Threat Library

Threat actors are exploiting Google Play's Early Access program, intended for pre-release beta feedback, to distribute thousands of deceptive Android apps promising fake money, rewards, casino winnings, and premium content. This abuse allows fraudulent apps to bypass some standard vetting scrutiny while still appearing on the legitimate Play Store, increasing user trust and installation rates.

This is a weekly aggregated security news digest covering approximately 200 Android vulnerabilities, browser-based phishing techniques using malicious extensions, and a network of roughly 119,000 fraudulent online storefronts. The report is a compilation of disparate stories rather than a single coordinated campaign, spanning exposed systems, aging unpatched bugs, malicious browser extensions, and risky software packages.

Surfshark disclosed that attackers accessed one of its internal testing/proxy servers after a configuration error left it exposed to the public internet. The incident highlights ongoing risks from misconfigured internal infrastructure at network service providers, though the scope of user data exposure has not been fully detailed.

Microsoft's September 2026 security updates for Windows Server 2019, 2022, and 2025 are causing Remote Desktop Services (RDS) failures, blocking user connections and in some cases requiring a hard reset to restore service. This is a patch quality/regression issue rather than an exploited vulnerability, but it poses an operational availability risk for organizations relying on RDS for remote access.

A missing authorization vulnerability in WebView on Google Chrome for Android prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions via crafted network traffic combined with social engineering. Google/Chromium rates this as Medium severity, indicating exploitation requires user interaction and does not grant full system compromise on its own.

The MCP Kotlin SDK's stdio transport buffers incoming bytes with no size limit and only flushes frames on a newline delimiter, allowing a malicious or malformed peer to stream endless newline-free data and exhaust JVM memory until the host process is OOM-killed. This is a remote, pre-authentication denial-of-service issue affecting any deployment where stdin to the MCP server is fed by an untrusted producer, such as a proxy or wrapper bridging network input to stdio. The vendor has released version 0.13.0 with a fix.

A vulnerability in n8n allowed a workflow's caller restriction setting ('This workflow can be called by') to be bypassed when the restricted workflow was attached to an AI Agent as a tool instead of invoked via the standard Execute Workflow node. This let a user with Agent-building privileges invoke and read output from workflows they were explicitly not authorized to call, breaking intended access boundaries. The issue is fixed in n8n 2.37.7 and 2.38.2.

The U.S. Department of Justice disrupted Xinbi Guarantee, an online marketplace facilitating scam services for Chinese organized crime groups, seizing associated Telegram channels and freezing $52.8 million in cryptocurrency. The action also included physical disruption of 13 scam compounds in Madagascar linked to romance and investment scam operations (commonly known as 'pig butchering' schemes).

CERT/CC has disclosed that Skullcandy Dime 3 wireless earbuds will accept Bluetooth pairing requests from any nearby device without requiring user confirmation. This flaw could allow an attacker within Bluetooth range to eavesdrop on audio or hijack the connection without the victim's knowledge or consent.

A path traversal vulnerability in Dell SCG 5.0 Appliance and Application allows an unauthenticated remote attacker to escape restricted directories, potentially leading to remote code execution. The flaw affects versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) and carries a CVSS score of 6.5, indicating medium severity despite the RCE potential.

This is a regulatory compliance advisory, not an active exploit or malware campaign. The EU Cyber Resilience Act imposes new mandatory vulnerability reporting requirements effective September 11, requiring software vendors to report actively exploited vulnerabilities to authorities within 24 hours of awareness. The article emphasizes that organizations must maintain precise records of software composition and vulnerability discovery timelines to meet these tight deadlines.

DoppelCart is a large-scale fraud operation leveraging over 119,000 fake e-commerce domains to trick consumers into entering payment card details on fraudulent storefronts. The scale of the infrastructure suggests automated domain generation and templated site deployment, enabling rapid scaling and takedown resilience. The primary impact is financial fraud and payment card data theft against consumers and, by extension, brands whose identities may be spoofed.

CareCam Pro IP Cameras (ANJIA AJL33PC0801 firmware) contain a hard-coded credential used for bootloader authentication, allowing an attacker with physical access to gain privileged bootloader access and fully compromise the device. The vendor has not responded to CISA's coordination attempts, and no patch is currently available. Exploitation requires physical access and is not remotely exploitable.

This is an academic research paper (not an active exploit) that reframes indirect prompt injection as a search problem, showing that an attacker agent with more compute and structured strategy management becomes significantly better at finding and exploiting injection vulnerabilities in victim agents. The core finding is that attack success scales with attacker search budget and adaptive strategy, meaning current security evaluations that treat 'attack success' as fixed likely underestimate real-world risk against tool-using agents.

Langflow OSS versions 1.0.0 through 1.11.2 contain a path traversal flaw in the SaveToFileComponent that lets an authenticated, low-privileged user write files to arbitrary locations on the server via the /api/v1/run/{flow_id} endpoint. This is a classic input validation failure in an agent-building tool component rather than a novel agentic attack, but it can be leveraged to escalate into further server compromise depending on deployment. Severity is moderate due to the authentication requirement, but risk increases sharply in multi-tenant or exposed Langflow deployments.

A stored cross-site scripting vulnerability exists in the Playground chat interface of IBM Langflow OSS, a popular framework for building LLM/agent workflows. An attacker could inject malicious script content that executes in the browser of another user viewing the chat, potentially hijacking sessions or performing actions on their behalf within the Langflow UI.

Hardware wallet maker Trezor disclosed that 67,000 U.S. customers had personal data exposed in a breach at its shipping partner ShipMonk, despite the data reportedly having been deleted. Exposed information includes names, emails, phone numbers, shipping addresses, and order numbers spanning November 2019 to August 2021. Trezor confirmed the breach does not compromise the security of its hardware wallets or private keys.

Threat actors are embedding invisible Unicode characters within phishing emails to conceal malicious lures and evade email security filters, a technique known as ASCII smuggling. This allows attackers to bypass keyword-based and pattern-matching detection systems while presenting deceptive content to human victims or automated parsers.

Rowboat versions through 0.9.1 let authenticated users register arbitrary MCP server and webhook URLs without validating the destination, enabling server-side request forgery. An attacker can abuse this to reach internal-only services or cloud instance metadata endpoints, potentially exposing credentials or internal network topology. This is a classic insecure agent-tool-configuration flaw rather than a novel agentic attack technique.

The postgres-mcp-server (versions before 1.1.7) has an incomplete SQL input validation blocklist that can be bypassed with crafted SQL, allowing data modification even when the tool is configured for read-only access. This lets a user of the MCP server escape its intended safety boundary and perform writes it should have blocked.