Threats Affecting Mozambique

AnonyMousKIT is an AI-powered Phishing-as-a-Service platform that targets stolen Apple devices by disabling Activation Lock. It automates credential harvesting via email, SMS, WhatsApp, and AI-driven voice phishing calls, primarily targeting device owners with personalized lures. The platform operates through a decentralized supply chain with hundreds of reseller storefronts and operators, mainly conducting vishing calls to Brazil. Operational logs leaked due to coding vulnerabilities reveal extensive infrastructure and operator details. This campaign monetizes stolen iPhones by bypassing security features through industrialized social engineering.

MediumCampaignUnited StatesAlgeriaArgentina+16#credential harvesting#iphone theft#phishing-as-a-service

A weakness has been identified in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file FinalStatusImportService.php of the component Final Status Import. Executing a manipulation of the argument school_id can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

MediumVulnerabilityBrazilPortugalAngola+4#cve#cve-2026-2015

A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

MediumVulnerabilityBrazilPortugalAngola+7#cve#cve-2025-11554

New Predator spyware infrastructure revealed activity in Mozambique for first time Source: https://securityaffairs.com/179036/hacking/new-predator-spyware-infrastructure-revealed-activity-in-mozambique-for-first-time.html

MediumNewsFranceGermanyUnited Kingdom+5#infosecnews#reddit#spyware

A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attacker to craft malicious urls with arbitrary javascript in the 'titulo_documento' parameter.

MediumVulnerabilityBrazilPortugalAngola+4#cve#cve-2024-55239

Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/gateway_pagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter.

MediumVulnerabilityBrazilPortugalAngola+3#cve#cve-2024-53470

Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.

HighVulnerabilityBrazilPortugalAngola+7#cve#cve-2024-48325