 4.01 -1.64 -2 Trojan-Proxy.AndroidOS.Vo1d.b 0.07 3.20 +3.13 Backdoor.AndroidOS.Triada.z 3.23 2.85 -0.38 -1 Trojan-Dropper.AndroidOS.Mamont.am 0.00 2.72 +2.72 Trojan.AndroidOS.Vo1d.c 0.00 2.16 +2.16 Trojan-Spy.AndroidOS.Btmob.c 1.02 2.09 +1.07 +22 Trojan.AndroidOS.Fakeapp.in 0.00 2.03 +2.03 Trojan-Dropper.AndroidOS.Mamont.aq 0.00 2.03 +2.03 Trojan-Banker.AndroidOS.Mamont.hl 2.48 2.03 -0.45 -6 Backdoor.AndroidOS.Triada.ad 1.93 1.75 -0.18 -1 Trojan.AndroidOS.Triada.fe 2.18 1.70 -0.48 -5 Backdoor.AndroidOS.Triada.ae 1.44 1.67 +0.23 +2 Trojan-Spy.AndroidOS.GGtrack.a 1.20 1.65 +0.45 +8 Trojan-Banker.AndroidOS.Agent.ws 1.11 1.46 +0.34 +10 Trojan-Dropper.AndroidOS.BeatBanker.c 1.01 1.33 +0.32 +14 Trojan.AndroidOS.Triada.hf 1.93 1.33 -0.61 -8 Trojan-Dropper.AndroidOS.Creduz.t 0.00 1.30 +1.30

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions

Most of the list is made up of variants of Trojans that were already popular last quarter: several versions of the preinstalled Triada Trojan, Mamont bankers, and BTMOB spyware.

The main newcomer among Q3’s most widespread malware was the Trojan-Proxy.AndroidOS.Vo1d.b apps, delivered by preinstalled Trojans. These apps turn the device into an exit node of a VPN service. These attacks are dangerous for two reasons. First, they burn through internet traffic, which the user may be paying for, to relay other people’s data. Second, cybercriminals can use the infected device to attack online services and visit banned websites, breaking the law in the victim’s name.

Mobile banking Trojans

In Q3 2026, the number of Trojan-Banker installation packages began rising again after a drop last quarter.

Number of installation packages for mobile banking Trojans detected by Kaspersky, Q3 2025 – Q3 2026 (download)

By type, Creduz again accounts for the largest share of banking Trojans. However, as in Q2, the statistics of actual attacks tell a different story: Mamont variants were again the most active Trojans.

TOP 10 mobile bankers Verdict %* Q2 2026 %* Q3 2026 Difference in p.p. Change in ranking Trojan-Banker.AndroidOS.Mamont.hl 11.13 10.31 -0.81 0 Trojan-Banker.AndroidOS.Agent.ws 4.99 7.42 +2.43 +2 Trojan-Banker.AndroidOS.Agent.eq 2.58 5.58 +3.00 +7 Trojan-Banker.AndroidOS.Mamont.lf 2.79 5.10 +2.30 +5 Trojan-Banker.AndroidOS.Mamont.od 0.00 5.05 +5.05 Trojan-Banker.AndroidOS.Mamont.mv 5.12 4.29 -0.83 -3 Trojan-Banker.AndroidOS.Faketoken.pac 4.10 3.81 -0.29 -1 Trojan-Banker.AndroidOS.Agent.io 0.30 3.68 +3.38 +87 Trojan-Banker.AndroidOS.Mamont.ns 0.24 3.01 +2.77 +97 Trojan-Banker.AndroidOS.Mamont.da 2.37 2.97 +0.60 +2

* Unique users who encountered this malware as a percentage of all Kaspersky mobile security solution users who encountered banking threats

AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]

A Linux security protection can appear to be available but still be switched off when a system needs it.