https://blog.dansec.red/vendors/appsflyer/Recent content in AppsFlyer on DanSec DailyHugoen-gbSun, 15 Mar 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-03-15-cybersecurity-news/Sun, 15 Mar 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-03-15-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>The AppsFlyer Web SDK was hijacked in a supply-chain attack, with malicious JavaScript code injected to steal cryptocurrency from users. The attack was temporary but impacted the integrity of the SDK, potentially affecting numerous websites and their users.</li> <li>A hacker reportedly gained unauthorised access to FBI files related to the Epstein investigation. The breach was accidental but highlights the exposure of sensitive law enforcement data.</li> <li>A porn-quitting app exposed the personal habits of hundreds of thousands of users due to a data leak, revealing sensitive behavioural information.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Multiple flaws have been identified in OpenClaw (formerly Clawdbot and Moltbot), an open-source AI agent. These vulnerabilities enable prompt injection and data exfiltration, raising concerns about the security of AI agent platforms, as highlighted by a warning from China&rsquo;s CNCERT.</li> <li>A critical vulnerability in HPE AOS-CX networking devices allows remote, unauthenticated attackers to reset admin passwords, bypassing authentication controls.</li> <li>Microsoft released an out-of-band (OOB) update for Windows 11 Enterprise to address a remote code execution (RCE) flaw in the Routing and Remote Access Service (RRAS) component. The update targets devices that receive hotpatch updates outside the regular Patch Tuesday cycle.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The GlassWorm campaign has escalated its tactics, now abusing 72 extensions in the Open VSX registry in a supply-chain attack targeting software developers. This represents a significant expansion in the campaign&rsquo;s reach and impact.</li> <li>Russian threat actors are attempting to compromise Signal accounts belonging to individuals, as reported in the context of broader cyber operations.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>The GlassWorm campaign’s use of supply-chain attacks via popular developer tool registries demonstrates ongoing targeting of development environments to propagate malware.</li> <li>Increased targeting of AI agent platforms (e.g., OpenClaw) via prompt injection and data exfiltration underscores emerging risks associated with the adoption of generative AI tools.</li> <li>The hijacking of widely-used SDKs, such as AppsFlyer’s, for cryptocurrency theft reflects continued exploitation of trusted software supply chains.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>China’s National Computer Network Emergency Response Technical Team (CNCERT) has issued a formal warning regarding the security risks of AI agent platforms, specifically referencing OpenClaw, highlighting increased regulatory attention to AI-related vulnerabilities.</li> </ul>