Seller Offers Branch Deep-Link Keys That Could Enable Phishing Across 2,553 Apps
Summary
A seller named exfilar is offering Branch deep-link keys for $15,000, claiming they come from public developer packages rather than a breach. The keys could enable phishing through a shared domain trusted by 2,553 apps.
Key points
- The seller, exfilar, is offering Branch deep-link keys for $15,000.
- The listing reportedly uses escrow and cryptocurrency for payment.
- The seller claims the keys come from public developer packages, not a direct breach.
- The keys could be abused for phishing through a shared domain trusted by 2,553 apps: 666 iOS apps and 1,887 Android apps.
Article Details
- Event Type
- A seller is offering Branch deep link keys for sale, which could enable phishing through a shared domain.
- Impact
- The keys reportedly come from public developer packages rather than a direct breach. If abused, the shared domain—trusted by 2,553 apps, including 666 iOS apps and 1,887 Android apps—could be used for phishing. The asking price is $15,000.