200 Android Flaws, Browser-Constructed Phishing, 119K Rip-off Outlets + 23 Extra Tales

A set of 4 malicious Google Chrome and Mozilla Firefox extensions has been discovered to focus on Axiom Commerce and Padre customers to steal session tokens and pockets information. The extensions are J7Tracker (Chrome), VREO (Chrome and Firefox), and Orbit Tracker (Firefox). Whereas the primary three include the identical Axiom and Padre assortment module, the fourth implements a distinct collector however targets the identical information, whereas retaining some artifacts from J7Tracker. “The module is byte-identical throughout all three analyzed extensions. It robotically retrieves authenticated consumer data, wallet-related bundle information, Firebase entry tokens, and software state, then sends the knowledge to risk actor-controlled Vercel deployments,” Socket stated. The identical Chrome writer has been traced again to 2 earlier extensions, GhostApe and GhostApe Coloration, impersonating the MockApe buying and selling add-on.

A Chinese language-speaking operator has been noticed utilizing Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions in opposition to authorities and monetary methods in Afghanistan, Thailand, Taiwan, and the U.S. A few of the targets included Taiwan’s Kuomintang Get together Historical past Archives, Indonesia’s Ministry of Overseas Affairs, authorities and schooling methods in mainland China, and industrial hosts in Da Nang, Vietnam. The attacker is alleged to have used SecFlow, an AI orchestration framework, to transform “marketing campaign targets into duties for specialised AI brokers” and provide them with instruments, goal data, shared storage, and community routes, Hunt.io stated, including the software “break up reconnaissance, exploitation, assortment, and reporting amongst specialist employees.” A few of the vulnerabilities exploited by the risk actor are Shellshock, Spring4Shell, Ghostcat, Shiro deserialization, Log4Shell, Grafana and Nexus path traversals, and a Nacos authentication bypass. The exploitation is adopted by the deployment of internet shells, that are generated by means of a devoted GLUTTON functionality, and used to facilitate follow-on actions, like reconnaissance, privilege escalation, credential theft, and customized implant deployment. One such backdoor is SecBox, a Go-based remote-access and network-pivot framework. Particulars of the marketing campaign first got here to gentle in July 2026.

The U.Ok.’s Nationwide Cyber Safety Heart (NCSC) has warned that workers utilizing unapproved AI instruments can expose delicate company information and create safety dangers that organizations might wrestle to detect and handle. “Offering shadow AI entry to firm or buyer information doubtless will increase the chance of information breaches, mental property loss and failure to satisfy regulatory necessities,” NCSC stated. “Staff who switch delicate or proprietary data to shopper AI providers will doubtless cut back the group’s visibility and management over that data. AI brokers are complicated items of software program that may have vital safety vulnerabilities. If an attacker efficiently exploits a vulnerability, they will achieve entry to the identical information, providers, and privileges that the agent has respectable entry to.”

Attackers are masquerading as executives and tricking targets in authorized groups into transferring conversations to WhatsApp and private electronic mail with an intention to provoke worldwide wire transfers utilizing solid acquisition paperwork as a part of a merger and acquisition rip-off. “The attackers introduced the acquisition as a tightly managed transaction coordinated by a good adviser, with solely a small group concerned and an announcement approaching quick,” Gen Digital stated. “The organizations and professions assorted. The targets included senior folks in non-public fairness, industrial finance, gross sales, mining and power. For every of them, an acquisition or strategic funding narrative would have been credible sufficient to justify preliminary engagement. Regardless of the totally different branding, the paperwork adopted considerably the identical sequence of sections and reused the identical authorized language. All of them imposed confidentiality, directed communications in the direction of WhatsApp and private electronic mail, and launched a brief interval between the NDA date and the supposed public announcement.”

Microsoft is including new age-awareness APIs referred to as the Home windows Age API to Home windows 11 that can permit apps to find out whether or not a consumer is a baby, teenager, or grownup with out exposing their precise date of delivery. “Apps obtain solely the age-related sign wanted for the expertise and never delicate private information comparable to full date of delivery,” Microsoft stated. “By making age consciousness obtainable as a platform functionality, Home windows helps builders construct safeguards into experiences from the beginning slightly than putting the burden on youngsters and households to handle protections app by app.”

An enormous operation dubbed DoppelCart is utilizing greater than 119,000 domains to run a community of faux e-commerce outlets that steal cost card particulars. The websites mimic respectable companies by copying product catalogs, descriptions, branding, and pictures, typically even loading property instantly from the true firm’s servers. In all, the outlets mimic 44,182 totally different manufacturers, with a median of two clones for every. “Every copies an actual model’s pictures and web page textual content, then undercuts its costs,” Netby stated. “Every additionally republishes the model’s personal assist tackle, so the individuals who get charged complain to the model, not the store.”

Google has formally shifted to a two-week cadence for main Chrome milestones, with weekly safety updates, in response to a shifting cybersecurity panorama within the AI period. The shift is pushed by LLM-assisted vulnerability discovery approaches, which have elevated the quantity of patches and updates throughout the software program ecosystem. “Whereas this dramatic change in software program safety led to by LLMs may be startling, a rise in bugs discovered and glued is just not an indication of failure,” Google stated. “Each bug discovered and glued is one much less foothold for an attacker. However discovering and fixing a bug is just half the battle — we should additionally ship the repair and apply the replace for customers sooner than adversaries can exploit the bug.” The thought, subsequently, is to shrink the window between pushing a repair in a public codebase and getting that repair to finish customers earlier than it may be exploited. A shorter launch cycle would scale back the patch hole – the timeframe between when a safety vulnerability is understood and when it will get addressed. Google moved to a four-week launch cycle for Chrome in 2021, down from six weeks. Related strikes have been adopted by different browser makers like Microsoft, Mozilla, and Courageous.

Google has launched patches for 200 vulnerabilities as a part of the September 2026 Android safety updates. This consists of numerous vital and high-severity vulnerabilities, together with those who may permit attackers to remotely execute code with out consumer interplay. One of many flaws value highlighting is CVE-2026-28662, a vital Wi-Fi-related bug that would doubtlessly permit an attacker to realize distant code execution. “Most regarding from this listing is CVE-2026-28662 as a result of it is a Wi-Fi-related reminiscence corruption flaw,” Adam Boynton, enterprise technique supervisor at Jamf, stated. “If left unpatched, it may allow attackers to execute code remotely, with none extra privileges or consumer interplay, doubtlessly permitting privilege escalation. This vulnerability will solely proceed to pose a danger if units are left unpatched. It is essential that organizations problem the updates throughout their gadget fleet as quickly as potential.”

Singapore police officers have arrested two male Chinese language Malaysians, aged 25 and 47, for his or her alleged involvement in a coordinated scheme that compromised the Singpass accounts of Singapore residents and work allow holders. “Investigations revealed that the 2 males have been workers of a cell phone store positioned in Singapore,” authorities stated. “They allegedly exploited alternatives arising from their work to entry clients’ Singpass accounts. In a single such event, when a buyer was buying a brand new SIM card, one of many males allegedly supplied to assist replace the cell quantity linked to the client’s Singpass account, earlier than utilizing this chance to create a LiquidPay account with out the client’s data.” Investigations have uncovered over 170 Singapore residents and international employees whose Singpass accounts have been linked to the identical exercise. The fraudulent Singpass accounts have been then used to register for greater than 160 extra LiquidPay accounts.

Cryptocurrency {hardware} pockets maker Trezor has warned clients to be looking out for phishing assaults after its third-party electronic mail supplier Brevo was breached. The incident impacted 120 Brevo accounts, together with Trezor’s. “Please bear in mind that the e-mail named ‘Crucial Safety Alert: STM32 Entropy Vulnerability’ is just not coming from us, and it is a phishing try,” it stated. Don’t click on on any hyperlink. The incident affected our opt-in e-newsletter database, roughly 347,000 electronic mail addresses. These addresses may be doubtlessly used for different phishing assaults sooner or later.” The Brevo account has been suspended to forestall the risk actors from abusing it to ship phishing emails. The phishing electronic mail despatched from the account contained a malicious hyperlink that instructed customers to obtain an app that requested them to enter their pockets backup. The area has since been taken down.

An assault marketing campaign that installs EtherRAT by way of a malicious MSI installer masquerading as a Sysinternals software has been discovered to ship an AI-generated malware framework referred to as TukTuk and GoTo Resolve. Utilizing the entry supplied by the distant entry software program, the risk actor is alleged to have efficiently exfiltrated information to a cloud service and deployed The Gents ransomware. “TukTuk can use Arweave as a dead-drop resolver,” the DFIR Report stated. “On this mode, the implant queries the Arweave blockchain for a particular Drive-Id, then retrieves an encrypted configuration blob. That blob accommodates the credential pool for all supported C2 transports. After execution of TukTuk, the risk actor started hands-on-keyboard exercise, Kerberoasting operations, and credential discovery focusing on administrative accounts. Subsequent, the risk actor leveraged compromised service account credentials to deploy GoTo Resolve distant administration tooling laterally throughout a number of methods, together with servers and area controllers.”

The U.S. Cybersecurity and Infrastructure Safety Company (CISA) has launched an up to date model of its Insider Menace Mitigation Information to spotlight the “rising influence insider threats have on vital infrastructure, the dynamic and evolving operational panorama, and supply new use instances to assist organizations tackle new challenges.” A few of the key updates relate to rising office tendencies comparable to elevated hybrid and distant work, using AI for manipulation and deception, entry management, and customer screening.

James Strahler II, 37, of Columbus, has been sentenced within the U.S. to fifteen years in jail for utilizing each actual and AI-generated sexually specific photos and intimidating victims with threats of violence. “Strahler had put in greater than 24 AI platforms and greater than 100 AI web-based fashions on his cellphone,” the Justice Division stated. “The defendant used phone calls, voicemails, textual content messages and internet postings to interact in a marketing campaign of harassment in opposition to his victims. From December 2024 till June 2025, Strahler despatched harassing messages to not less than six grownup feminine victims. These messages included nude photos of the victims, each actual and AI-generated. Strahler additionally posted on-line AI-generated obscenities he created of kids.” The defendant is alleged to have created greater than 700 photos of each actual victims and animated individuals and posted them to a web site devoted to youngster sexual abuse. He was arrested in June 2025.

Sergei Anatolyevich Filimonov, 36, a Russian nationwide and internet developer, has been extradited to the U.S. in reference to a transnational cyber-fraud conspiracy chargeable for large-scale checking account takeover assaults. “Filimonov and his co-conspirators executed a classy scheme involving spoofed domains that mimicked the web sites of federally insured monetary establishments,” the Justice Division stated. “The conspirators bought sponsored search-engine hyperlinks to divert unsuspecting banking clients to fraudulent login pages, the place victims entered their credentials. The conspirators used the stolen credentials to entry financial institution accounts, evaluate account balances, and provoke unauthorized wire transfers to steal checking account funds.” Filimonov can be accused of growing and sustaining on-line infrastructure supporting the operation, together with interactive databases storing greater than 5,000 stolen login credentials and software program designed to reap and transmit delicate authentication information. One of many backend domains linked to the scheme was seized by U.S. authorities in December 2025. Filimonov has pleaded not responsible to the costs.

Malone Lam (aka Anne Hathaway, $$$, and King Greavy), 22, a citizen of Singapore and up to date resident of Miami, has pleaded responsible within the U.S. for his or her position as a “ringleader of a global cybercrime conspiracy” that used social engineering to steal and launder cryptocurrency valued at greater than $245 million. “The prison enterprise started no later than October 2023 and continued by means of not less than Could 2025,” the Justice Division stated. “The scheme developed by means of connections made on on-line gaming platforms and was comprised of people primarily based in California, Connecticut, New York, Florida, and overseas. The RICO conspiracy used social engineering and occasional residence break-ins to acquire data that allowed the conspirators to empty their victims’ cryptocurrency wallets.” Lam is accused of organizing the enterprise, figuring out goal victims, and coordinating with totally different co-conspirators. The stolen property have been used to buy nightclub providers, luxurious purses, high-end watches and clothes, rental houses, non-public jet leases, a workforce of personal safety guards, and a fleet of unique automobiles.

Microsoft stated it’ll present extra safety for QR codes shared by exterior customers in workforce messages. “Photographs containing QR codes from exterior senders will probably be obscured by default and require customers to disclose them earlier than viewing or scanning,” the corporate stated. “This helps cut back the chance of phishing and fraud by encouraging extra deliberate interplay with QR code content material.” The function is anticipated to start out rolling out subsequent month.

A newly found phishing marketing campaign has been noticed routing “victims by means of a deliberate chain of respectable Google providers earlier than touchdown them on credential harvesters or deploying distant entry instruments,” in keeping with KnowBe4 Menace Lab. What’s uncommon concerning the assault is that it abuses six distinct Google properties (Meet, Search, DoubleClick, Programmable Search Engine, Picture Search, and Tag Supervisor) throughout a multi-hop redirection path to bypass electronic mail safety filters. “The web page pulls reside firm logos from Clearbit, real-time web site screenshots from a third-party screenshot API, and makes use of Google’s public DNS to validate the sufferer’s company electronic mail area,” it added. Latest phishing campaigns have additionally more and more exploited .vu, Vanuatu’s country-code top-level area, for establishing malicious infrastructure. KnowBe4 stated it recorded a 159% enhance in phishing websites, 1,660 distinctive domains, and over 28,000 malicious emails from April by means of July 2026. “Safety distributors have traditionally seen virtually no .vu site visitors, so there is no such thing as a TLD-level danger sign constructed into most risk feeds,” the corporate stated. One other “iCloud Signal-In Alert” phishing assault has been discovered to detect the working system and serve a distant entry software for Home windows customers and a credential harvesting web page for Apple customers. “Everybody else will get walked by means of a faux Microsoft login whereas a human operator watches the credentials arrive in Telegram in actual time,” KnowBe4 stated.

LG is drawing criticism over claims from YouTube channel Avid gamers Nexus that its good TVs collect in depth details about customers and their environment to gas its promoting enterprise. The channel crew stated it noticed the TV capturing IP addresses, location information, and the names, sign strengths, and channel numbers of close by Wi-Fi networks. The buyer {hardware} additionally enumerated units on the native community that weren’t paired with it, together with smartphones, watches, routers, thermostats, air purifiers, server baseboard administration controllers, and PCs. The transfer has been described as “an egregious invasion of privateness.” In a press release shared with The Register, the corporate stated the allegations will not be true. “LG TVs course of voice information solely when the voice button on the distant management is pressed and held, or when a wake phrase comparable to ‘Hello LG’ is acknowledged after the consumer has activated the Far-Discipline voice recognition function,” the corporate stated. Aside from these cases, the TVs don’t acquire or file ambient conversations. If the wake phrase is just not acknowledged, no voice information is transmitted to the server; wake phrase detection is processed domestically on the gadget and instantly deleted. Moreover, to offer good TV functionalities, LG TVs function the flexibility to scan for and hook up with close by units on the identical community. It is a commonplace perform generally obtainable on good TVs and good residence units.”

A set of 13 malicious pockets packages have been found on the npm registry. In line with InstallSafe, their names reference wallets, signing, analytics, Solana, Base, or cell parts. “Any pc that has this package deal put in or operating needs to be thought of absolutely compromised,” GitHub warns in an advisory. All secrets and techniques and keys saved on that pc needs to be rotated instantly from a distinct pc. The package deal needs to be eliminated, however as full management of the pc might have been given to an outdoor entity, there is no such thing as a assure that eradicating the package deal will take away all malicious software program ensuing from putting in it.

Barracuda has disclosed particulars of a DocuSign-themed assault marketing campaign that replaces the normal phishing website with a phishing web page generated contained in the sufferer’s browser utilizing blob URLs. “Victims are routed by means of respectable Microsoft providers, making the assault seem reliable and lowering widespread warning indicators,” the cybersecurity firm stated. “As a result of the web page exists solely inside that browser session, there is no such thing as a persistent phishing URL for safety instruments to retrieve, analyze, or blocklist prematurely. As a result of the seen navigation stays inside trusted Microsoft providers, customers and automatic scanners could also be much less more likely to determine the exercise as malicious.”

Greater than 5,400 compromised web sites have been used for finishing up EtherHiding assaults. “The compromised web sites have little in widespread past being small companies (clinics, plumbers, e-commerce outlets) with no shared business, area, or proprietor,” Netskope stated. “These compromised websites embrace both an inline script or a spoofed package deal that calls the BSC testnet and downloads a ClickFix overlay as the subsequent step of the assault, which instructs guests to run a command on their PC.” One other variant of the assault has been discovered to open a covert WebRTC information channel for command-and-control (C2) as an alternative of serving the ClickFix overlay and use it to obtain and execute arbitrary JavaScript code.

Rapid7 stated it has recognized 476 cases of compromised Social Safety numbers (SSNs) throughout 395 distinctive company personnel since early 2026. “Over 73% of those exposures instantly focused top-level management, with C-suite executives comprising 44.6% of affected profiles and Presidents making up one other 28.6%,” it stated. “Unsurprisingly, given the geographical nature of SSNs, 95.6% of those leaks stemmed from U.S.-headquartered organizations, concentrated closely in high-value sectors like Financials (over 25%) and Industrials (17%).” Marketplaces like Xilo, Bankom, and PeopleFinder collectively account for 81.5% of all government SSN leaks current in its dataset, led by Xilo at 40.8%, Bankom at 21.8%, and PeopleFinder at 18.9%.

An evaluation of 33,563 revealed MCP server builds containing 475,865 instruments has discovered that 2 in 5 server builds embrace a software that may entry delicate information or take consequential motion and 1 in 13 server builds include a code or command-execution primitive. “When an MCP host makes a software obtainable to a mannequin, the software’s description can enter the mannequin’s context,” Island stated. “After the software is known as, its returned textual content can enter that context too. The mannequin might interpret both as steerage, not simply documentation. An attacker might not want a malicious binary. A paragraph of pure language will be sufficient.” This makes the “instruction provide chain” a vital assault floor, permitting dangerous actors to embed covert directions in software descriptions and prompts {that a} mannequin might learn and set off unintended actions with out requiring malicious executable code. “Safety groups want a management aircraft that governs a software from discovery to execution: examine its code and directions, constrain its capabilities, confirm configuration adjustments, and consider every motion in runtime context,” Island stated. “Approval can’t be a one-time package deal rating; it should account for the software model, the agent and consumer invoking it, the vacation spot, the info in scope, and the motion being tried.”

Lots of of organizations throughout greater than 40 international locations have been focused by BigBear 2.0, a rebranded Evilginx2-based Microsoft 365 phishing-as-a-service (PhaaS) operation. The stolen information are tied to 461 organizations. CloudSEK, which was in a position to achieve admin entry to the risk actor panel, stated the operation has “exfiltrated 5,137 credential information — together with 474 full MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies — affecting 3,331 distinctive sufferer IPs throughout 40+ international locations.” The multi-user PhaaS panel has been leased to not less than 5 affiliate operators to date. “The core method employed is adversary-in-the-middle (AitM) phishing,” CloudSEK stated. “Not like classical phishing that solely captures passwords, Evilginx2’s reverse proxy relays the whole session.”

The U.S. Federal Bureau of Investigation (FBI) has outlined its first-ever cyber technique, stating it “will detect shifts in adversary intent and functionality, disrupt their potential to revenue or function safely, expose their tradecraft and enablers, convey offenders to justice with home and worldwide companions, and supply the proof and intelligence that underpin sanctions, diplomatic motion, and associate legislation enforcement actions.” The company additionally goals to attribute malicious cyber exercise with confidence, assist victims following intrusions, share actionable intelligence, and associate with U.S. allies and the non-public sector to extend influence. Moreover, the company stated it’ll “undertake agentic AI in ways in which securely scale protection and disruption, and can implement AI-enabled instruments to detect, divert, and deceive risk actors the place operationally acceptable.”