An upgraded variant of BX RAT, JanelaRAT, can steal cryptocurrency and financial data from financial organizations, trace mouse inputs, log keystrokes, collect system information, and take screenshots.
In a recent report, Kaspersky said, “One of the key differences between these trojans is that JanelaRAT uses a custom title bar detection mechanism to identify desired websites in victims' browsers and perform malicious actions.” The hackers behind the JanelaRAT attacks constantly modify the malware versions by adding new features.
Telemetry data collected by a Russian cybersecurity firm suggests that around 11,695 attacks happened in Mexico and 14,739 in Brazil in 2025. We do not know how many of these led to a successful exploit.
In June 2023, Zscaler first discovered JanelaRAT in the wild, leveraging ZIP archives containing a VBScript to download another ZIP file, which came with a genuine executable and a DLL payload. The hacker then deploys the DLL side-loading tactic to launch the malware.
An analysis by KPMG in 2025 revealed that the malware is circulated via rogue MSI installer files impersonating as a legit software hosted on trusted sites like GitLab.
"Upon execution, the installer initiates a multi-stage infection process using orchestrating scripts written in Go, PowerShell, and batch,” KPMG said. "These scripts unpack a ZIP archive containing the RAT executable, a malicious Chromium-based browser extension, and supporting components."
The scripts are also made to recognize installed Chromium-based browsers and secretly configure their launch parameters to install the extension. The browser add-on collects system data, cookies, browsing history, tab metadata, and installed extensions. It also triggers actions depending upon URL pattern matches.
The recent malware campaign found by Kaspersky reveals that phishing emails disguised as due invoices are used to lure recipients into downloading a PDF file by opening a link, causing the download of a ZIP archive that starts the attack chain, including DLL side-loading to deploy JanelaRAT.
Since May 2024, JanelaRAT malware has moved from VBScripts to MSI installers, which work as a dropper for the trojan via DLL side-loading and build persistence in the victim system by making a Windows Shortcut (LNK) in the Startup folder that leads to the executable.
According to Kaspersky, “The malware determines if the victim's machine has been inactive for more than 10 minutes by calculating the elapsed time since the last user input.”
If the inactivity is over ten minutes, “the malware notifies the C2 by sending the corresponding message. Upon user activity, it notifies the threat actor again. This makes it possible to track the user's presence and routine to time possible remote operations," Kaspersky said.
In spite of the fact that the Russian government is intensifying its efforts to reaffirm its control over digital communication channels, unintended consequences of that strategy are becoming evident in a number of critical sectors beyond social media. Significant disruptions to the domestic financial infrastructure have coincided with the sweeping restrictions imposed on the use of virtual private networks widely relied upon for bypassing state-imposed restrictions over the past week.
The Federal Bureau of Investigation has issued a fresh alert cautioning users about potential security and privacy threats posed by mobile applications developed outside the United States, particularly those linked to China. The advisory emphasizes that while the concern may seem obvious, many users continue to download such apps without fully understanding the risks.
In its public notice, the agency highlighted that a significant number of widely used and top-earning apps in the U.S. market are owned or operated by foreign companies. Many of these are tied to Chinese firms, raising concerns due to China’s legal framework governing data access.
At the center of the warning are provisions within China’s National Intelligence Law. Under Article 7, individuals and organizations are required to assist state intelligence efforts and maintain secrecy around such cooperation. Article 14 further allows authorities to demand support, data, or cooperation from entities and citizens. Together, these provisions create a legal pathway through which user data collected by apps could be accessed by the Chinese state.
Despite raising these concerns, the FBI has not published a formal list of high-risk apps. Instead, it has urged users to evaluate all foreign-developed applications before installing them. Media reports, including analysis referenced by outlets such as New York Post, suggest that popular platforms like CapCut, Temu, SHEIN, and Lemon8 fall into this broader category of concern.
Further analysis by TechRadar indicates that several of these apps rank highly in download charts across both Android and iOS platforms. On Android, for example, TikTok Lite appears among the most downloaded, alongside TikTok and Temu. Some apps are linked to developers based in Hong Kong or operate through complex international structures, making origin tracing less transparent. While Android devices face higher exposure due to sideloading capabilities, iPhone users are not entirely shielded from such risks.
Notably, platforms like TikTok, CapCut, and Lemon8 currently operate in the U.S. under TikTok USDS LLC, a joint venture backed by Oracle Corporation, with majority U.S. ownership. This structure means their U.S. operations are treated differently from their global counterparts, even though their origins remain tied to Chinese development.
The FBI stresses that its advisory is not a blanket ban on Chinese apps. Rather, it encourages users to be more vigilant. One key concern is the type of permissions users grant during installation. Many individuals overlook privacy policies, allowing apps to continuously gather sensitive data such as contact lists, location details, and personal identifiers.
This data can be used to build detailed social networks, which may later support targeted cyberattacks or social engineering campaigns. Some applications also include features that encourage users to invite contacts, enabling developers to collect additional personal data such as names, email addresses, phone numbers, and physical addresses.
Another major concern is data storage. Certain apps explicitly state that collected information may be stored on servers located in China for extended periods. In some cases, users cannot access app functionality unless they agree to such data-sharing practices.
Beyond privacy risks, the FBI also warns about potential cybersecurity threats. Some foreign-developed apps may include hidden malicious components capable of exploiting system vulnerabilities, collecting unauthorized data, or establishing persistent backdoor access on devices.
The advisory highlights that installing apps from unofficial sources significantly increases these risks. This is particularly relevant for Android users, where sideloading is more common. While official app stores conduct security checks to detect harmful code, third-party sources may bypass these safeguards. Companies like Google have taken steps to limit installations from unknown developers, though risks remain.
To mitigate exposure, the FBI recommends several precautionary measures:
• Install applications only from official app stores
• Review terms of service and user agreements carefully
• Restrict unnecessary permissions and data sharing
• Regularly update passwords
• Keep device software up to date
In a parallel development stressing upon global regulatory tensions, China recently ordered the removal of a decentralized messaging application created by Jack Dorsey from its local app store. Authorities claimed the app violated national internet regulations, reinforcing how governments worldwide are tightening control over digital platforms.
The larger takeaway is that app-related risks are no longer limited to malware alone. Increasingly, they are shaped by legal frameworks, data governance policies, and geopolitical dynamics. For everyday users, this makes informed decision-making around app downloads more critical than ever.
In famous wholesale hubs like Chenoy Trade Centre (CTC) in Secunderabad and Gujarati Galli in Koti, the effects of the ban are already visible: unsold stock, lower volumes, and price surge in non-Chinese devices.
Om Singh, a local businessman, has been running Kimpex Security Solutions for 14 years. He has called the ban ‘sudden’ and the transition ‘blunt’. According to The Hindu’s reporting, “Before the ban, we had 20 to 25 brands. Now we are left with only one. Customers have reduced significantly because rates have increased a lot and they are not satisfied with the quality.”
Om used to sell between 2,000 and 3,000 cameras every month for each of the brands, including Hikvision, TP-Link, and Dahua Technology. In total, he sold ₹30–40 lakh worth of shares each month. Om currently has stock that is worth between ₹15 and ₹20 lakh. He is worried about the sale of this remaining stock.
In the market, local traders say prices of Indian brands have surged by 10-30% since April 1. Cameras previously priced at ₹25k are now available for ₹ 27,000-32,000 or higher.
Another trader, Bhavesh, has been running Jeevraj CCTV for a decade. He says the change in demand is clear but also confusing. Indian brands are in high demand, especially CP Plus. However, businesses have increased prices for associated equipment and IT cameras. Sales and customer numbers have decreased due to the price increase.
Traders believe the situation is not sudden and has been building up over time. Over the past year, traders have not received significant supplies of these cameras. Shops sold whatever Chinese stock they had before March 31 so that it could be billed for GST, before the new financial year. Therefore, the ban didn’t significantly impact the markets as traders were left with a small number of Chinese stocks.
For installers and system integrators designing and executing surveillance setups, the impact is more optional. One system integration expert said the sudden rise in demand for Indian brands has resulted in supply bottlenecks. Clients are now demanding ‘Make in India’ products, and stock for Indian cameras is not ready for the current demand. Installers are facing pressure.

A set of publicly available flashcards discovered through simple online searches has sparked concern after appearing to reveal sensitive details related to facility security at U.S. Customs and Border Protection locations in Kingsville, Texas.
The flashcards were hosted on Quizlet and compiled under the title “USBP Review” in February. They remained accessible until March 20, when the set was made private shortly after an inquiry was sent to a phone number potentially linked to the account. Although the listed user appeared to be located near a CBP facility, there is no confirmation that the content was created by an active employee or contractor.
CBP has stated that its Office of Professional Responsibility is reviewing the matter, emphasizing that such reviews are routine and do not automatically indicate misconduct. Other agencies under the Department of Homeland Security, including Immigration and Customs Enforcement, did not respond to requests for comment.
If the material is found to be linked to CBP personnel, it could signal a serious lapse for an agency tasked with protecting national borders and safeguarding the country.
The flashcards included what appeared to be access codes for checkpoint doors and specific facility gates, with exact numerical combinations provided in response to direct prompts. Some gate names were not disclosed in reporting due to uncertainty over their confidentiality. Additional entries outlined immigration-related violations such as passport misuse, visa fraud, and attempts to evade checkpoints, along with associated legal consequences.
Several cards also detailed procedural workflows, including voluntary return processes, expedited removals, and warrants of removal. These entries referenced required documentation and reminded users to verify accuracy using an internal “agents Resources Page.”
Quizlet stated that it takes reports of sensitive content seriously and removes material that violates its policies, encouraging users to report concerning sets for review.
Further content within the set described the Kingsville sector’s operational scope, covering approximately 1,932 square miles across six counties. It also explained internal grid and zone systems, noting that one grid designation does not exist due to the layout of regional highways.
The flashcards additionally identified 11 operational towers in the area, including abbreviated naming formats and shared jurisdiction between certain towers. Some of these references appeared to align with the previously mentioned gate locations, increasing the potential sensitivity.
Another entry described an internal system called “E3 BEST,” which enables officers to record, investigate, and process secondary inspection cases. The system allows simultaneous database checks on individuals and vehicles and supports the creation of event records tied to enforcement outcomes.
The incident comes at a time of accelerated hiring across border enforcement agencies. CBP has offered incentives of up to $60,000 to attract recruits, while ICE has promoted similar packages, including signing bonuses and student loan repayment support. Increased recruitment may expand the use of informal study tools, raising the risk of unintended exposure.
Additional searches also surfaced other flashcard sets potentially linked to DHS-related training. These included materials on detention standards and transportation procedures, with prompts such as detainees being transported in a “safe and humane manner” and rules stating that driving under the influence is prohibited. Another set appeared to contain answers to internal training questions, including multiple-choice responses such as “Both A and C” and “All of the above.”
One user created more than 60 flashcard sets between November 2025 and February 2026, covering topics from radio codes and alphabets to more advanced areas like body-worn camera policies and immigration-related Spanish vocabulary. A more recent set included terms resembling language used in recruitment messaging, such as “the nation,” “the security,” and “the homeland.”
From a broader security perspective, the incident highlights how publicly accessible platforms can unintentionally expose operational knowledge. While no confirmed misuse has been reported, the situation underlines the importance of controlling how internal training materials are created, shared, and stored, particularly within agencies responsible for national security.
The commission disclosed the attack on March 27, when Bleeping Computer confirmed the breach of the European Union’s primary executive body.
Recently, the European Commission informed CERT-EU about the breach, informing them that their Cybersecurity Operations was not warned about an API exploit, a possible account hack, or any malicious network traffic until March 24.
In March, TeamPCP exploited a compromised AWS API key to manage rights over different Commission AWS accounts (hacked in the Trivy supply-chain breach).
After that, the gang deployed TruffleHog to look for more secrets, then added a new access key to an existing user to escape detection before doing more spying and data theft.
In the past, TeamPCP has been known for supply-chain attacks targeting developer code forums like NPM, Docker, PyPi, and GitHub. The gang also attacked the LiteLLM PyPI package in a campaign that affected tens of thousands of devices via its “TeamPCP Cloud Stealer” data-stealing malware.
Later, data extortion gang ShinyHunters posted the stolen data on their dark web leak site as a 90 GB archive of documents (around 340GB uncompressed), which includes email addresses, contacts, and email information.
According to the CERT-EU analysis, hackers have stolen tens of thousands of documents; the leak affects around 42 internal European Commission clients and around 20 other Union firms.
"The threat actor used the compromised AWS secret to exfiltrate data from the affected cloud environment. The exfiltrated data relates to websites hosted for up to 71 clients of the Europa web hosting service: 42 internal clients of the European Commission, and at least 29 other Union entities,” CERT-EU said. Regarding the dataset, CERT-EU said it also contained “at least 51,992 files related to outbound email communications, totalling 2.22 GB. The majority of these are automated notifications with little to no content. However, 'bounce-back' notifications, which are responses to incoming messages from users, may contain the original user-submitted content, posing a risk of personal data exposure."
No websites were taken offline or altered as a result of this attack, and no lateral movement to other Commission AWS accounts has been found, according to CERT-EU.
Although it would probably take "a considerable amount of time" to analyze the exfiltrated databases and information, the Commission has informed the appropriate data protection authorities and is in direct contact with the impacted organizations.
After learning that a mobile device management platform used to oversee employees' devices had been compromised, the European Commission revealed another data breach in February.