From app stores to online shopping platforms, cybercriminals are exploiting trust to infiltrate systems and steal sensitive data. Eight trojan-infected Android apps were spotted on the Google Play Store, downloaded over two million times. These apps, containing Android.FakeApp.1669, connect to malicious DNS servers to display deceptive links.

Meanwhile, the CISA has issued a warning about two critical vulnerabilities in Palo Alto Networks Expedition software, citing active exploitation. These flaws allow attackers to execute commands as root and access sensitive database contents. 

In another alarming campaign, Chinese threat actor SilkSpecter has created over 4,500 fake domains impersonating brands like North Face and Ikea to steal credit card details from shoppers in the U.S. and Europe. 

Top Malware Reported in the Last 24 Hours

New info-stealer in threat landscape

The new Glove Stealer malware was found to bypass Google Chrome's Application-Bound encryption to steal browser cookies. The malware is simple and lacks protection mechanisms, suggesting it is in the early stages of development. The threat actors behind the malware use social engineering tactics to trick victims into installing it. The malware can extract cookies from Firefox and Chromium-based browsers, as well as steal cryptocurrency wallets, 2FA tokens, passwords, and emails. 

Eight trojanized apps on Play Store

Dr. Web discovered eight Android apps on the Google Play Store containing a trojan called Android.FakeApp.1669 (Android/FakeApp). Over two million users downloaded these infected apps. This variant of the Android/FakeApp trojan uses a modified library to receive commands from a malicious DNS server, displaying unwanted links instead of the advertised function. The malware activates only under specific conditions when connected to certain mobile data providers, making it hard to detect. 

Top Vulnerabilities Reported in the Last 24 Hours

High-severity bug in PostgreSQL

A high-severity security flaw (CVE-2024-10979) in PostgreSQL can allow unauthorized users to change environment variables and potentially execute code or expose information. PostgreSQL warned that unprivileged users can manipulate environment variables like PATH, leading to code execution, even without server privileges. The issue has been fixed in the latest PostgreSQL versions. Researchers noted severe security risks like arbitrary code execution or unauthorized access through malicious queries. 

CISA adds two new flaws to KEV catalog

The CISA issued a warning about two new vulnerabilities in the Palo Alto Networks Expedition software, which are being actively exploited. They have been added to the KEV catalog. The vulnerabilities are OS Command Injection (CVE-2024-9463) and SQL Injection (CVE-2024-9465), which can allow unauthorized access to run commands as root or expose database contents, potentially revealing sensitive information like usernames, passwords, configurations, and keys. Palo Alto Networks addressed these in an update on October 9. 

Fortinet patches VPN app flaw

A high-severity bug in Fortinet's FortiClient VPN application was discovered, allowing a low-privilege user or malware on a Windows system to gain higher privileges, execute code, possibly take over the system, and delete log files. The bug, tracked as CVE-2024-47574, has a severity rating of 7.8 out of 10 and affects several versions of FortiClientWindows. A second security oversight allows unauthorized access to system-level registry keys. While the latter flaw, CVE-2024-50564, has not been officially addressed by Fortinet, it has been fixed in the latest version. Exploiting the bugs involves using Windows named pipes with FortiClient software and a hard-coded local API encryption key to gain unauthorized access and execute code. 

Top Scams Reported in the Last 24 Hours

North Korean IT cluster involved in phishing attacks

Unit 42 researchers discovered a group of North Korean IT workers, referred to as CL-STA-0237, involved in phishing attacks using malware-infected video conference apps, operating primarily from Laos. This group exploited a U.S.-based IT services company to apply for jobs and succeeded in getting hired by a major tech company in 2022. The team found newly registered domains linked to a known IP address associated with the MiroTalk fake job campaign, revealing that CL-STA-0237 exploited information and controlled multiple accounts belonging to the U.S.-based IT company. 

Massive fraud network steals credit cards

A Chinese threat actor named SilkSpecter is running a scam using fake online stores to steal credit card information from shoppers in the U.S. and Europe. SilkSpecter operates 4,695 fake domains impersonating popular brands like North Face, Lidl, and Ikea. The scam uses domain names containing "Black Friday" to target bargain hunters. Sites adjust language based on location using Google Translate. They use legitimate payment processor Stripe to appear trustworthy while stealing card details. SilkSpecter tracks visitors' behavior with tools like OpenReplay and uses phishing kits to steal card information. The scam may use stolen phone numbers for two-factor authentication in future attacks.