Blog

by Chris H Chris H No Comments

Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign

The Russia-linked threat actor known as APT28 (aka Forest Blizzard) has been linked to a new campaign that has compromised insecure MikroTik and TP-Link routers and modified their settings to turn them into malicious infrastructure under their control as part of a cyber espionage campaign since at least May 2025.
The large-scale exploitation campaign has been codenamed 
by Chris H Chris H No Comments

$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation

Drift has revealed that the April 1, 2026, attack that led to the theft of $285 million was the culmination of a months-long targeted and meticulously planned social engineering operation undertaken by the Democratic People’s Republic of Korea (DPRK) that began in the fall of 2025.
The Solana-based decentralized exchange described it as “an attack six months in the
by Chris H Chris H No Comments

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale.
Cisco Talos has attributed the operation to a threat cluster it tracks as
by Chris H Chris H No Comments

Iran-Linked Hackers Breach FBI Director’s Personal Email, Hit Stryker With Wiper Attack

Threat actors with ties to Iran successfully broke into the personal email account of Kash Patel, the director of the U.S. Federal Bureau of Investigation (FBI), and leaked a cache of photos and other documents to the internet.
Handala Hack Team, which carried out the breach, said on its website that Patel “will now find his name among the list of successfully hacked victims.” In a statement
by Chris H Chris H No Comments

AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE

Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries.
In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter’s sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells
by Chris H Chris H No Comments

Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

A suspected China-based cyber espionage operation has targeted Southeast Asian military organizations as part of a state-sponsored campaign that dates back to at least 2020.
Palo Alto Networks Unit 42 is tracking the threat activity under the moniker CL-STA-1087, where CL refers to cluster, and STA stands for state-backed motivation.
“The activity demonstrated strategic operational patience and
by Chris H Chris H No Comments

Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations

Threat hunters have called attention to a new campaign as part of which bad actors masqueraded as fake IT support to deliver the Havoc command-and-control (C2) framework as a precursor to data exfiltration or ransomware attack.
The intrusions, identified by Huntress last month across five partner organizations, involved the threat actors using email spam as lures, followed by a phone call from
by Chris H Chris H No Comments

Google Disrupts UNC2814 GRIDTIDE Campaign After 53 Breaches Across 42 Countries

Google on Wednesday disclosed that it worked with industry partners to disrupt the infrastructure of a suspected China-nexus cyber espionage group tracked as UNC2814 that breached at least 53 organizations across 42 countries.
“This prolific, elusive actor has a long history of targeting international governments and global telecommunications organizations across Africa, Asia, and the Americas,”
by Chris H Chris H No Comments

APT28 Targeted European Entities Using Webhook-Based Macro Malware

The Russia-linked state-sponsored threat actor tracked as APT28 has been attributed to a new campaign targeting specific entities in Western and Central Europe.
The activity, per S2 Grupo’s LAB52 threat intelligence team, was active between September 2025 and January 2026. It has been codenamed Operation MacroMaze. “The campaign relies on basic tooling and the exploitation of legitimate services
by Abinaya Abinaya No Comments

Google Blocked 1.75 Million Malicious Apps from Entering into the Play Store

AI-powered security systems blocked over 1.75 million malicious or policy-violating apps from reaching the Play Store in 2025, strengthening Android security.

According to Google’s latest Android and Google Play security update, the company blocked over 1.75 million apps during the review process.

The apps were flagged for policy violations, including embedded malware, financial fraud, aggressive data collection, and hidden subscription abuse.

Google also banned more than 80,000 “bad developer” accounts linked to harmful or deceptive apps, cutting off repeat offenders from re-entering the ecosystem under new identities.

Every submitted app now undergoes more than 10,000 automated and manual safety checks, with Google stating that these measures are designed to prevent real-world harm before apps ever reach user devices.

Safeguards block bad apps tools ease compliance(source : Google Blog)
Safeguards block bad apps, tools ease compliance (source: Google Blog)

Strengthening Privacy Controls and Data Protection

Google says it has heavily integrated its latest generative AI models into the Play review pipeline, enabling security teams to spot complex, evolving malicious patterns faster than before.

These models work alongside human reviewers to detect obfuscated behaviors, suspicious permission usage, and fraud indicators that may not be obvious from static analysis alone.

The company reports that its strengthened pre-review checks, developer verification, and mandatory testing requirements are discouraging many bad actors from even attempting to publish malicious apps on Google Play.

Expanded Play Protect to fight scams(source : Google Blog)
Expanded Play Protect to fight scams (source: Google Blog)

Beyond blocking app submissions, Google prevented more than 255,000 apps from obtaining excessive access to sensitive user data by enforcing stricter privacy controls and permission policies.

To protect the integrity of ratings and user trust, anti-spam systems blocked around 160 million fake or manipulative reviews, avoiding an average 0.5-star rating drop for apps targeted by coordinated review bombing campaigns.

For families, Google has also introduced new layers of protection to stop children from discovering or downloading apps related to high-risk categories such as gambling or dating.

New Security Tools for Android Developers

Google Play Protect, Android’s built-in malware defense, now scans over 350 billion apps every day across the Play Store and sideloaded sources.

In 2025, its real-time scanning identified more than 27 million new malicious apps distributed outside Google Play, warning users or blocking installations outright to neutralize threats before they could execute.

Security Tool / Feature Purpose 2025 Update Protection Benefit
Play Policy Insights (Android Studio) Real-time policy guidance Lint-style checks flag risky permissions & APIs Prevents policy violations before submission
Pre-review checks (Play Console) Catch compliance issues early Automated checks for credentials, permissions & privacy links Blocks misconfigured or risky apps
Play Integrity API Verify app & device integrity Hardware-backed signals, stronger attestation, device recall Detects fraud, tampering & compromised devices
Developer verification Strengthen developer identity checks Expanded verification & new account types Reduces abuse from fake/throwaway accounts
Android 16 security APIs Protect sensitive app flows Tapjacking & overlay attack protections Prevents credential theft & UI hijacking

Enhanced fraud protection within Play Protect is now deployed in 185 markets and covers over 2.8 billion Android devices.

Android security relies on developer collaboration and feedback(source : Google Blog)
Android security relies on developer collaboration and feedback (source: Google Blog)

Blocked 266 million risky sideloading attempts tied to approximately 872,000 unique high-risk apps, many of them designed for financial fraud via abusive permissions.

To support developers, Google expanded Play Policy Insights in Android Studio, providing real-time feedback on risky permissions and policy compliance during development rather than only at submission time.

The Play Integrity API, now handling more than 20 billion checks per day, gained hardware-backed signals and in-app prompts to help apps defend against abuse, spoofed devices, and unauthorized access while preserving user privacy.

Looking ahead, Google plans to roll out broader developer verification across the Android ecosystem and continue investing in AI-driven defenses.

Aiming to make malicious apps increasingly unviable while helping legitimate developers build secure, compliant apps by design.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Google Blocked 1.75 Million Malicious Apps from Entering into the Play Store appeared first on Cyber Security News.

Top