A sophisticated cybercriminal campaign has emerged targeting Indonesian and Vietnamese Android users with banking trojans disguised as legitimate government identity applications and payment services.

The malicious operation, active since approximately August 2024, employs advanced evasion techniques to deliver variants of the BankBot trojan family while maintaining an extensive infrastructure of over 100 domains.

The threat actors demonstrate significant operational sophistication through their use of fake Google Play Store pages and government service applications such as M-Pajak tax payment services and digital identity verification systems.

The campaign exploits user trust in official government platforms, creating highly convincing replicas that deceive victims into downloading malicious APK files containing banking trojans capable of stealing sensitive financial information and credentials.

DomainTools analysts identified the malware distribution pattern through monitoring suspicious site elements associated with spoofed Google Play Store websites.

The researchers uncovered an elaborate delivery mechanism designed to bypass traditional network security controls and evade automated detection systems commonly employed by cybersecurity frameworks.

Advanced WebSocket-Based Delivery Mechanism

The threat actors employ a remarkably sophisticated malware delivery system that leverages WebSocket technology to circumvent conventional security measures.

Rather than providing direct download links that security scanners can easily detect, the malicious sites utilize the Socket.IO library to establish real-time bidirectional communication channels between victim browsers and command servers.

When users click the Android download button, the system initiates a WebSocket connection using the command socket. Emit('startDownload', …).

The server responds by transmitting the malicious APK file in fragmented chunks rather than as a complete file transfer.

The browser collects these fragments through event listeners coded as socket. On('chunk', (chunk) => { chunks. Push(chunk); });, while simultaneously receiving progress updates that maintain the illusion of a legitimate download process.

Upon completion, the system combines all received chunks in memory and assigns the MIME type application/vnd.android.package-archive to create a proper APK file structure.

The delivery mechanism then generates a temporary local URL and programmatically triggers an invisible download link, prompting the browser’s standard file download interface.

This elaborate process effectively disguises malware distribution as encrypted WebSocket traffic, allowing malicious payloads to bypass network security systems configured to block direct APK downloads while remaining invisible to static URL-based security scanners that crawl websites for malicious links.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Banking Trojans Attacking Android Users Mimic as Government and Legitimate Payment Apps appeared first on Cyber Security News.

A critical stored cross-site scripting vulnerability has emerged in the popular DotNetNuke (DNN) Platform, threatening websites powered by this widely-used content management system.

The vulnerability, tracked as CVE-2025-59545 with a severity score of 9.1 out of 10, affects all DNN Platform versions prior to 10.1.0 and allows attackers to execute malicious scripts through the platform’s Prompt module.

The security flaw stems from the way DNN’s Prompt module processes commands that return raw HTML output.

While the platform typically sanitizes user-submitted data before displaying it in entry forms, the Prompt module bypasses these standard sanitation mechanisms by treating command output as executable HTML.

This creates a dangerous pathway for attackers to inject and execute malicious scripts within the application’s trusted environment.

The vulnerability poses significant risks to organizations running affected DNN installations, particularly when exploited in super-user contexts.

Attackers can craft malicious input containing embedded scripts or harmful markup that, when processed through specific Prompt commands, gets rendered directly in browsers without proper security validation.

Github analysts identified this critical weakness through comprehensive security research, highlighting the importance of continuous platform monitoring for emerging threats.

Attackers leverage this vulnerability by targeting the network-accessible Prompt module with relatively low complexity attack vectors.

The exploitation requires minimal privileges and user interaction, making it an attractive target for malicious actors seeking to compromise DNN-powered websites.

Once successfully exploited, the vulnerability can impact system confidentiality, integrity, and availability across changed security scopes.

Exploitation Mechanism and Attack Vectors

The attack mechanism revolves around the fundamental design flaw in how the Prompt module handles command execution and output rendering.

When an attacker submits crafted input through the module, the system fails to distinguish between legitimate HTML output and malicious script content.

The vulnerability manifests when specific commands process untrusted data and return it as HTML, effectively bypassing the application’s security boundaries.

The attack vector follows a stored XSS pattern, categorized under CWE-79 weakness classification.

Malicious payloads can be persistently stored within the system and executed whenever the compromised content is accessed.

This persistence factor amplifies the vulnerability’s impact, as it affects not only the initial victim but potentially all subsequent users who interact with the compromised content.

Organizations using affected DNN Platform versions should immediately upgrade to version 10.1.0, which includes comprehensive patches addressing this critical security flaw.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Critical DNN Platform Vulnerability Let Attackers Execute Malicious Scripts appeared first on Cyber Security News.