From Mobile Browsers to Cloud App Identities: Five Threats Stealing Sessions, Secrets, and Credentials
APT29-linked Poisoned Source mobile exploits, three no-interaction Android RCEs, Key Eater’s stolen Entra ID app secrets, Nyasher calendar phishing that relays MFA, and Gorbag’s WinRAR CVE-2025-8088 attacks on Ukraine. Patch phones, audit app identities, and revoke sessions.