Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
Browser leaks extensive data (e.g., audio, CSS features, device info) revealing unique characteristics for fingerprinting. This tool analyzes and displays default information exposed by browsers, highlighting potential privacy concerns. Users are advised to use anti-fingerprinting measures.
Google's December 2025 Android security update fixes 107 vulnerabilities, including two exploited in attacks. Major issues address information disclosure and elevation of privileges. Critical flaws also include a denial-of-service vulnerability in the Android Framework and several severe vulnerabilities in the Kernel affecting Qualcomm devices. Users should update to newer Android versions or use third-party distributions for security.
4.3M Browsers Infected by ShadyPanda Malware: A seven-year campaign leveraged malicious browser extensions infecting 4.3 million Chrome and Edge users. ShadyPanda employed a phased strategy, transitioning from affiliate fraud to spyware. Initially, they disguised malicious extensions as legitimate tools, then progressively escalated operations to include remote code execution and comprehensive data surveillance. The extensions, some Google-verified, captured and exfiltrated extensive user data, exploiting marketplace oversight flaws. Despite termination of some extensions, others remain active with significant surveillance capabilities, highlighting systemic security vulnerabilities in extension marketplaces.
https://www.koi.ai/blog/4-million-browsers-infected-inside-shadypanda-7-year-malware-campaign
Cybercriminals exploit browser push notifications via the Matrix Push C2 platform to deliver malware and phishing attacks. Users are deceived into granting permission through misleading prompts, allowing attackers to send fake alerts and gather personal data. The platform enables detailed monitoring of victims and custom URL management for malicious campaigns, often resulting in data theft or financial loss. Users are advised to manage notification permissions across their browsers to mitigate these risks.
Summary: Browser fingerprinting compromises online privacy by creating unique identifiers from browser information, making tracking harder to evade than traditional cookies. While steps like using VPNs and popular browsers can mitigate risks, effective resistance is challenging and often inconvenient. Legal clarity on fingerprinting is lacking, and stronger legislation is needed to address its privacy threats. Overall, fingerprinting remains a significant concern, contributing to intrusive advertising practices.
A recent cyber threat, “Matrix Push,” uses browser notifications for phishing attacks, exploiting legitimate API requests. Infections happen through social engineering, allowing attackers to send deceptive alerts disguised as genuine notifications. To combat these threats, stronger browser protections, user vigilance, and security tools are essential.
Lumma Stealer, also known as Water Kurita, has resurfaced with new tactics after an initial drop in activity following the public disclosure of its core members' identities. Since late October 2025, it has employed browser fingerprinting in conjunction with its traditional command-and-control approaches to evade detection, gather extensive data on the victim's environment, and maintain operational continuity. The malware injects itself into trusted browser processes, collects detailed system and browser information via JavaScript, and sends this data back to its command-and-control (C&C) servers stealthily. Despite some operational setbacks and reduced public presence, Lumma Stealer remains active, with operators likely keeping a low profile to avoid further scrutiny. Organizations are advised to enhance email vigilance, restrict software installations, monitor for suspicious CAPTCHA behaviors, and utilize MFA, while Trend Vision One tools detect and aid in identifying relevant compromise indicators.
https://www.trendmicro.com/en_us/research/25/k/lumma-stealer-browser-fingerprinting.html
BiDi Swap vulnerability exploits text direction mix in browsers to create deceptive URLs for phishing. It builds on past Unicode tricks like Punycode homograph attacks. Awareness and improved browser protections are essential to combat this risk.
Security Vulnerability in AI Browsers: OpenAI's Atlas and Perplexity's Comet browsers are susceptible to AI sidebar spoofing attacks, allowing hackers to deceive users into executing harmful instructions. Researchers from SquareX demonstrated that malicious extensions can overlay a fake AI sidebar, leading users to phishing sites, compromising Google accounts, or executing harmful commands. Users are advised to restrict sensitive activities on these browsers due to their current security weaknesses.
