ThreatsDay Bulletin: Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories

The latest ThreatsDay Bulletin is basically a cheat sheet for everything breaking on the internet right now. No corporate fluff or boring lectures here, just a quick and honest look at the messy reality of keeping systems safe this week.

Things are moving fast. The list includes researchers chaining small bugs together to create massive backdoors, old software flaws coming back to haunt us, and some very clever new tricks that let attackers bypass security logs entirely without leaving a trace. We are also seeing sketchier traffic on the underground and the usual supply chain mess, where one bad piece of code threatens thousands of apps.

It is definitely worth a quick scan before you log off for the day, if only to make sure none of this is sitting in your own network. Let's get into it.

Pre-auth RCE chain exposed watchTower Labs has disclosed two security flaws in Progress ShareFile (CVE-2026-2699 and CVE-2026-2701) that could be chained to achieve pre-authenticated remote code execution. While CVE-2026-2699 is an authentication bypass via the "/ConfigService/Admin.aspx" endpoint, CVE-2026-2701 refers to a case of post-authenticated remote code execution. An attacker could combine the two vulnerabilities to sidestep authentication and upload web shells. Progress released fixes for the vulnerabilities with Storage Zone Controller 5.12.4 released on March 10, 2026. There are about 30,000 internet-facing instances, making patching against the flaws crucial.

Rootkit spreads via 50+ apps A new Android malware named NoVoice has been distributed via more than 50 apps that were downloaded at least 2.3 million times. While apps masqueraded as utilities, image galleries, and games, and offered the advertised functionality, the malware attempted to obtain root access on the device by exploiting 22 Android vulnerabilities that received patches between 2016 and 2021. "If the exploits succeed, the malware gains full control of the device," McAfee Labs said. "From that moment onward, every app that the user opens is injected with attacker-controlled code. This allows the operators to access any app data and exfiltrate it to their servers." The malware avoids infecting devices in certain regions, like Beijing and Shenzhen in China, and implements more than a dozen checks for emulators, debuggers, and VPNs. It then contacts a remote server to send device information and fetch appropriate exploits to gain root access and disable SELinux. Upon gaining elevated access, the rootkit modifies system libraries to facilitate the execution of malicious code when specific apps are opened, install arbitrary apps, and enable persistence. NoVoice has been found to share some level of overlap with Triada. One of the targeted apps is WhatsApp, which enabled the malware to harvest data from the app as soon as it was launched. Google has since removed the apps. The highest concentration of infections has been reported in Nigeria, Ethiopia, Algeria, India, and Kenya.

FBI flags foreign app risks The U.S. Federal Bureau of Investigation (FBI) is warning of the data security risks associated with foreign-developed mobile applications. "As of early 2026, many of the most downloaded and top-grossing apps in the United States are developed and maintained by foreign companies, particularly those based in China," the FBI said. "The apps that maintain digital infrastructure in China are subject to China's extensive national security laws, enabling the Chinese government to potentially access mobile app users' data." The bureau also warned that these apps may harvest contact information under the pretext of inviting friends to use them, store personal data in Chinese servers, or contain malware that could collect data beyond what is authorized by the user. "This could include malicious code and hard-to-remove malware designed to exploit known vulnerabilities in various operating systems and insert a backdoor for escalated privileges, such as enabling the download and execution of additional malicious packages designed to provide unauthorized access to users' data," it added. The FBI did not name the apps, but TikTok, Shein, Temu, and DeepSeek fit the profile.

New bureau targets cyber threats The U.S. State Department has officially launched the Bureau of Emerging Threats, a new unit tasked with protecting U.S. national security against cyber attacks against critical infrastructure, threats in the space domain, and misuse of artificial intelligence (AI) and other advanced technology risks from Iran, China, Russia, and North Korea.

Cybercrime kingpin extradited Li Xiong, the former chairman of a Cambodian financial conglomerate, HuiOne, has been extradited to China. He has been accused of operating gambling dens, fraud, unlawful business operations, and money laundering. According to Xinhua, Li is said to be a key member of the transnational cybercrime syndicate masterminded by Chen Zhi, the chairman of Prince Group, who was extradited to China in January 2026 and has been indicted by the U.S. for operating large-scale, forced-labor "pig butchering" scam compounds in Southeast Asia. In May 2025, the U.S. Treasury's Financial Crimes Enforcement Network labeled Huione Group "a financial institution of primary money laundering concern."

Gmail username change arrives Google said it's rolling out the ability to change a username to Google Account users in the U.S. "Your previous Google Account email ending in gmail.com will become an alternate email address," Google said in a support document. "You'll receive emails to both your old and new addresses. The data saved in your account won’t be affected. This includes things like photos, messages, and emails sent to your previous email address." While users can change back to their previous email address at any time, it's not possible to create a new Google Account email ending in gmail.com for the next 12 months. The new email address cannot be deleted either.

Court halts AI risk label A U.S. federal judge has temporarily blocked the Trump administration's designation of Anthropic as a supply chain risk. The AI company had argued that the designation was causing immediate and irreparable harm. "Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government," District Judge Rita Lin wrote in the ruling.

Phishing apps target mobile users Cybercriminals have set their sights on Android users through a new phishing scheme that disguises malicious applications as beta-testing opportunities for ChatGPT and Meta advertising tools. In these attacks, what appears to be an invitation to advertising apps turns out to be a carefully planned attempt to steal Facebook credentials and hijack control of user accounts. "These messages push malicious apps delivered through '[email protected]' via Firebase App Distribution, a legitimate Google service for distributing pre-release apps to testers," LevelBlue said. "Once installed, these apps request Facebook credentials, leading to phishing and account takeover." A similar campaign has leveraged phishing emails impersonating ChatGPT and Gemini to push users into downloading malicious iOS apps from the Apple App Store. "Disguised as business or ad management tools, these apps prompt for Facebook credentials, leading to credential harvesting," the company added.

Drive adds ransomware defense Google has made ransomware detection and file restoration in Drive generally available after launching the feature in beta in September 2025 to help organizations minimize the impact of malware attacks on personal computers. Ransomware detection pauses file syncing, and file restoration allows users to bulk restore their files to a previous version in Drive. "Compared to when the feature was in beta, we are now able to detect even more types of ransomware encryption."