CERT Polska Archives • Daily CyberSecurity

Android Toll Fraud Malware Found on Google Play

Diagram of the Google Play Android toll fraud malware infection chain showing how Android toll fraud malware executes

Android Toll Fraud Malware Found on Google Play

Do Son September 29, 2026

Security teams uncovered Google Play Android toll fraud malware. Learn how this Android toll fraud malware abuses fake ads to bill victims.

MikroTrick PoC: RouterOS Admin Rights Exploited In Wild MikroTik RouterOS MikroTrick vulnerability chain exploited in the wild for full administrative privileges via SSH, with public PoC exploit code

MikroTik RouterOS MikroTrick vulnerability chain exploited in the wild for full administrative privileges via SSH, with public PoC exploit code

MikroTrick PoC: RouterOS Admin Rights Exploited In Wild

Do Son September 7, 2026

The MikroTrick PoC is publicly disclosed. This MikroTrick RouterOS flaw is actively exploited in the wild, granting full administrative privileges.

GNU gzip Vulnerability Allows gzexe Symlink Overwrite

Do Son July 2, 2026

A GNU gzip vulnerability (CVE-2026-41991) lets a local attacker overwrite files through a gzexe symlink attack. Update to the patched gzip release now.

UNC1151 ‘Ghostwriter’ Phishing Campaign Hijacks Gmail Accounts and 2FA Codes UNC1151 Gmail phishing fake Google login page stealing 2FA codes by Ghostwriter

UNC1151 Gmail phishing fake Google login page stealing 2FA codes by Ghostwriter

UNC1151 ‘Ghostwriter’ Phishing Campaign Hijacks Gmail Accounts and 2FA Codes

Do Son June 19, 2026

The UNC1151 Gmail phishing campaign by Ghostwriter steals passwords and 2FA codes from Polish targets via fake Google login pages. Stay alert.

The CAPTCHA Trap: How a Fake “ClickFix” Prompt Unleashed Latrodectus & Supper Malware ClickFix CAPTCHA Latrodectus Malware

The CAPTCHA Trap: How a Fake “ClickFix” Prompt Unleashed Latrodectus & Supper Malware

Do Son February 23, 2026

CERT Polska reveals how a fake "ClickFix" CAPTCHA campaign tricked users into deploying evasive Latrodectus and Supper malware. Protect your network now.

Grid Sabotage: “Static Tundra” Hits Poland’s Energy Sector with DynoWiper DynoWiper Malware Middle East Cyberwar, Cyber Operations

Grid Sabotage: “Static Tundra” Hits Poland’s Energy Sector with DynoWiper

Do Son February 3, 2026

CERT Polska reveals destructive attacks on energy infrastructure. "Static Tundra" used DynoWiper and LazyWiper to brick OT devices. Read more.

Unpatched & Exposed: Legacy Vivotek Cameras Broadcast Live Video to All

Fortra BoKS vulnerability OS command injection, CVE-2026-9862 Altium Enterprise Server Vulnerability CVE-2026-9129 Path Traversal Patreon OAuth Vulnerability Identity Collision DRC INSIGHT Vulnerability Exam Data Hijacking Horner Automation PLC Industrial Brute Force Honeywell IQ4x Vulnerability CVE-2026-3611 DJI Romo vacuum security flaw Python Cryptography Vulnerability CVE-2026-26007 Open5GS Vulnerability CVE-2026-0622 Vivotek IP7137 Vulnerabilities CVE-2025-66049 Forcepoint DLP Vulnerability CVE-2025-14026 Cellopoint Secure Email Gateway - CVE-2024-9043

Unpatched & Exposed: Legacy Vivotek Cameras Broadcast Live Video to All

Do Son January 12, 2026

Critical unpatched flaws in Vivotek IP7137 cameras allow unauthorized live streaming (CVE-2025-66049). Disconnect these EOL devices immediately.

NGate NFC Malware Steals Cash from ATMs by Relaying EMV Data and PINs from Victim’s Phone NGate NFC Relay, ATM Cash-Out

NGate NFC Malware Steals Cash from ATMs by Relaying EMV Data and PINs from Victim’s Phone

Do Son November 5, 2025

CERT Polska exposed NGate, an Android malware that tricks users into tapping their card against their phone to steal NFC EMV data and PINs. The data is then relayed to an ATM for cash withdrawal.

UNC1151 Exploits Roundcube Flaw in Spear Phishing Attack Roundcube SVG XSS, HTML Style Sanitizer Roundcube Phishing Roundcube webmail vulnerability

Roundcube SVG XSS, HTML Style Sanitizer Roundcube Phishing Roundcube webmail vulnerability

UNC1151 Exploits Roundcube Flaw in Spear Phishing Attack

Do Son June 9, 2025

CERT Polska warns of a critical Roundcube XSS flaw (CVE-2024-42009) exploited by UNC1151 in spear phishing, stealing credentials and compromising Polish organizations.