⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, Air Snitch Attack & Vibe-Coded Malware
Summary: A coalition of security companies and law enforcement agencies dismantled the infrastructure behind Tycoon 2FA, which Europol described as among the largest adversary-in-the-middle phishing operations worldwide, and authorities also took down LeakBase, one of the largest forums for buying and selling stolen data and cybercrime tools. The same week's critical vulnerability list included CVE-2026-21385 in Qualcomm, CVE-2026-2796 in Mozilla Firefox, three flaws in Google Chrome (CVE-2026-3536, CVE-2026-3537, CVE-2026-3538), three in Amazon AWS-LC (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338), and a privilege escalation flaw in IPVanish VPN for macOS.
What you should know: The article notes that takedowns like Tycoon 2FA and LeakBase typically create only short-term disruptions, because the ecosystem adapts by migrating to other forums or more resilient channels such as Telegram - so the phishing-as-a-service capability that democratized AitM attacks for a modest subscription fee does not go away with the infrastructure.
Read the original at The Hacker News ↗
- Topics
- Cybercrime & Law Enforcement
- Mentions
- CVE-2025-13476CVE-2025-14500CVE-2025-34288CVE-2025-67736CVE-2026-20079CVE-2026-21385CVE-2026-2256CVE-2026-23600CVE-2026-24009CVE-2026-25611CVE-2026-26198CVE-2026-27636CVE-2026-2796CVE-2026-27966CVE-2026-27970CVE-2026-28289CVE-2026-29058CVE-2026-3336CVE-2026-3337CVE-2026-3338CVE-2026-3536CVE-2026-3537CVE-2026-3538
- Related
- CVE-2026-20079: Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026CVE-2026-21385: Qualcomm Multiple Chipsets Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 03, 2026