Loading story…
Brazilian authorities are investigating a suspected cyberattack on the national Civil Defense alert network after unauthorized "extreme" emergency warnings were pushed to mobile phones across multiple regions. The false alerts, which included the word misanthropy/misantropi4, triggered loud alarm tones even on devices set to silent mode. Officials said at least 10 unauthorized messages were sent, including nine via cell broadcast and one by SMS, and confirmed there was no real public safety threat tied to the warning.
In response, Defesa Civil Nacional took its dispatch platform offline after detecting the breach, while authorities blocked external access to the Public Alert Dissemination Interface and launched a joint investigation involving the Federal Police and telecom regulator Anatel. Officials said the alerts were remotely triggered by someone outside the National System of Protection and Civil Defense, but added there is no evidence of structural damage to the core infrastructure. Brazil said the affected platform will be relaunched after security improvements, and a more secure replacement system was already under development.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Reporting cited vx-underground as attributing the fake Brazil emergency alerts to an individual using the name “mizanthropiaz.” The report also alleged the attacker exploited weak security controls and credentials exposed by infostealer malware on a government employee’s computer in 2016.
Authorities said the affected emergency alert platform was being restored after security checks following the suspected compromise. Officials also reported that a more secure dispatch system was being developed.
Brazilian authorities, including the Federal Police, began investigating suspected unauthorized remote access to the national emergency alert system. Officials said the alerts were triggered by someone outside the national civil defense network and stated there was no public safety threat or evidence of structural damage to core infrastructure.
Defesa Civil Nacional said it took its dispatch platform offline at 01:30 after detecting the breach. Authorities also blocked external access to the Public Alert Dissemination Interface while responding to the incident.
On June 20, unauthorized high-priority alerts were broadcast to mobile devices across multiple Brazilian regions through the Civil Defense alert system. Authorities said at least 10 false alerts were sent, including nine via cell broadcast and one via SMS, and the messages included the word "misanthropy."
The first fraudulent emergency alert in the Brazil Civil Defence system was reportedly issued in Paraná at about 23:40 on June 19, preceding the wider wave of false alerts sent across multiple regions. The message formed part of the same compromise that later broadcast 'misanthropy' alerts via cell broadcast and SMS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcehackread.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourcetheregister.com
Open sourcemalware.news
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious Android app masquerading as Bahrain Civil Defense's **"BH Alert"** emergency application is being distributed through fake Google Play pages and spoofed Bahraini government websites, with researchers saying the campaign is designed to exploit public anxiety during regional missile strikes and civil-defense alerts. Victims are reportedly lured via smishing, social media, and messaging links to sideload a rogue APK outside official app stores, where demand for emergency-alert apps has surged across Bahrain, Kuwait, and other Gulf states. Researchers at Dream Research Lab said the app uses a four-stage infection chain that deploys **OctagonPanel** malware and the **Ward** framework, giving attackers broad surveillance and remote-access capabilities. The malware can steal lock-screen PINs, one-time passwords, SMS messages, banking credentials, contacts, call logs, and screenshots, while also using banking overlays, Accessibility Services abuse, watchdog processes, boot receivers, runtime code injection, and RC4-encrypted payloads hidden in font files to maintain persistence and evade detection. Analysts warned that infected employee phones could help attackers bypass MFA and reach corporate applications, and recommended MDM controls to block sideloading, restrict app execution, and monitor for the malware's roughly five-second command-and-control heartbeat.
Jul 23, 2026
A ransomware attack targeted the OnSolve CodeRED emergency alert platform, operated by Crisis24, causing widespread outages for emergency notification services across numerous U.S. municipalities. The attack disrupted the ability of state, local, police, and fire agencies to send critical alerts, forcing affected regions to resort to alternative communication methods such as social media and door-to-door notifications. Municipalities including those in Colorado, Texas, Missouri, and many other states issued advisories to residents, warning of the service disruption and recommending immediate password changes for CodeRED accounts. Some municipalities, like Douglas County, Colorado, terminated their contracts with Crisis24, while others are awaiting the rollout of a new, more secure platform that Crisis24 claims is hosted in a separate, uncompromised environment. The attackers stole user data from the CodeRED system, including names, addresses, email addresses, phone numbers, and account passwords. Crisis24 confirmed that the stolen data was published online and emphasized that no financial information was compromised, as CodeRED does not collect such data. Forensic analysis indicated the breach was contained to the CodeRED environment, with no impact on other Crisis24 systems. Municipalities and law enforcement agencies across multiple states have notified residents and advised them to change any reused passwords. Crisis24 is working to bring a new version of the emergency alert platform online, following a comprehensive security audit and additional hardening measures.
Jun 29, 2026
Acronis researchers reported a deceptive Android campaign targeting Israeli users with a trojanized version of the *Red Alert* rocket-warning app distributed via SMS messages impersonating Israel’s Home Front Command. The fake app displays legitimate rocket alerts to reduce suspicion while requesting extensive permissions that enable **GPS tracking**, **SMS interception (including one-time passwords)**, contact harvesting, installed-app enumeration, and account discovery; collected data is exfiltrated to a remote server, and the operators used **certificate spoofing** to make the installation appear as if it came from Google Play. Separate consumer-focused advisories described multiple **social-engineering/phishing** lures delivered via text, email, and calendar invites: an “Amazon recall” SMS that pushes victims to a credential-harvesting site for “refunds,” an “Apple Security Alert” pop-up/text/email that attempts to drive victims to call a fraudulent support number or surrender credentials/2FA/payment details, and a trend of **fake calendar invitations** increasingly appearing in Microsoft Outlook (previously more common in Gmail) using urgent subjects (e.g., “Final Notice”) and domain-reconnaissance to personalize invites; the Outlook example noted mixed authentication signals (DMARC/SPF/DKIM pass/fail across relays), underscoring that users and defenders should treat unsolicited invites and urgent account/payment prompts as high-risk even when messages appear superficially legitimate.
Jun 29, 2026