Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

Threatpost

SecurityWeek

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

AWS Security Bulletins

GCP Kubernetes Security

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An investigation uncovered more than 20 cryptocurrency phishing applications on the Google Play Store impersonating legitimate wallets like SushiSwap and PancakeSwap. These malicious apps employ phishing techniques to steal users' mnemonic phrases, allowing access to real wallets and theft of funds. The apps share common patterns, including embedded C&C URLs in privacy policies and similar package names. They are distributed through compromised developer accounts previously used for legitimate apps. Two main types were identified: those using the Median framework and those directly loading phishing URLs into WebViews. The campaign demonstrates a coordinated operation with a large-scale phishing infrastructure linked to over 50 domains.

This threat involves a coordinated campaign distributing over 20 malicious cryptocurrency phishing applications on the Google Play Store. These apps impersonate legitimate decentralized finance (DeFi) wallet applications such as SushiSwap and PancakeSwap, which are popular platforms for cryptocurrency trading and liquidity provision. The malicious applications employ phishing techniques aimed at stealing users' mnemonic seed phrases — critical credentials that provide full access to cryptocurrency wallets. By capturing these phrases, attackers can gain unauthorized access to victims' wallets and steal their funds. The campaign is notable for its use of compromised developer accounts that were previously used to publish legitimate apps, allowing the malicious apps to bypass some of Google's app vetting processes. Two primary technical approaches were identified: one group of apps uses the Median framework, a known tool for building phishing apps, while the other group loads phishing URLs directly into embedded WebViews within the app, effectively presenting fake login or seed phrase input pages to users. The apps share common characteristics such as similar package names and embedded command and control (C&C) URLs hidden within privacy policy documents, indicating a well-organized infrastructure. The campaign is linked to a large-scale phishing infrastructure involving over 50 domains, suggesting a broad and persistent operation. Although no known exploits in the wild have been reported beyond this campaign, the threat poses a significant risk to cryptocurrency users relying on Android devices and the Google Play ecosystem. The attack leverages social engineering and app impersonation rather than exploiting software vulnerabilities, making it harder to detect by traditional antivirus or signature-based defenses.

Detailed information about Crypto Phishing Applications On The Play Store. Get real-time updates, technical details, and mitigation strategies.

Crypto Phishing Applications On The Play Store - Live Threat Intelligence - Threat Radar | OffSeq.com

Crypto Phishing Applications On The Play Store

Threats Tagged 'webview'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'webview'

Lead Pen Test Professional