CriticalPhishing
⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More
The Hacker News·Source published ·1 min read
What happened?
Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble. Then there were the bigger messes.
Key details
- North Korean group TraderTraitor stole $6.43B from Binance across 11 blockchains, 82% on Ethereum and Bitcoin, with $2.85B frozen on-chain by major issuers.
- Volt Typhoon built a covert relay network called Silent Train from compromised SOHO and IoT devices to hide origins of zero-day attacks on strategic infrastructure.
- DebugBear compromise led to Polymarket suspension; third-party JavaScript siphoned $2.7M from 33 deposit wallets in under an hour.
- Two tampered Claude Code extensions on Cursor Marketplace installed persistent SSH backdoors, impacting up to 5,000 users.
- uCreator Android spyware clones WeChat and other messaging accounts via repackaged legitimate apps sideloaded or socially engineered.
Affected
- Chrome extensions: 319 with 13.4M installs hijacked searches; 60 OffiDocs extensions with 2.3M installs exfiltrated URLs.
- Prediction market platform Polymarket temporarily suspended trading.
- Cursor marketplace: Claude Code extensions tampered with SSH backdoor; impacted up to 5,000 users.
Fixes and mitigations
- ChatGPT flaw patched by Parameter Labs.
What to look for
- Searchjacked: 319 Chrome extensions with 13.4M installs hijacked searches through tracking servers; captured queries and collected referral payments.
- OffiDocs: 60 Chrome extensions with 2.3M installs exfiltrated all URLs visited by users to third-parties or redirect pages.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.