30
30
35
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
Google’s Early Access is creating a blind spot for malicious apps
Bitdefender found thousands of Google Play Early Access apps with deceptive behavior, including ad-fraud-capable utilities requesting excessive permissions on Android devices.
Bitdefender Labs analyzed Google Play apps installed by its users and identified thousands of Early Access applications that appeared deceptive, including fake casino and reward games, misleading utilities, and apps using third-party trademarks, many promoted via social ads with AI deepfakes. Early Access apps cannot receive public reviews, removing a key warning signal users normally rely on. Some apps requested unusual permissions, such as a QR scanner seeking to replace the device launcher, which could enable hidden web views that click ads and potentially display fake login screens or capture two-factor codes. Bitdefender recommends Android Enterprise Work Profiles and notes Google Workspace admins can disable Early Access apps for their organization.
45
Mirai Variant V3G4 Targets IoT Devices
Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.
From July to December 2022, Unit 42 observed three campaigns spreading V3G4, a Mirai botnet variant, by exploiting 13 vulnerabilities, including CVE-2022-26134 in Atlassian Confluence and CVE-2019-15107 in Webmin. The campaigns shared the same C2 domains containing the string 8xl9, nearly identical shell script downloaders, and the same XOR keys, suggesting a single threat actor. The malware brute-forces telnet and SSH credentials, terminates rival botnet processes via a stop list, and receives DDoS commands from its C2. Compromised servers and networking devices are absorbed into the botnet for further attacks.
45
30
30
30
30
30
30
30
30
35
30
30
30
30