ThreatsDay Roundup: 200 Android Flaws, 119,000 Fake Shops and New Phishing Tactics
Summary
This weekly roundup covers malicious extensions and npm packages, AI-assisted intrusions, phishing and scam operations, ransomware, law-enforcement actions, and Google’s September Android patches for 200 vulnerabilities.
Key points
- Four Chrome and Firefox extensions targeting Axiom Trade and Padre users were found stealing session tokens, wallet data, Firebase access tokens, and application state.
- A Chinese-speaking operator reportedly used Claude Code, Qwen, DeepSeek, and SecFlow to automate intrusions against government and financial systems, deploying web shells and the SecBox backdoor.
- Google’s September 2026 Android updates patched 200 vulnerabilities, including critical Wi-Fi-related CVE-2026-28662, which could enable remote code execution without user interaction.
- Trezor warned of phishing after its email provider Brevo was breached; the incident affected roughly 347,000 newsletter addresses. The provider account was suspended and the phishing domain was taken down.
- The DoppelCart operation reportedly uses more than 119,000 domains to imitate 44,182 brands and steal payment card details.
- CloudSEK reported that BigBear 2.0, an Evilginx2-based phishing service, targeted organizations in more than 40 countries and exfiltrated 5,137 credential records, including 474 MFA-bypassed authentications.
- Other reported techniques include routing phishing through legitimate Google services and using browser blob URLs to hide phishing pages from security tools.
Article Details
- Event Type
- Weekly roundup of cybersecurity incidents, threat activity, vulnerability disclosures, law-enforcement actions, and security updates.
- Impact
- Reported activity included theft of session tokens, wallet data, payment-card details, credentials, and sensitive personal information; phishing and account-takeover schemes; ransomware deployment and data exfiltration; and intrusions affecting government, financial, and other organizations. Google disclosed patches for 200 Android vulnerabilities, including CVE-2026-28662, which was described as a critical Wi-Fi-related flaw that could permit remote code execution without user interaction.
MITRE ATT&CK
CVE
People
Adam BoyntonJamf enterprise strategy manager who commented on the potential remote-code-execution risk from CVE-2026-28662.Malone LamPleaded guilty to a role described by the Justice Department as ringleader of a cybercrime conspiracy that used social engineering to steal and launder cryptocurrency.Sergei Anatolyevich FilimonovExtradited to the U.S. in connection with a bank-account takeover conspiracy; he pleaded not guilty to the charges.
Threat Actors
$$$Alias explicitly identified in the source for Malone Lam.Anne HathawayAlias explicitly identified in the source for Malone Lam.BigBear 2.0Named MFA-bypassing Microsoft 365 phishing-as-a-service operation reportedly used by affiliates to steal credentials and session cookies from organizations in more than 40 countries.Malone LamPleaded guilty to participating as a ringleader in a cryptocurrency theft and laundering conspiracy.Sergei Anatolyevich FilimonovAccused of developing and maintaining infrastructure for a bank-account takeover scheme using spoofed domains and stolen credentials; he pleaded not guilty.
Malware
EtherRAT#AxiomTrade #Padre #AnthropicClaudeCode #AlibabaQwen #DeepSeek #SecFlow #Trezor #Brevo #EtherRAT #TukTuk #TheGentlemen #BigBear2.0 #Evilginx2SecBoxOne such backdoor is SecBox, a Go-based remote-access and network-pivot framework.The GentlemenUsing the access provided by the remote access software, the threat actor is said to have successfully exfiltrated data to a cloud service and deployed The Gentlemen ransomware.TukTuk#AxiomTrade #Padre #AnthropicClaudeCode #AlibabaQwen #DeepSeek #SecFlow #Trezor #Brevo #EtherRAT #TukTuk #TheGentlemen #BigBear2.0 #Evilginx2
Vendors
Alibaba GroupA Chinese-speaking operator has been observed using Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S.AnthropicA Chinese-speaking operator has been observed using Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S.Brevo#AxiomTrade #Padre #AnthropicClaudeCode #AlibabaQwen #DeepSeek #SecFlow #Trezor #Brevo #EtherRAT #TukTuk #TheGentlemen #BigBear2.0 #Evilginx2DeepSeek#AxiomTrade #Padre #AnthropicClaudeCode #AlibabaQwen #DeepSeek #SecFlow #Trezor #Brevo #EtherRAT #TukTuk #TheGentlemen #BigBear2.0 #Evilginx2GoogleThreat actors abused Google services, blob URLs, and QR codes to hide phishing and bypass security filters.LGLG is drawing criticism over claims from YouTube channel Gamers Nexus that its smart TVs gather extensive information about users and their surroundings to fuel its advertising business.MicrosoftMicrosoft is adding new age-awareness APIs called the Windows Age API to Windows 11 that will allow apps to determine whether a user is a child, teenager, or adult without exposing their exact date of birth.Trezor#AxiomTrade #Padre #AnthropicClaudeCode #AlibabaQwen #DeepSeek #SecFlow #Trezor #Brevo #EtherRAT #TukTuk #TheGentlemen #BigBear2.0 #Evilginx2
Products
Android200 Android flaws patchedAxiom TradeMalicious Chrome and Firefox extensions stole session tokens and wallet data from Axiom Trade and Padre users.Claude CodeAI tools like Claude Code, Qwen, and DeepSeek were used to automate intrusions against government and financial targets.Google ChromeMalicious Chrome and Firefox extensions stole session tokens and wallet data from Axiom Trade and Padre users.GoTo ResolveAn attack campaign that installs EtherRAT via a malicious MSI installer masquerading as a Sysinternals tool has been found to deliver an AI-generated malware framework called TukTuk and GoTo Resolve.LiquidPaythe mobile number linked to the customer’s Singpass account, before using this opportunity to create a LiquidPay account without the customer’s knowledge.” Investigations have uncovered over 170 Singapore citizens andMicrosoft 365 Apps for EnterpriseHundreds of organizations across more than 40 countries have been targeted by BigBear 2.0, a rebranded Evilginx2-based Microsoft 365 phishing-as-a-service (PhaaS) operation.Mozilla FirefoxMalicious Chrome and Firefox extensions stole session tokens and wallet data from Axiom Trade and Padre users.Padre#AxiomTrade #Padre #AnthropicClaudeCode #AlibabaQwen #DeepSeek #SecFlow #Trezor #Brevo #EtherRAT #TukTuk #TheGentlemen #BigBear2.0 #Evilginx2QwenAI tools like Claude Code, Qwen, and DeepSeek were used to automate intrusions against government and financial targets.SingpassSingpass scheme tied to 170 victimsWindows 11Microsoft is adding new age-awareness APIs called the Windows Age API to Windows 11 that will allow apps to determine whether a user is a child, teenager, or adult without exposing their exact date of birth.
Tools
Countries
AfghanistanA Chinese-speaking operator has been observed using Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S.ChinaSome of the targets included Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam.IndonesiaSome of the targets included Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam.SingaporeSingapore police officials have arrested two male Chinese Malaysians, aged 25 and 47, for their alleged involvement in a coordinated scheme that compromised the Singpass accounts of Singapore citizens and work permitTaiwanA Chinese-speaking operator has been observed using Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S.ThailandA Chinese-speaking operator has been observed using Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S.United StatesA Chinese-speaking operator has been observed using Anthropic Claude Code, Alibaba Qwen, and DeepSeek to automate intrusions against government and financial systems in Afghanistan, Thailand, Taiwan, and the U.S.VietnamSome of the targets included Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam.
Industries
CryptocurrencyCryptocurrency hardware wallet maker Trezor has warned customers to be on the lookout for phishing attacks after its third-party email provider Brevo was breached.E-commerceA massive operation dubbed DoppelCart is using more than 119,000 domains to run a network of fake e-commerce shops that steal payment card details.EducationSome of the targets included Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam.EnergyThe targets included senior people in private equity, industrial finance, sales, mining and energy.GovernmentAI tools like Claude Code, Qwen, and DeepSeek were used to automate intrusions against government and financial targets.IndustrialSome of the targets included Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Da Nang, Vietnam.