Hello and welcome to the Friday, October 24th, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu credit certificate program in incident

response. Info-stealers for Android written in Python, apparently that's a thing in Xavier came across

an example. This particular infestiler takes advantage Termux, a terminal emulator that is

available for Android. This terminal emulator also includes utilities that allow you to access

things like, for example, the address book and such from Android, and that then produces a simple

to parse JSON formatted output, and that then produces a simple to parse JSON formatted output and that is being

exfiltrated by this InfoSteeler. Xavier isn't sure how sort of the entire infections

change starts here in order to run the InfoStealer. The victim essentially already has

thermox running. It's possible that the attacker uses social engineering or essentially just

counts on victims that already have these tools installed on their Android phone.

And e-commerce security company S Sansec, has observed the active exploitation of a

recently patched Adobe Commerce vulnerability.

Adobe Commerce, also known as Magento, is an e-commerce application that always focus on when

we have like Adobe patches, because in the past

vulnerabilities in this application have repeatedly been abused and have been exploited. So no big

difference here for this vulnerability. It also goes by the name of Session Reaper. The problem

is that an attacker is able to basically create a malicious session and then take

advantage of a deseralization vulnerability that will then execute arbitrary code.

Proof-of-concept code has been made available, has been made public, so it's no big surprise

here that this vulnerability is actively being exploited.

...