How Androxgh0st rose from Mozi's ashes to become 'most prevalent malware'

Androxgh0st, a cloud credential-stealing botnet that has integrated Mozi IoT-infection capabilities, has rapidly expanded in late 2024 to target Windows, macOS, Linux systems, web servers, routers, firewalls, and other IoT devices by exploiting dozens of CVEs; Check Point reported it affected ~5% of organizations in November and security firms and US agencies warn of large-scale exploitation and suspected Chinese state-linked use for surveillance, theft, and DDoS operations.