Threats Affecting Kenya

AnonyMousKIT is an AI-powered Phishing-as-a-Service platform that targets stolen Apple devices by disabling Activation Lock. It automates credential harvesting via email, SMS, WhatsApp, and AI-driven voice phishing calls, primarily targeting device owners with personalized lures. The platform operates through a decentralized supply chain with hundreds of reseller storefronts and operators, mainly conducting vishing calls to Brazil. Operational logs leaked due to coding vulnerabilities reveal extensive infrastructure and operator details. This campaign monetizes stolen iPhones by bypassing security features through industrialized social engineering.

MediumCampaignUnited StatesAlgeriaArgentina+16#credential harvesting#iphone theft#phishing-as-a-service

Beginning in August 2025, a sophisticated intrusion was discovered where attackers used log poisoning techniques to deploy a web shell on vulnerable phpMyAdmin panels. The threat actors exploited misconfigured web applications to plant China Chopper web shells, controlled via AntSword, before deploying Nezha, an open-source monitoring tool, to facilitate remote command execution. This led to the deployment of Ghost RAT on compromised systems. Analysis revealed over 100 compromised machines, predominantly located in Taiwan, Japan, South Korea, and Hong Kong. The attackers demonstrated technical proficiency through multi-stage operations, utilizing AWS and VPS infrastructure, with indicators pointing to China-nexus threat actors. The campaign highlights increasing abuse of legitimate publicly available tools to achieve malicious objectives while maintaining plausible deniability.

MediumMalwareUnited StatesAngolaArgentina+46#phpmyadmin#gh0st rat#china-nexus

CVE-2025-70031 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Sunbird-Ed portal version 1.13.4. This vulnerability allows remote attackers to trick authenticated users into executing unwanted actions without their consent, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. Exploitation requires user interaction but no privileges or authentication are needed by the attacker. Although no known exploits are currently in the wild and no patches have been published, the vulnerability's CVSS score of 8.8 indicates a critical risk. Organizations using Sunbird-Ed portal should prioritize mitigation to prevent unauthorized state-changing requests. The threat is particularly relevant to countries with significant deployments of Sunbird-Ed, especially in education sectors. Immediate defensive measures include implementing CSRF tokens, validating request origins, and educating users about phishing risks.

HighVulnerabilityIndiaUnited StatesUnited Kingdom+7#cve#cve-2025-70031

CVE-2025-70033 is a medium severity vulnerability in Sunbird-Ed SunbirdEd-portal v1.13.4 related to improper neutralization of input during web page generation (CWE-79), commonly known as a Cross-Site Scripting (XSS) issue. The vulnerability allows remote attackers to inject malicious scripts via crafted input, requiring user interaction but no authentication. Exploitation can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There are no known exploits in the wild, and no official patches have been released yet. Organizations using this version of SunbirdEd-portal should prioritize input validation and output encoding to mitigate risks. Countries with significant adoption of SunbirdEd or similar educational platforms, especially those with large deployments in education sectors, are at higher risk. The vulnerability has a CVSS score of 5.4, indicating a medium severity level.

MediumVulnerabilityIndiaUnited StatesUnited Kingdom+7#cve#cve-2025-70033

A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the component Setting Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

MediumVulnerabilityIndiaPakistanBangladesh+7#cve#cve-2026-3261

A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Product results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.

MediumVulnerabilityUnited StatesIndiaChina+8#cve#cve-2026-2865

CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.

HighVulnerabilityGhanaNigeriaKenya+3#cve#cve-2026-26063#cwe-20

A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument stud_no results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

MediumVulnerabilityUnited StatesIndiaUnited Kingdom+7#cve#cve-2025-13555

A weakness has been identified in Campcodes School Fees Payment Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_fees. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

MediumVulnerabilityUnited StatesIndiaUnited Kingdom+7#cve#cve-2025-13274

A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_payment. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

MediumVulnerabilityUnited StatesIndiaUnited Kingdom+7#cve#cve-2025-13273