Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A SpyLoan application called 'RapiPlata' was identified on a victim's device, having been downloaded by over 150,000 users from both Google Play and Apple App Store. The app, which ranked in the top 20 finance category in Colombia, had extensive access to sensitive user data, including SMS messages, call logs, calendar events, and installed applications. It uploaded this data to its servers, posing significant risks to users' privacy and financial security. The app's malicious behavior included harassing messages, unauthorized loan approvals, and data theft. Despite its removal from official app stores, it remains accessible through third-party websites. The app is part of a larger SpyLoan malware operation, with similarities to previously identified malicious apps.

The threat involves a malicious mobile application named 'RapiPlata,' part of the SpyLoan malware family, which was distributed via both the Google Play Store and Apple App Store before being removed. The app was downloaded by over 150,000 users, primarily in Colombia, where it ranked in the top 20 finance apps. RapiPlata masquerades as a legitimate loan application but performs extensive unauthorized data collection and malicious activities. It gains access to highly sensitive user data, including SMS messages, call logs, calendar events, and lists of installed applications. This data is exfiltrated to attacker-controlled servers, enabling privacy violations and potential financial fraud. The app also engages in harassing users with messages and can approve loans without user consent, indicating a direct financial impact on victims. Despite removal from official app stores, the app remains accessible through third-party websites, increasing the risk of continued infections. The malware shares characteristics with other SpyLoan variants, suggesting a coordinated campaign targeting mobile users with predatory lending and data theft objectives. The indicators of compromise include numerous file hashes and malicious domains used for command and control or data exfiltration. The threat does not require user authentication beyond installation and likely requires user interaction to install, but once installed, it operates stealthily to harvest data and conduct fraudulent activities. No known exploits in the wild are reported, but the app’s presence in official stores prior to removal highlights gaps in app store security and the potential for widespread impact.

Detailed information about Malicious Loan App Removed from iOS and Google Play App Store Posed Severe Risks to Users. Get real-time updates, technical details, 

Malicious Loan App Removed from iOS and Google Play App Store Posed Severe Risks to Users - Live Threat Intelligence - Threat Radar | OffSeq.com

Malicious Loan App Removed from iOS and Google Play App Store Posed Severe Risks to Users

Threats Tagged 'sms scanning'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'sms scanning'

Lead Pen Test Professional