Threats Day: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Summary: This week's roundup covers four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) that stole session tokens and wallet data from Axiom Trade and Padre users, sending it to attacker-controlled Vercel deployments. It also reports a Chinese-speaking operator using Anthropic Claude Code, Alibaba Qwen, and DeepSeek through the SecFlow orchestration framework to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S., and Google's September 2026 Android update patching 200 vulnerabilities including the critical Wi-Fi flaw CVE-2026-28662.
Key Takeaway: The DoppelCart operation's 119,000 fake shop domains mimicking 44,182 brands republish the real company's own support address, so customers who get charged complain to the brand rather than the shop - and the operator's use of Shellshock, Log4Shell, and other long-known flaws shows the entry path was often already open.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026