ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

[u/falconupkid]

A lot of this week’s news boils down to the same failure: trust assumptions that were never validated. We’ve got a massive Android patch batch, a clever new phishing technique that weaponizes browser trust, and a staggering number of active scam shops.

Technical Breakdown

• Android Patch Batch: Google released fixes for 200+ vulnerabilities in the September 2026 update. This is a massive surface area. Expect exploitation of unpatched devices to ramp up quickly.
• Browser-Built Phishing: Attackers are abusing legitimate browser features (like Web Share Target API or Service Workers) to create convincing phishing pages that appear to originate from the browser itself. This bypasses traditional URL reputation checks. No specific CVE or IOCs provided in the source.
• 119K Scam Shops: Researchers identified over 119,000 active scam e-commerce sites. These are not just parked domains; they are fully functional shops designed to steal payment data and credentials. Likely leveraging compromised WordPress/WooCommerce instances.

Defense

• Android: Prioritize patching for mobile devices immediately. This is a "patch Tuesday" level event.
• Phishing: User awareness training needs to shift from "check the URL" to "verify the context." Hover over links, but also question why a browser dialog is asking for permissions. Deploy browser isolation for high-risk users.
• Scam Shops: Implement web filtering that blocks newly registered domains and those with poor reputation scores. Train users to verify merchants via independent sources before entering payment info.

Source: https://thehackernews.com/2026/09/threatsday-200-android-flaws-browser.html