Kaspersky has discovered a new multi-stage attack by the Head Mare APT group against organisations with PhantomCore and PhantomGraph backdoors. To deliver these backdoors, the attackers exploit vulnerabilities in unpatched TrueConf videoconferencing servers and can also replace TrueConf client installers with infected ones.

Kaspersky reported the attacks to the vendor; the vulnerabilities were fixed in the latest TrueConf Server update on June 18, 2026 (versions 5.3.9, 5.4.9, and 5.5.5).

To compromise the TrueConf server, attackers exploited a combination of two vulnerabilities (assigned internal Kaspersky identifiers are KLCERT-26-057 and KLCERT-26-058), which allowed the attackers to execute any code with maximum privileges. By exploiting these vulnerabilities, they replaced one of the server’s files with their own web shell.

The attackers then used this shell to collect information about the victim organisation’s IT infrastructure, gain privileged access to the TrueConf server database, and replace the client installer with an infected one. The attack applies to TrueConf servers in versions 5.3.X prior to 5.3.9, 5.4.X prior to 5.4.9, 5.5.X prior to 5.5.5, and earlier.

For users of TrueConf software, the attack looks like this: video conference participants connecting to the compromised server are prompted to download and install an “updated version” of the client application. In reality, as a result of this, malware gets onto the device.

Advertisement

“Exploiting vulnerabilities in popular services is one of the most common methods used by attackers. This campaign is particularly dangerous because it puts at risk not only organisations using unpatched TrueConf servers.

“Even if a company doesn’t use this solution, its employees can connect to compromised servers at the invitation of their counterparties to participate in online meetings. As a result, they may unknowingly download infected installation packages, creating the potential for compromising a large number of enterprises across different countries,” comments Evgeny Goncharov, Head of Kaspersky ICS CERT.

The 2026 FIFA World Cup, Africa Cup of Nations (AFCON), Iran-Israel conflict, and the controversy involving social media activist VeryDarkMan and businessman Blord dominated Google searches by Nigerians between January and July.

Google

This is contained in a review of anonymised Google Trends data released on Friday, which ranked the major stories that generated the highest search interest in Nigeria during the period.

The World Cup recorded the highest search volume, with Nigerians following the Super Eagles’ campaign, major matches, entertainment performances and developments throughout the tournament.

The data showed that searches around the tournament far exceeded those recorded for other major events during the seven-month period.

The Super Eagles’ AFCON semi-final defeat to Morocco also generated significant search interest, with “Nigeria vs Morocco” among the leading individual searches.

Senegal eventually won the AFCON title after defeating Morocco in the final on Jan. 18.

Advertisement

The 2026 Winter Olympics in Milan-Cortina, Italy, also attracted substantial interest from Nigerians in February, including searches around ice hockey and other events.

Google Trends data further showed increased searches around Iran and the Strait of Hormuz following the escalation of tensions in the Middle East.

Searches including “Iran news,” “Israel Iran war” and “Strait of Hormuz meaning” featured prominently as Nigerians sought information on the conflict and its possible impact on global oil prices.

The Strait of Hormuz is a major global oil transit route, carrying about one-fifth of the world’s oil supply.

The controversy involving cryptocurrency entrepreneur Blord and social media activist VeryDarkMan also maintained strong search interest for several months.

Advertisement

The saga peaked around Blord’s arrest and subsequent remand in Kuje prison in April, followed by his release on bail 16 days later.

Searches for “Who is Blord” also featured prominently, indicating growing interest among Nigerians seeking background information on the businessman.

The death of celebrities also generated significant search activity during the period.

Afro-fuji singer Destiny Boy, who died in January at the age of 22, remained in the news amid investigations into his death and an autopsy.

The death of American actor Eric Dane, known for his roles in Grey’s Anatomy and Euphoria, also generated substantial searches in February.

Advertisement

Similarly, the reported death of Nollywood actor Alexx Ekubo in May, at the age of 40, generated renewed search interest in June during his burial ceremonies.

Political and legal developments were also among the major subjects searched by Nigerians.

Former Minister of Power, Saleh Mamman, who was sentenced to 75 years in prison over an alleged N33 billion fraud, generated significant interest following his arrest by the Economic and Financial Crimes Commission (EFCC) in Kaduna in May.

The political crisis involving Mudashiru Obasa and his return as Speaker of the Lagos State House of Assembly also featured prominently.

Globally, Nigerians showed strong interest in the release of millions of pages of documents relating to the late American financier Jeffrey Epstein.

Advertisement

Meanwhile, internet culture accounted for some of the lighter moments in the search rankings.

The Gen Z meme “67” became one of the most searched terms in January, generating curiosity among older Nigerians over its meaning.

The trend originated from a U.S. rap song and became popular among young people, with the phrase often used without a specific meaning.

In April, the case involving Opeyemi Awodoyin, an OPay customer who reportedly received N100,000 in error and declined to return the money, also attracted widespread online interest and public debate.

The reported hantavirus outbreak aboard a cruise ship further prompted Nigerians to search for information about the disease in May.

Advertisement

Celebrity-related stories also featured prominently in the rankings.

Veteran broadcaster Frank Edoho’s confirmation of his divorce and subsequent allegations involving his former wife generated considerable search interest in May.

In July, music promoter Sam Larry survived a road crash on the Lagos-Calabar Coastal Road which reportedly claimed the life of his bodyguard, leading to renewed online discussions around the late singer Mohbad.

In the entertainment sector, Wizkid and Asake’s “Jogodo” dominated searches around January, while Asake’s album generated renewed interest in May.

The 2026 Grammy Awards also attracted substantial search traffic, with Nigerians searching for winners and other developments from the ceremony.

Advertisement

Bad Bunny’s Super Bowl halftime performance also generated significant interest, while films including Mortal Kombat 2 and Christopher Nolan’s The Odyssey featured among popular entertainment searches.

Footballer Zadok Yohanna’s reported €28 million transfer to Brighton also attracted attention, particularly among Nigerian football followers.

Commenting on the findings, Taiwo Kola-Ogunlade, Communications and Public Affairs Manager, West Africa, Google, said search data provided an insight into issues commanding Nigerians’ attention.

“Search data is the most honest record of national attention we have, because nobody performs for a search bar,” he said.

According to him, Nigerians did not only consume major stories but actively searched for explanations and context surrounding them.

Advertisement

The rankings were based on peak monthly search interest in Nigeria between January and July 2026, with related queries grouped together.

The top 25 trending searches during the period included the FIFA World Cup 2026, 2026 Winter Olympics, AFCON Nigeria vs Morocco, Iran and the Strait of Hormuz, Blord, Alexx Ekubo, “67”, Destiny Boy, Erling Haaland and France’s World Cup campaign.

Others were the Grammy Awards 2026, Epstein files, hantavirus, Saleh Mamman, Obasa impeachment saga, Sam Larry, Shakira and Burna Boy’s World Cup performance, Zadok Yohanna, Eric Dane, Opeyemi Awodoyin, Bad Bunny’s Super Bowl halftime show, Frank Edoho, Mortal Kombat 2, The Odyssey and “Jogodo” by Wizkid featuring Asake.

Google Trends provides access to an anonymised sample of search requests made to Google and categorises the information to show collective search interest across regions and over time.

Advertisement

Kaspersky’s latest survey highlights a protection gap between macOS and Windows based devices. While macOS has long been regarded as the more secure operating system, 12% of its users reported malware infections compared with 9% of Windows users. Moreover, only 35% of macOS owners install dedicated security software, versus 42% of Windows users.

According to Kaspersky’s latest global survey*, Windows users report a higher adoption rate for most security measures, while macOS users show a modest advantage in a few privacy‑focused actions. At the same time, during the past year macOS users reported higher percentages than Windows users for a number of cybersecurity incidents.

The largest gap in cybersecurity approaches appears in the habit of not opening suspicious emails or links, with 62% of Windows users following this practice compared to 51% of macOS users.

What’s more, when it comes to cybersecurity software installation, macOS users are also lagging behind. While among Windows users  42% reported using digital‑life‑protection software, for macOS this rate is only 35%, what Kaspersky security experts call a worryingly low figure.

It is noteworthy that 12% of macOS respondents said they fell victim to phishing (fake emails, websites or messages) over the past year compared with 9% of Windows users. Moreover, during this period macOS users faced more scams and investment frauds (16% vs 13%), privacy violations (11% vs 8%) and thefts of personal data (12% vs 7%).

Advertisement

To counter these specific threats, robust anti-malware and anti-phishing protection is essential. Malware authors put a lot of effort into developing new, more powerful and stealthier versions of stealers, spies and other classes of malicious payloads, while relying on phishing techniques that allows them to get access to user’s data.

Dedicated security solutions add a crucial layer of real-time detection and defence that complements macOS’s built-in protection – and independent tests have repeatedly shown that effective options, such as Kaspersky Premium for macOS, deliver strong protection. In 2025, AV-TEST recognised it as the top-performing macOS security solution based on consistent, reliable results across a full year of evaluations.

When it comes to credentials and passwords safety, Windows users also show better security practices’ adoption rates. They lead in using a unique password for each account (38% vs 35%) and complex passwords (52% vs 45%), two‑factor or multi‑factor authentication (51% vs 46%).

Adopting a dedicated password manager becomes a logical next step. Such tools store all credentials in a secure vault protected by a single master password, eliminating the need to remember hundreds of passwords while keeping them safe from breaches.

They also support modern authentication methods like passkeys, enabling seamless, single-tap sign-in across all devices through secure synchronisation – capabilities offered by solutions such as Kaspersky Password Manager.

Advertisement

“There are entrenched stereotypes that macOS is inherently more secure because its user base is smaller, leading cyber‑criminals to deem it a lower‑value target, or because the platform itself includes many robust security features. While these observations are not entirely unfounded, the threat landscape has evolved dramatically.

Attackers actively employ phishing and commit supply chain attacks, which often allow them to affect users of any operating system in a single malware campaign. Moreover, mac specific malware is not rare and there are many malware families that target macs exclusively. Consequently, any device with an Internet connection, regardless of its operating system or form factor, requires cybersecurity software to defend against a wide range of cyber threats,” comments Sergey Puzan, cybersecurity expert at Kaspersky.