SANS Internet StormCast

SANS Stormcast Wednesday, March 4th, 2026: CrushFTP Brute Force; Android Patches 0-Day; 0Auth Phishing Abuse

In this 5‑minute Stormcast, Johannes Ulrich covers three security topics: a credential‑guessing campaign targeting CrushFTP admin accounts using default usernames and passwords, the latest Android Patch Tuesday which includes a critical Qualcomm display driver flaw already being exploited, and a new OAuth‑based phishing technique that abuses redirect URLs to deliver malware. He emphasizes that the CrushFTP issue stems from poor password choices, not a software flaw, and urges admins to enforce strong credentials. The Android update fixes a memory‑management vulnerability, highlighting the need for timely device patches despite carrier delays. Finally, he explains how attackers manipulate OAuth flows to trick users into downloading malware, and reminds listeners to secure Google API keys to avoid costly exposure.