Carrier-grade MikroTik routers are delivering potentially millions of daily cryptomining pages to the attacker.

In an unusual move, Metamorfo abuses legitimate, signed Windows binaries to load the malicious code.

Mike Mimoso, Chris Brook, and Threatpost’s newest reporter, Tom Spring, discuss the week in news, including a first hand account of an online casino’s experience with a Teslacrypt infection, Brazil shutting down WhatsApp, and attackers mining an ADP portal for W-2s. Download: Threatpost_News_Wrap_May_6_2016.mp3 Music by Chris Gonsalves

WhatsApp’s presence in Brazil has been rocky at best from a legal standpoint, but it got even more tenuous this week when for the second time in the last six months a judge ordered the country’s telecommunications companies to block the messaging app. The judge demanded that WhatsApp be blocked for 72 hours after WhatsApp’s...

Following an appeal from WhatsApp’s lawyers, on Tuesday afternoon a Brazilian judge overturned a suspension previously handed down this week that would’ve blocked usage of the messaging app for 72 hours. According to Reuters, on Tuesday afternoon a “different judge from the state tribunal intervened” and canceled Monday’s ruling. WhatsApp’s presence in Brazil has been...

A new run of Spy Banker banking malware infections has been targeting Portuguese-speaking victims in Brazil. While Spy Banker is an old threat, dating back to 2009 according to some security companies, the latest wrinkle attackers are taking is a new one. The campaign, spotted by researchers at Zscaler, spreads primarily over social media—Facebook for...