Ghost Poster and Kimwolfe Highlight Browser and Botnet Risks

Summary

Security Now examines the Ghost Poster Firefox extension, the Kimwolfe Android botnet, cryptocurrency theft attributed to North Korea, and cryptomining attacks against AWS accounts and exposed Docker APIs.

Key points

• The hosts report that Ghost Poster hides malicious code in a Firefox extension’s PNG icon and has affected 50,000 users.
• Chainalysis estimates that North Korean hackers stole $2.02 billion in cryptocurrency in 2025, with the Bybit theft heavily influencing the total.
• An AWS cryptomining campaign used compromised IAM credentials and enabled EC2 termination protection, complicating response.
• Trend Micro observed attackers using gRPC over h2c against Docker remote APIs to deploy cryptominers. The hosts recommend restricting and securing remote access.
• Researchers estimate that Kimwolfe has infected more than 1.8 million devices, primarily Android TV boxes; its propagation path remained unclear.
• Kimwolfe supports proxying, reverse shells and DDoS attacks. Researchers estimated its attack capacity near 30 terabits per second, but could not directly measure it.

MITRE ATT&CK

Malware

Vendors

Related Articles

• CrowdStrike 2026 Threat Hunting Report Highlights Faster Exploitation and Rising Identity Attacksgithub.com/jacobdjwilsonT1078.004 · T1496
• Toc Consulting’s 2026 AWS Security Report Examines IAM and Agentic AI Risksgithub.com/jacobdjwilsonT1078.004 · T1496
• Datadog Tracks AI-Assisted Credential-Harvesting Platforms and AWS Abusesecuritylabs.datadoghq.comT1078.004 · T1496
• Attackers Hijack AWS Bedrock Access Using Stolen IAM Credentialsfeeds.fortinet.comT1078.004 · T1496
• Shai Hulud-Linked Intrusion Escalated From Jenkins Credentials to AWS Redshift Data Theftfeeds.fortinet.comT1078.004 · T1496