ThreatsDay Uncovers 200 Android Bugs, Browser‑Based Phishing and Over 119,000 Fake Shops

This week’s security briefing, dubbed ThreatsDay, revealed a staggering collection of threats that span mobile platforms, web browsers, and online commerce. Researchers catalogued more than 200 distinct flaws affecting Android devices, identified a novel phishing method that leverages browser extensions, and estimated that roughly 119,000 fraudulent online stores are currently active.

The Android vulnerabilities range from privilege‑escalation bugs that could grant apps root‑level access to data‑exposure flaws that allow private information to be read without user consent. Many of the issues trace back to legacy components that have not received timely updates, putting older devices at particular risk. Security teams stress that the sheer volume of bugs will test Google’s monthly patch cycle and may leave some devices unprotected for weeks.

In the web arena, a new phishing chain exploits browser extensions that request far more permissions than they need. Once installed, these add‑ons can inject counterfeit login forms directly into trusted websites, effectively turning the browser itself into a phishing platform. Because the malicious pages appear within the context of a familiar domain, users are less likely to spot the deception, and the attack bypasses many traditional email‑filter defenses.

An old, well‑known bug resurfaced in recent campaigns, demonstrating that unpatched legacy code continues to be a lucrative target. Attackers are still able to trigger the flaw to execute arbitrary code, underscoring the importance of retiring or fully securing outdated software components rather than relying on temporary workarounds.

Separately, a misconfigured server that has been publicly exposed for months remains untouched, providing a steady source of data for cyber‑criminals. The open system hosts logs and configuration files that can reveal internal network structures, credentials, and other sensitive details, illustrating how a single exposed asset can amplify broader threat activity.

The report’s estimate of 119,000 scam shops highlights the scale of the e‑commerce fraud problem. These counterfeit storefronts mimic legitimate brands, lure shoppers with steep discounts, and harvest payment information. Law‑enforcement agencies and platform operators are scrambling to takedown the sites, but the sheer number makes comprehensive remediation a daunting task.

Analysts say the findings point to a systemic need for stricter permission reviews, faster vulnerability disclosure cycles, and heightened user education. As browsers and mobile ecosystems evolve, security teams urge developers to adopt zero‑trust principles and for users to scrutinize extension permissions and app updates. Ongoing monitoring and coordinated response efforts will be essential to curb the momentum of these interconnected threats.