Daily Briefing for 12.04.25

Top stories.

• Marquis breach affects dozens of banks and credit unions.
• Threat actor advertises plausible iOS chain exploit.
• ClayRat Android malware gets an upgrade.

Marquis breach affects dozens of banks and credit unions.

Financial software provider Marquis Software Solutions has disclosed a data breach affecting more than 400,000 customers from at least 74 banks and credit unions, BleepingComputer reports. The company said it sustained a ransomware attack on August 14th, 2025, after a threat actor compromised their SonicWall firewall. Marquis said in a filing with Maine's Attorney General that the affected data include "names, addresses, phone numbers, Social Security numbers, Taxpayer Identification Numbers, financial account information without security or access codes, and dates of birth."

Marquis hasn't attributed the attack to any particular group, but BleepingComputer notes that the Akira ransomware gang has been targeting SonicWall firewalls since September 2024.

Threat actor advertises plausible iOS chain exploit.

Dataminr warns that a threat actor is advertising a full-chain exploit that uses memory corruption vulnerabilities to achieve remote code execution on iOS 26. The threat actor has offered proof of the alleged exploit, and Dataminr describes the advertisement as "credible." The actor says the exploit uses memory corruption to run arbitrary code and links multiple vulnerabilities to achieve remote code execution, escape the app sandbox, and escalate privileges to full device control.

Full-chain iOS exploits are extremely valuable, and Dataminr notes that the Russian zero-day purchasing platform Operation Zero is offering up to $500,000 for iOS 26 exploits.

ClayRat Android malware gets an upgrade.

Zimperium is tracking a new variant of the ClayRat Android malware that abuses Accessibility Services to record PINs, place overlays, and create fake notifications. The malware can also harvest all notifications on the infected device. The researchers note, "Together, these capabilities make ClayRat a more dangerous spyware compared to its previous version where the victim could uninstall the application or turn off the device upon detecting the infection."

The malware is primarily distributed via phishing sites impersonating third-party versions of legitimate apps.