ThreatsDay: 200 Android Flaws, Browser Phishing, 119K Scam Shops
Weekly security bulletin reveals major vulnerabilities and phishing schemes.
1Malicious Browser Extensions
Four malicious Google Chrome and Mozilla Firefox extensions, including J7Tracker and VREO, have been found targeting Axiom Trade and Padre users. These extensions steal session tokens and wallet data by retrieving authenticated user information and sending it to threat actor-controlled Vercel deployments. The same Chrome publisher has been linked to earlier extensions like GhostApe, which impersonated the MockApe trading add-on. The modules are byte-identical across the analyzed extensions, indicating a coordinated attack.
2AI-Driven Intrusions
A Chinese-speaking operator has been using AI tools like Anthropic Claude Code and Alibaba Qwen to automate intrusions against government and financial systems in multiple countries. Targets included Taiwan's Kuomintang Party History Archives and Indonesia's Ministry of Foreign Affairs. The attacker used SecFlow, an AI orchestration framework, to split tasks among specialist workers. Exploited vulnerabilities include Shellshock, Log4Shell, and Spring4Shell, followed by the deployment of web shells for further actions like credential theft.
3Unapproved AI Risks
The U.K.'s NCSC warns that employees using unapproved AI tools can expose sensitive corporate data, increasing the risk of data breaches and intellectual property loss. Shadow AI access reduces organizational visibility and control over data. AI agents' vulnerabilities can be exploited by attackers to gain access to the same data and privileges, posing significant security risks.
4Executive Impersonation Scams
Attackers are masquerading as executives to trick legal teams into moving conversations to WhatsApp and personal email. The scam involves forged acquisition documents to initiate international wire transfers. Targets include senior professionals in private equity and industrial finance. The attackers present the acquisition as a tightly controlled transaction, reusing the same legal language across documents.
5Windows Age API
Microsoft is introducing the Windows Age API in Windows 11 to allow apps to determine a user's age group without exposing their exact date of birth. This helps developers build safeguards into experiences from the start, reducing the burden on children and families to manage protections app by app. The API provides only age-related signals, not sensitive personal data.
6DoppelCart Operation
A massive operation called DoppelCart uses over 119,000 domains to run fake e-commerce shops that steal payment card details. The sites mimic 44,182 different brands, copying product catalogs, descriptions, and branding. Some even load assets directly from the real company's servers. The shops undercut prices and republish the brand's support address, leading victims to complain to the brand.
7Phishing Chains
Trusted services are increasingly becoming part of phishing chains, where extensions or packages ask for excessive access. Old bugs remain exploitable, and exposed systems stay vulnerable. The common thread is that the path for intrusion is often already present, requiring no advanced techniques—just access, trust, and weak edges.
8AI in Cyber Attacks
AI is being leveraged to automate and orchestrate cyber attacks, as seen in the use of SecFlow to coordinate reconnaissance and exploitation. This trend highlights the dual-use nature of AI tools, which can be repurposed by threat actors to enhance the scale and efficiency of their operations, targeting high-value systems globally.
9Regulatory Challenges
The NCSC's warning underscores the regulatory challenges posed by shadow AI usage in organizations. Employees transferring sensitive data to consumer AI services can lead to compliance failures and intellectual property loss. Organizations must balance innovation with robust security measures to mitigate these risks.
10Brand Impersonation
The DoppelCart operation's scale—119,000 domains mimicking 44,182 brands—demonstrates the sophistication of modern e-commerce scams. By republishing real brands' support addresses, the attackers divert complaints, making it harder for victims to identify the fraud. This tactic erodes trust in legitimate online businesses.
11Security Best Practices
Microsoft's Windows Age API represents a proactive approach to security by minimizing data exposure. Developers can integrate age-awareness without handling sensitive data, reducing the risk of breaches. This aligns with broader industry trends toward privacy-by-design and zero-trust architectures.
12Ongoing Threats
The recurring theme in this week's security news is the exploitation of existing vulnerabilities and trust mechanisms. Whether through AI tools, phishing, or brand impersonation, attackers continue to find low-effort, high-impact methods to compromise systems. Organizations must prioritize continuous monitoring and employee education to stay ahead.
Original article: The Hacker News — ThreatsDay: 200 Android Flaws, Browser Phishing, 119K Scam Shops