ThreatsDay Roundup: Smart TV Proxyware, curl and Hoppscotch Flaws, and Malware Campaigns
Summary
This weekly roundup covers curl and Hoppscotch flaws, proxyware in LG and Samsung TV apps, credential theft and malware campaigns, a legacy credential used to steal Salesforce data, and law-enforcement developments.
Key points
- AISLE reported six curl vulnerabilities, including CVE-2026-8932; the flaws were fixed in curl 8.21.0.
- An unauthenticated Hoppscotch flaw could enable server takeover and persistent access; the issue was fixed in hoppscotch-backend 2026.5.0.
- Spur found proxyware in 2,058 of 6,038 reviewed LG webOS and Samsung Tizen apps, allowing third-party traffic to use TV owners’ residential connections.
- Zscaler reported that an actor affiliated with Payouts King used Microsoft Teams social engineering and the Edgecution extension to gain host access and run commands.
- A macOS ClickFix campaign delivered an information stealer assessed as part of the Atomic macOS Stealer lineage; separate reporting described BitB lures used to distribute malware and steal credentials.
- Klue said a credential from a 2022 pilot was exploited by Icarus extortionists to steal Salesforce data; several companies confirmed limited Salesforce information was stolen.
- Two people were convicted for the 2024 Transport for London cyberattack, while a separate alleged cybercrime marketplace administrator was extradited to the U.S.
Article Details
- Event Type
- Cybersecurity news roundup covering vulnerability disclosures, proxyware in smart TV apps, phishing and malware campaigns, data theft, cybercrime prosecutions, and a bot-detection protocol.
- Impact
- The Hoppscotch flaw could allow unauthenticated attackers to take over self-hosted servers and retain access after password resets; it was fixed in hoppscotch-backend 2026.5.0. Six curl vulnerabilities were fixed in curl 8.21.0. Proxyware in reviewed LG and Samsung smart TV apps can relay third-party traffic through residential connections. Other reported incidents include Salesforce data theft using a legacy credential, a TfL cyberattack with $38.2 million in losses, and campaigns targeting credentials, host access, and sensitive data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | www[.]market0day[.]com | Cybercrime marketplace that Abdellah Belmili is alleged to have administered; the article also says he created phishing kits used to compromise financial institutions. |
| HOSTNAME | www[.]spoxy[.]us | Marketplace Belmili said he had opened and advertised as a bulk-SMS store; the article notes bulk SMS typically refers to phishing or other fraudulent messages. |
CVE
CVE-2026-50160A critical security flaw has been disclosed in self-hosted versions of Hoppscotch(CVE-2026-50160, CVSS score: 10.0), an open source API platform, that can result in complete compromise.CVE-2026-8932a connection, credential, or host identity is still valid.” One of the notable vulnerabilities is CVE-2026-8932, which allows the library to “reuse a previously created connection even when some mTLS config-related
People
Threat Actors
Abdellah BelmiliArrested, charged, and extradited to the U.S. on bank-fraud conspiracy charges; he is alleged to have administered a cybercrime marketplace and created phishing kits. The article gives Dila Belmili and SPOX as aliases.Dila BelmiliAlias the article gives for Abdellah Belmili, who is alleged to have administered a cybercrime marketplace and created phishing kits.Icarus extortionistsReportedly exploited a legacy credential to steal Salesforce data from Klue's corporate customers.Owen FlowersConvicted in the U.K. for participating in the 2024 cyberattack on TfL; the article identifies him as a member of Scattered Spider.Payouts KingA reported initial access broker affiliated with Payouts King ransomware used Microsoft Teams social engineering to deliver the Edgecution extension.Scattered SpiderThe article identifies this online criminal collective as engaging in data extortion and social engineering. Thalha Jubair and Owen Flowers, described as members, were convicted in connection with the 2024 cyberattack on TfL.SPOXAlias the article gives for Abdellah Belmili, who is alleged to have administered a cybercrime marketplace and created phishing kits.Thalha JubairConvicted in the U.K. for participating in the 2024 cyberattack on TfL; the article identifies him as a member of Scattered Spider.UNC6508GTIG attributed a year-plus espionage campaign against North American academic, medical, and military research institutions to this China-nexus actor; the campaign used exposed REDCap servers to deploy INFINITERED.
Malware
ApexAIgenerative AI tools, advertising solutions that can enhance social engineering, AI-enabled malware (e.g., ApexAI, Metatron, and PolyEngine), discussing jailbreaks for public AI models to bypass censorship and otherAtomic macOS Stealer (AMOS)The stealer is assessed to belong to the Atomic macOS Stealer (AMOS) lineage, particularly a variant called Odyssey, per Palo Alto Networks Unit 42.Edgecution#curlINFINITEREDThe intrusion set leveraged internet-facing REDCap servers as an initial access vector to deploy a backdoor called INFINITERED to exfiltrate sensitive data.MetatronAI tools, advertising solutions that can enhance social engineering, AI-enabled malware (e.g., ApexAI, Metatron, and PolyEngine), discussing jailbreaks for public AI models to bypass censorship and other safeguardsOdyssey#curlPolyEnginesolutions that can enhance social engineering, AI-enabled malware (e.g., ApexAI, Metatron, and PolyEngine), discussing jailbreaks for public AI models to bypass censorship and other safeguards using techniquesSNOWBELTA similar attack chain involving a Chromium-based extension codenamed SNOWBELT was detailed by Google-owned Mandiant in April 2026.
Vendors
Bright DataBright Data, Massive, and Oxylabs take up the top three SDK providers for webOS and Tizen.CloudflareCloudflare, Google Chrome, Microsoft Edge, and Mozilla Firefox are backing PACT for privacy-preserving bot detection.GoogleCloudflare, Google Chrome, Microsoft Edge, and Mozilla Firefox are backing PACT for privacy-preserving bot detection.LGThis roundup also covers new flaws in curl and Hoppscotch, proxyware found in LG and Samsung smart TV apps, and campaigns using Microsoft Teams, ClickFix, BitB, and Browser-in-the-Browser to deliver malware and stealMassiveBright Data, Massive, and Oxylabs take up the top three SDK providers for webOS and Tizen.Microsoftnew flaws in curl and Hoppscotch, proxyware found in LG and Samsung smart TV apps, and campaigns using Microsoft Teams, ClickFix, BitB, and Browser-in-the-Browser to deliver malware and steal data.MozillaCloudflare, Google Chrome, Microsoft Edge, and Mozilla Firefox are backing PACT for privacy-preserving bot detection.OxylabsBright Data, Massive, and Oxylabs take up the top three SDK providers for webOS and Tizen.SamsungThis roundup also covers new flaws in curl and Hoppscotch, proxyware found in LG and Samsung smart TV apps, and campaigns using Microsoft Teams, ClickFix, BitB, and Browser-in-the-Browser to deliver malware and steal
Products
curlThis roundup also covers new flaws in curl and Hoppscotch, proxyware found in LG and Samsung smart TV apps, and campaigns using Microsoft Teams, ClickFix, BitB, and Browser-in-the-Browser to deliver malware and stealHoppscotchThis roundup also covers new flaws in curl and Hoppscotch, proxyware found in LG and Samsung smart TV apps, and campaigns using Microsoft Teams, ClickFix, BitB, and Browser-in-the-Browser to deliver malware and stealLG webOSThe company said it scanned 6,038 apps across LG webOS and Samsung Tizen and found 2,058 that contain residential proxy software.Microsoft EdgeCloudflare, Google Chrome, Microsoft Edge, and Mozilla Firefox are backing PACT for privacy-preserving bot detection.Microsoft Teamsflaws in curl and Hoppscotch, proxyware found in LG and Samsung smart TV apps, and campaigns using Microsoft Teams, ClickFix, BitB, and Browser-in-the-Browser to deliver malware and steal data.REDCap#curlSalesforceto 2022, which was used as part of a limited pilot, was exploited by the Icarus extortionists to steal Salesforce data from its corporate customers, including several cybersecurity companies.Samsung TizenThe company said it scanned 6,038 apps across LG webOS and Samsung Tizen and found 2,058 that contain residential proxy software.
Countries
ChinaLast week, Google Threat Intelligence Group (GTIG) attributed a year-plus espionage campaign against North American academic, medical, and military research institutions to UNC6508, a China-nexus actor.SpainAbdellah Belmili (aka Dila Belmili or SPOX), a 26-year-old Algerian national, has been arrested, charged, and extradited from Spain to the U.S.United KingdomThalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, have been convicted in the U.K.United Statesto obtain credentials, install remote access tools, and/or bypass multi-factor authentication,” the U.S.
Industries
Cybersecurityby the Icarus extortionists to steal Salesforce data from its corporate customers, including several cybersecurity companies.MilitaryLast week, Google Threat Intelligence Group (GTIG) attributed a year-plus espionage campaign against North American academic, medical, and military research institutions to UNC6508, a China-nexus actor.