News & Protection
VPN and privacy news from the LiMP VPN team: data breaches, phone and account security, online scams, and practical advice on protecting your data in 2026.
RatHat Android Trojan Abuses ADB to Steal Banking PINs
Zimperium's zLabs discovered RatHat, an Android banking trojan that autonomously enables Wireless Debugging and connects to ADB to steal banking PINs, OTPs, and credentials — with AI-driven persistence that survives removal attempts.
LinkedIn Fake Recruiters Hide Malware in Developer Test Tasks
The Mirage Kitten APT poses as recruiters on LinkedIn, sending developers test assignments with NodeRabbit malware hidden in an npm package. The ban on AI assis…
Read more
First AI Agent Data Breach Officially Reported in 2026
Spain's AEPD logged the first confirmed personal data breach carried out by an autonomous AI agent — no human needed at any stage of the attack.…
Read more
Hackers Used AI to Scan 1.8M Android Apps for Secrets
ShinyHunters used an AI agent to scan 1.8M Android APKs for hardcoded secrets. The result: millions of payment records and over a terabyte of stolen data. What …
Read more
Hackers Hit Tez Tour: What the Attack Means for Travelers' Data
The DataSuckers group claimed to breach tour operator Tez Tour on 15 September 2026. We break down the risks to travelers' personal data and what you can do.…
Read more
TP-Link Tapo C200: Zero-Days Let Attackers Watch Your Home Camera
OPSWAT disclosed two Tapo C200 zero-days: an auth bypass gives admin access with no password, DoS crashes the feed. Update firmware to V5_1.4.6 now.…
Read more
CHOSEN BRICK: Iranian Spyware Reading Emails, Tapping Mics
UK NCSC, FBI and Netherlands AIVD warned about CHOSEN BRICK — Iranian state-linked spyware stealing emails, chat logs and activating microphones.…
Read more
Telegram Desktop Flaw Let Hidden Scripts Steal Chat History
ExPatch disclosed an XSS flaw in Telegram Desktop where bot messages hid JavaScript in chat exports, stealing message history when the HTML file was opened in a…
Read more
German Police Read WhatsApp and Signal Without Hacking
ZKA, Germany's customs police, has been officially reading WhatsApp, Signal and Telegram since August 2025 by cloning accounts — no encryption hacking needed.…
Read more
Microsoft September 2026: Record 974 CVEs and 2 Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, 2 actively exploited zero-days added to CISA KEV, and 20 wormable DNS bugs.…
Read more
Revolut Breach: Fraudsters Stole Passports and IBANs 2026
Fraudsters tricked Revolut via a fake government email, walking away with passports, IBANs and full transaction histories — no server hack required.…
Read more