ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.
- Four malicious extensions target Axiom Trade and Padre users, exfiltrating tokens and wallet data to Vercel deployments.
- AI-agent intrusions used SecFlow orchestration and known vulnerabilities including Log4Shell and Spring4Shell.
- NCSC warns shadow AI use increases breach, IP loss, and compliance risks.
- DoppelCart fake shops use 119,000 domains mimicking 44,182 brands to steal payment card details.
- Products
- Claude CodeQwenSecFlowWindows 11
- Organizations
- NCSC
- AI models
- Qwen
From the original article
13 min read at thehackernews.com
A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?” An extension asks for access and takes too much. A trusted service becomes part of a phishing chain.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.