We’ve compiled the week’s most important cybersecurity news.
- Hackers launched a phishing campaign against nearly a million crypto investors.
- Fake AML checkers designed to steal cryptocurrency were found online.
- Attackers infected a popular Rust library used by blockchain developers.
- Hackers compromised about 14,500 Dahua cameras in Ukraine and Russia.
Hackers launched a phishing campaign against nearly a million crypto investors
Attackers stole a database containing about 885,000 phone numbers of crypto investors from various countries. Cybersecurity firm Rapid7 detailed the “Operation Asterix” phishing campaign.
Victims received calls from people posing as support staff or emails spoofing companies such as Crypto.com. The goal was to push users to a phishing site or get them to install a fake app closely imitating Ledger, Trezor, or Exodus to steal their seed phrases.
The hackers used automated scripts to cross-check phone numbers at scale against databases of major exchanges (Kraken, Binance).
According to Rapid7, the hit rate was high: in the German sample, the match rate was 13.6% — attackers identified 43,066 real crypto investors. They prioritized more than 5,500 confirmed Binance accounts for first-wave attacks. Analysts also found that AI tools were actively used to generate phishing content.
The largest fragment of the stolen data contains 316,002 phone numbers belonging to German citizens. The lists also include residents of the U.S., the U.K., Hong Kong, and Bulgaria, customers of Canadian fintech companies, and users whose data leaked from hardware wallet maker Ledger.
Fake AML checkers designed to steal cryptocurrency found online
Scammers created fake AML services that claimed to assess whether crypto wallets were “clean.” Cybersecurity researchers at Malwarebytes warned about the new phishing scheme.
They copied the design of legitimate platforms like AMLBot or used neutral brands such as AML Check.
The trap was that the site requested permission to connect a crypto wallet to begin the “scan.” After connecting, the portal simulated deep blockchain analysis with fake loading indicators. The victim always received a reassuring result — “Clean, low risk.”
Under the guise of paying a “small fee” for the check — or simply during the connection process — the victim was prompted to sign a transaction that granted a malicious smart contract the right to withdraw funds.
Malwarebytes noted that the scammers reused the same website template, swapping only logos and names.
Attackers infected a popular Rust library used by blockchain developers
On August 20, attackers compromised the developer account behind the popular Rust crate arrayref, injecting code that executed stealthily during project compilation. Within a 23-minute window, they also “poisoned” two other libraries by the same author — append-only-vec and internment, according to Wiz.
The potential impact is significant: arrayref alone has more than 245 million downloads. The crate is foundational and is used in blockchain tooling, including components for Ethereum and Solana.
Attack stages:
- The attackers added a dependency in arrayref on a malicious package named proc-macro1 (a deliberate misspelling to mimic the popular proc-macro2).
- Because the Cargo package manager automatically runs scripts at compile time, one of them — a fake build.rs — went unnoticed.
- The code profiled the system and downloaded a loader tailored to the victim’s operating system.
Researchers said the trojan’s main task was to gather system information and steal databases of saved passwords from popular browsers: Google Chrome, Brave, and Edge. For persistence, it added itself to system startup.
Wiz noted overlap between the campaign’s network infrastructure and that used in recent attacks on Mastra and Axios. Microsoft links both incidents to the North Korean group Sapphire Sleet.
Hackers compromised about 14,500 Dahua cameras in Ukraine and Russia
In just 35 days — from June 17 to July 22, 2026 — attackers managed to compromise 14,530 Dahua surveillance cameras. Researchers at Hunt.io detailed the CameraSwarm operation.
According to the researchers, the attackers made an operational mistake: they left an HTTP server unprotected, allowing analysts to copy 407 MB of data, including tool source code, logs, credentials, and even snapshots from infected cameras.
While the device scanning was global, the main focus was on telecom provider networks in Russia, Ukraine, and other countries. Comments in the tools’ code were written in Russian.
The attackers used three vectors in parallel:
- 12,324 cameras. They scanned open TCP port 37777, brute-forced passwords, captured frames, and automatically sent them to Telegram for later export into the Dahua SMART PSS platform.
- 1,923 cameras. Using the p2pwn tool, they exploited five-year-old vulnerabilities. A hidden backdoor account (login p2pwn, password p2password) was created; it persisted even after the real owner changed credentials and, in most cases, survived a factory reset.
- 283 cameras. They accessed devices beyond NAT using only their serial numbers and credentials embedded in Dahua apps. This interception allowed them to generate offline recovery codes and reset administrator passwords.
Owners of Dahua cameras were advised to check the admin panel for a hidden p2pwn account and remove it. For full protection, researchers recommended disabling P2P entirely (if not used for remote access) and installing the latest firmware that patches the 2021 vulnerabilities.
Trojan relayed stolen data via nearby smartphones
A new Android trojan targeted more than 169 apps across sectors including banking, government, and crypto, researchers at ThreatFabric said. The malware is called Manic.
The malware has been active since at least February 2026 and spreads via third-party APK files. Attackers use protected loaders that unpack the main payload directly into memory, effectively bypassing antivirus tools.
After obtaining access to Accessibility Services, Manic overlays transparent layers on digital keyboards in banking apps. It records every keystroke and automatically classifies the stolen data, separating unlock PINs, seed phrases, SMS codes, and 2FA.
Researchers also said the malware can intercept system notifications, download personal files, track geolocation, and grant attackers real-time remote screen access via WebRTC sessions.
Manic’s unique feature is a fallback exfiltration mechanism. If the compromised phone is offline, the virus searches for other infected devices nearby and transfers encrypted data to them over Wi-Fi Direct or Bluetooth. The chain forms a variant of a mesh network with four relay nodes, ending on a phone connected to the internet.
The primary targeting is users in Ukraine, as well as Central and Western Europe, the U.K., and Russia.
Also on ForkLog:
- Experts warned of mass crypto hacks using AI agents.
- BitBox patched two serious vulnerabilities in its bitcoin wallet firmware.
- OpenAI slowed the development of AI models due to cyber risks.
- The Maya Protocol team halted the network after a $1.7 million hack.
- Harmony will roll back the blockchain after an attack that minted trillions of ONE.
- A Mac vulnerability allowed stealth Monero miners to be installed.
- SafePal reported a data breach affecting about 40,000 users.
- A hacker stole data on 678,000 French taxpayers.
- Hackers stole more than 1,700 BTC from vulnerable Coldcard wallets.
What to read this weekend?
ForkLog compiled five stories about what happens when AI — the problem child of tech giants — gets out of control.
