In today’s cybersecurity news…

India orders web safety app

The Indian government has ordered smartphone makers to pre-install its state-owned cybersecurity app, Sanchar Saathi, on all new devices within 90 days and push it to existing phones. The app launched in January and helps block stolen phones, fraudulent connections, and recover lost devices. More than five million users have downloaded it. Apple and privacy advocates are expected to push back, because the mandate removes user choice and may conflict with Apple’s pre-sale app policies. (Al Jazeera)

Arrests over IP camera snooping

South Korean police arrested four people accused of hacking more than 120,000 IP cameras, with two suspects allegedly selling footage for around tens of thousands of dollars. In Australia, a 44-year-old received a minimum five-year sentence for running evil-twin Wi-Fi traps on flights and at airports to steal credentials and access victims’ private photos. And in the UK, a Norfolk man was sentenced to six and a half years for operating a dark-web drug business under the name DNMSoldiersNDD. (The Register)

Albiriox shows up on dark web

Android malware called Albiriox has shown up on Russian cybercrime forums, offering full device takeover and real-time fraud. Researchers at Cleafy say it targets more than 400 banking and crypto apps and started offering public subscriptions in October, starting at $650 per month. Early campaigns focused on Austrian users through phishing pages and a fake Google Play site distributing a trojanized “Penny Market” app. Albiriox supports VNC-based remote control, credential harvesting, UI automation, black-screen overlays, and uses Golden Crypt to evade detection. (Infosecurity Magazine)

ShadyPanda turns browser extensions into spyware

Koi Security reports that a China-linked group called ShadyPanda spent seven years turning once-legitimate Chrome and Edge extensions into spyware, affecting more than 4.3 million installs. Several extensions received malicious updates in mid-2024 that allowed hourly remote code execution, full browsing surveillance, encrypted data exfiltration, and adversary-in-the-middle attacks. Another batch of extensions logged every URL visit, query, click, and cookie, with WeTab alone reaching three million installs. (The Hacker News)

Huge thanks to our sponsor, Vanta

Authorities take down Cryptomixer

European authorities shut down Cryptomixer, a crypto-mixing service that allegedly laundered more than $1.5 billion in Bitcoin since 2016. As part of Operation Olympia, investigators seized nearly $28 million in Bitcoin, three servers in Switzerland, the domain, and 12TB of data. Europol called Cryptomixer a “platform of choice” for ransomware groups, fraud operations, and drug and weapons traffickers. (CyberScoop)

Coupang data breach impacts millions

South Korea’s largest retailer, Coupang, disclosed a data breach affecting 33.7 million customers. The incident was discovered November 18th and exposed names, phone numbers, emails, addresses, and order details, but not payment information or passwords. The breach reportedly began June 24th, possibly involving a former employee using unrevoked access tokens. Coupang has notified authorities and will inform affected users, urging vigilance against phishing. (BleepingComputer)

Malware manipulates AI detection in package breach

A malicious npm package was found using prompt text to manipulate AI-based code scanners, while actually operating as a supply chain compromise. It typosquatted the trusted ESLint plugin, ran a post-install hook, harvested environment variables, and exfiltrated data via a Pipedream webhook. Earlier versions were flagged in February 2024, but npm did not remove the package, which now has nearly 17,000 installs. (Infosecurity Magazine)

Dutch study: teen cybercrime a phase

A Dutch government report finds teenage cybercrime is largely a phase, with most offenders stopping by age 20. Only about 4% continue into adulthood, typically driven by ongoing curiosity and skill-building, rather than money. Cybercrime among teens is less common than property offenses but mirrors peak ages of other crimes. While the social cost of all adolescent crime in the Netherlands is €10.3 billion annually, cybercrime’s specific impact isn’t known. (The Register)