Security firm CloudSEK uncovered a sophisticated smishing campaign that disguises a fake Red Alert APK as an official wartime update, allowing attackers to steal contacts, messages, GPS data and verification codes, turning a life‑saving warning app into a serious information‑security threat.
A recent security investigation reveals that over 300 seemingly harmless browser extensions were covertly hijacked by the DarkSpectre campaign, silently collecting browsing history, meeting data, and other personal information from more than 8.8 million users across Chrome, Edge, and Firefox for up to seven years.
Researchers demonstrate that even computers isolated from networks can exfiltrate secret data by modulating fan speed to create vibrations that a nearby smartphone’s accelerometer can capture and decode, revealing a new low‑bandwidth side‑channel attack called AiR‑ViBeR.
The article explains how OS command injection can be leveraged for blind data exfiltration and demonstrates practical techniques using tools such as Netcat, cURL, Wget, SMB, Telnet, ICMP and DNS, along with preventive measures to mitigate such vulnerabilities.
