Agent Smith afflicts Android users. Magecart scans for S3 buckets. FinSpy in the wild. A US Navy contractor gets phished.

Check Point is tracking “Agent Smith,” Android malware that replaces legitimate apps with simulacra that carry adware. According to ZDNet, researchers have traced the operators behind Agent Smith to a company based in Guangzhou. It appeared originally in the third party app store, 9Apps, but it appears to be working toward establishing a foothold in Google Play as well. Most of its twenty-five-million victims so far have been in India, Bangladesh, and Pakistan.

RiskIQ reports that the online card-skimmers of Magecart are actively looking for unsecured AWS S-3 buckets. The gang has spread its skimmer code to some seventeen-thousand domains over recent months, WIRED notes. They've gone for reach, and not targeting.

Forbes reports that Kaspersky has found new infestations of FinSpy in the wild, suggesting that the spyware continues to find users among governments in many corners of the world.

An unnamed US defense contractor was induced to send sensitive, highly classified communications intercept equipment worth about $3 million dollars to an international criminal gang. A search warrant request the US Department of Homeland Security filed with the United States District Court for the District of Maryland revealed the details. Homeland Security Investigations asked for Apple iCloud information pertaining to four email accounts of interest. The incident appears to have been a phishing scam executed by hoods posing as a fictional US Navy contracting officer, "Daniel Drunz." In addition to the communications intercept gear, the gang also stole $6.3 million in televisions and $1.1 million in iPhones and iPads.