<![CDATA[ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories]]>This week's security roundup keeps circling back to one uncomfortable question: how did any of this get through? An extension asks for more access than it needs and gets it. A trusted service quietly becomes a link in a phishing chain. An old bug still delivers results. An exposed system stays exposed. A package looks legitimate right up until it isn't.

The common thread across these stories is that the way in rarely required anything sophisticated. 200 Android flaws headline the week's collection, alongside phishing campaigns assembled entirely inside the browser and a sprawling network of 119,000 scam shops. The roundup also bundles in 23 additional stories covering the broader threat landscape.

A few patterns worth noting from the collection:

  • Extensions and packages that appear useful until they turn malicious
  • Trusted services being abused as part of phishing infrastructure
  • Long-patched vulnerabilities that remain effective because systems were never updated
  • Exposed systems that simply stay exposed

The recurring lesson is that exposure often persists not because attackers are clever, but because basic hygiene gets skipped.

Source: The Hacker News

Which of these exposure patterns does your organization struggle with most, and how are you addressing it?

]]>https://xploitlk.com/topic/293/threatsday-200-android-flaws-browser-built-phishing-119k-scam-shops-23-more-storiesRSS for NodeSat, 12 Sep 2026 05:34:06 GMTFri, 11 Sep 2026 04:30:20 GMT60