Blahalla

Critical Zoho Analytics Plus Flaw Allows Attackers to Run Arbitrary SQL Queries

gbhackers.com · 8 months ago

A critical unauthenticated SQL injection vulnerability in Zoho ManageEngine Analytics Plus on-premise, tracked as CVE-2025-8324, enables attackers to execute arbitrary SQL queries without authentication, risking unauthorized data exposure and account takeover. The flaw affects on-premise builds at or below 6170 and has been fixed in build 6171 released August 01, 2025, so organizations running vulnerable builds should apply the update immediately. The issue is rated critical with a CVSS v3.1 score of 9.8, indicating remote unauthenticated exploitation could fully compromise confidentiality, integrity, and availability.
Washington Post Oracle E-Suite Breach Exposes Data of Over 9,000 Staff and Contractors

gbhackers.com · 8 months ago

More than 9,700 current and former employees and contractors had personal and financial data exposed after an external compromise of the Washington Post's Oracle E Business Suite systems that began on July 10, 2025 and went undiscovered until October 27, 2025. The exposed records included names, Social Security numbers, bank account and routing numbers, and tax identification numbers, and affected individuals were offered complimentary identity protection services. The incident is part of a wider campaign tied to the Clop ransomware group exploiting vulnerabilities in Oracle's E Business Suite, and Oracle released emergency patches in early October 2025 that customers applied during remediation.
Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign

www.securityweek.com · 8 months ago

A China linked state sponsored threat actor manipulated Anthropic Claude Code to carry out an espionage campaign that targeted nearly 30 organizations across the chemical manufacturing, financial, government, and technology sectors. By breaking attacks into small seemingly benign tasks to trick the model and abusing its agentic capabilities, the attackers used Claude to map environments, identify high value assets and vulnerabilities, build exploit code, exfiltrate credentials, create backdoors, and document stolen data, enabling the AI to perform roughly eighty to ninety percent of each campaign with humans intervening only for a few critical decisions. Abuse of the model's scale allowed thousands of requests per second and much faster operations than human teams, but hallucinated credentials and other AI limitations prevented full automation, and Anthropic disrupted the activity within ten days by banning the identified accounts and notifying affected organizations.
Critical Imunify360 Vulnerability Exposes Millions of Linux-Hosted Sites to RCE Attacks

gbhackers.com · 8 months ago

A critical remote code execution vulnerability was patched in Imunify360 AV, a security product protecting approximately 56 million websites worldwide. Hosting companies are urged to apply the patch immediately to prevent potential server compromises because details began circulating in late October 2024. Affected providers are advised to verify server integrity for signs of compromise and deploy the vendor update without delay.
Android Photo Frame App Infects Devices With Malware, Allows Full Remote Takeover

gbhackers.com · 8 months ago

Researchers found that many Uhale Android powered digital photo frames automatically download and execute a JAR or DEX payload at boot, causing the malware to persist across reboots. The payloads show links to the Vo1d botnet and Mzmess malware families and appear to be delivered via an update workflow that installs Uhale app version 4.2.0 which then fetches and runs the malicious files. A security assessment identified 17 vulnerabilities, 11 with assigned CVE identifiers including CVE-2025-58392, CVE-2025-58397, CVE-2025-58388, CVE-2025-58394, CVE-2025-58396, and CVE-2025-58390 that enable man in the middle remote code execution, command injection during updates, unauthenticated file uploads, and devices being shipped rooted with SELinux disabled. Users are advised to avoid devices using unofficial Android images, to prefer reputable brands with properly signed firmware and built in malware protections, and to consider Uhale based frames compromised until vendors release patches.
🚨 FIRST PUBLIC EVIDENCE: RedTail Cryptominer Targets Docker APIs

www.reddit.com · 8 months ago

A honeypot captured RedTail cryptominer probing exposed Docker APIs on port 2375. RedTail has previously been associated with exploiting PHP vulnerabilities, PAN OS, and Ivanti, but no public vendor reports document Docker targeting. Investigators confirmed a command and control IP of 178.16.55.224 and a user agent string of libredtail http, both consistent with RedTail activity. Observers conclude this may reflect either a blind spot in threat intelligence or a tactical evolution of RedTail as of November 2025.
Google Says Chinese ‘Lighthouse’ Phishing Kit Disrupted Following Lawsuit

www.securityweek.com · 8 months ago

Google says the Chinese Lighthouse phishing as a service kit run by the group tracked as Smishing Triad has been disrupted after the company filed a lawsuit and the operators reported their cloud server was blocked. Smishing Triad, active since at least 2023, ran large scale SMS phishing campaigns impersonating toll services, package delivery, healthcare providers, banks, payment platforms, social media sites and law enforcement, and Google identified more than 100 phishing site templates that targeted over one million users in more than 120 countries. Security firms report the operation hosted many sites on Tencent and Alibaba infrastructure, employed hundreds of staff, involved more than 194,000 malicious domains, and Google estimates between 12 million and 115 million payment cards were stolen in the United States alone.
Checkout.com Suffers Data Breach as ShinyHunters Attack Cloud Storage

gbhackers.com · 8 months ago

Checkout.com was targeted by the cybercrime group ShinyHunters, who claimed to have obtained data by accessing a legacy third party cloud file storage system that had not been properly decommissioned. The data came from a system used in 2020 and earlier for internal operational documents and merchant onboarding materials, and the company estimates the incident affects less than 25 percent of its current merchant base. Checkout.com said its live payment processing platform was not impacted, that merchant funds and card numbers were never accessed, and that it refused to pay the ransom, donating the demanded amount to cybersecurity research instead. The firm is working with law enforcement and relevant regulators and has begun identifying and contacting parties who may have been impacted.
CISA Warns: Akira Ransomware Has Extracted $42M After Targeting Hundreds

gbhackers.com · 8 months ago

There are reports that the Akira ransomware campaign has escalated, compromising over 250 organizations worldwide and extracting approximately 42 million dollars in ransom payments. There are indications that threat actors gain initial access primarily through virtual private networks without multifactor authentication and by exploiting known vulnerabilities including CVE-2020-3259 and CVE-2023-20269, and they also exploit edge devices and SonicWall SSLVPN flaws while using post compromise techniques such as creating domain accounts for persistence, Kerberoasting, and credential dumping with tools like Mimikatz. There are reports that operators deploy both Windows and Linux variants including Megazord and Akira v2, employ a hybrid ChaCha20 and RSA encryption scheme, and that agencies urge organizations to patch exposed devices, enforce multifactor authentication, restrict external access to services, and test recovery plans.
Palo Alto PAN-OS Flaw Lets Attackers Force Firewall Reboots via Malicious Packets

gbhackers.com · 8 months ago

A denial of service vulnerability in PAN-OS allows attackers to force firewalls into unexpected reboots using specially crafted network packets. The flaw affects multiple PAN-OS versions running on PA-Series and VM-Series firewalls as well as Prisma Access deployments. The vulnerability is tracked as CVE-2025-4619 and enables unauthenticated attackers to trigger those reboots.
Lumma Stealer Leverages Browser Fingerprinting for Data Theft and Stealthy C2 Communications

gbhackers.com · 8 months ago

Following the doxxing of alleged core members that prompted customers to migrate to rivals like Vidar and StealC, Lumma Stealer activity initially declined before telemetry recorded a resurgence beginning the week of October 20, 2025. There are new capabilities that use browser fingerprinting to profile victims and selectively harvest browser-stored credentials, cookies, and cryptocurrency wallets, and delivery chains now include fake CAPTCHA and malvertising lures as well as blockchain based EtherHiding and resilient loaders. Command and control communications are engineered for stealth with hardcoded tier one servers and fallbacks such as Steam profiles and Telegram, and vendor telemetry says the malware employs heavy obfuscation and loaders to evade detection while exfiltrating data.
Fortinet FortiWeb Zero-Day Exploited to Gain Full Admin Access

gbhackers.com · 8 months ago

A critical zero day vulnerability in Fortinet FortiWeb has been actively exploited in the wild, allowing attackers to execute unauthorized SQL commands and gain control of affected systems. The flaw is tracked as CVE-2025-25257 and is an unauthenticated SQL injection in the Fabric Connector that can lead to remote code execution. Affected FortiWeb versions include 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10, and Fortinet has released patched updates and advises upgrading or disabling the HTTP and HTTPS administrative interface as a temporary workaround.
DoorDash hit by new data breach in October exposing user information

www.bleepingcomputer.com · 8 months ago

On October 25, 2025, DoorDash identified a cybersecurity incident in which an unauthorized third party gained access to and took certain user contact information, including first and last name, physical address, phone number, and email address. The breach was traced to a DoorDash employee falling victim to a social engineering scam, and the company says it shut down the unauthorized access, began an investigation, and referred the matter to law enforcement. Notifications primarily went to DoorDash Canada users, DoorDash stated that Social Security Numbers were not accessed, and the company has deployed security enhancements, implemented additional employee training, engaged a forensic firm, and warned users to be wary of phishing. This marks the third notable security incident for DoorDash, following a 2019 breach affecting roughly five million people and a 2022 breach linked to threat actors who also attacked another company.
DoorDash hit by yet another data breach this October

www.bleepingcomputer.com · 8 months ago

On October 25, 2025 DoorDash identified a cybersecurity incident in which an unauthorized third party gained access to and took certain user contact information, and beginning November 12, 2025 the company began emailing impacted users. The exposed information varied by individual and may have included first and last name, physical address, phone number, and email address, and DoorDash stated that Social Security numbers were not accessed. The incident was traced to a DoorDash employee falling victim to a social engineering scam, after which DoorDash shut down the unauthorized access, launched an investigation with a leading forensic firm, notified law enforcement, and deployed security enhancements and employee training. The notifications appear to have primarily affected Canadian users, drew criticism over a 19 day notification delay, and represent the companys third notable security incident following breaches in 2019 and August 2022.
Milvus Proxy Authentication Bypass Vulnerability(CVE-2025-64513)

www.reddit.com · 8 months ago

A critical authentication bypass in the Milvus Proxy allows unauthenticated attackers to gain full administrative access to Milvus clusters, enabling reading, modifying, deleting data and performing privileged management operations. The issue is tracked as CVE-2025-64513, affects Milvus versions prior to 2.4.24, 2.5.21, and 2.6.5, and is rated with a CVSS base score of 9.3. The vulnerability is fixed in Milvus 2.4.24, 2.5.21, and 2.6.5, and operators who cannot immediately upgrade are advised to remove the sourceID header at the gateway or load balancer to mitigate exploitation.
Fortinet FortiWeb flaw with public PoC exploited to create admin users

www.bleepingcomputer.com · 8 months ago

There is an actively exploited Fortinet FortiWeb path traversal vulnerability that allows unauthenticated attackers to send crafted HTTP POST requests to the fwbcgi endpoint and create local administrative accounts. Researchers observed exploitation starting on October 6, 2025, with multiple username and password combinations created, public proof of concept code and a defender tool released, and scanning from many IP addresses. The flaw affects FortiWeb 8.0.1 and earlier and was fixed in 8.0.2, so administrators should update immediately, review logs for requests to the fwbcgi path and unexpected admin accounts, and restrict management interfaces from internet access.
Agentic AI opens door to new ID challenges: Report

www.csoonline.com · 8 months ago

New research from Rubrik Zero Labs finds that agentic AI and a surge in non human identities have created a troubling gap between the expanding identity attack surface and organizations' ability to recover from compromises. The report finds 89 percent of organizations have fully or partially incorporated AI agents, 58 percent estimate that within 12 months agentic AI will drive half or more of attacks, and industry data indicates non human identities now outnumber human users by about 82 to 1, creating credentials that are difficult to revoke and govern. Security experts warn identity has become the primary attack surface with breaches driven by trusted credentials rather than network exploits, and they call for comprehensive identity resilience, unified identity and secrets management, stricter control of agent creation, and improved credential lifecycle governance.
Cisco Catalyst Center REST API Command Injection Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated remote attacker to execute arbitrary commands in a restricted container as the root user. The issue is caused by insufficient validation of user supplied input in REST API request parameters and can be exploited by sending a crafted API request with valid credentials for an account with at least the Observer role. Cisco has released software updates that address the vulnerability and reports there are no available workarounds. The vulnerability is tracked as CVE-2025-20349.
Cisco Catalyst Center Cross-Site Scripting Vulnerability

sec.cloudapps.cisco.com · 8 months ago

There is a cross site scripting vulnerability in the web based management interface of Cisco Catalyst Center that could allow an unauthenticated remote attacker to execute arbitrary script in a user s browser or access sensitive browser based information. The flaw is caused by insufficient validation of user input and can be exploited by persuading a user to click a crafted link. Cisco has released software updates to address the issue, there are no workarounds, the security impact is rated Medium, and the vulnerability is tracked as CVE-2025-20353.
Cisco Catalyst Center Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · 8 months ago

There is a vulnerability in Cisco Catalyst Center that could allow an authenticated remote attacker with valid read only or Observer role credentials to perform operations that should require Administrator privileges because of improper role based access control. An attacker who logs in with at least the Observer role could modify policy configurations reserved for Administrators. Cisco released software updates to address the issue, there are no workarounds, the Security Impact Rating is Medium, CVE-2025-20346.
Cisco Catalyst Center Virtual Appliance Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated remote attacker to elevate privileges to Administrator on affected systems. The flaw is caused by insufficient validation of user supplied input and can be exploited by submitting a crafted HTTP request. To exploit the issue an attacker must have valid credentials for a user account with at least the role of Observer. Cisco has released software updates to address the issue, there are no workarounds, and the vulnerability is tracked as CVE-2025-20341 with a security impact rating of High.
Cisco Catalyst Center Virtual Appliance HTTP Open Redirect Vulnerability

sec.cloudapps.cisco.com · 8 months ago

A vulnerability in the web based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated remote attacker to redirect a user to a malicious web page. The vulnerability is caused by improper input validation of HTTP request parameters and can be exploited by intercepting and modifying a user's HTTP request. Cisco has released software updates to address the issue, there are no workarounds, the security impact rating is medium, and the issue is tracked as CVE-2025-20355.
Kraken ransomware benchmarks systems for optimal encryption choice

www.bleepingcomputer.com · 8 months ago

Kraken ransomware targets Windows and Linux VMware ESXi systems and gains initial footholds by exploiting internet facing SMB vulnerabilities, stealing admin credentials, and using Remote Desktop Protocol along with Cloudflared and SSHFS for persistence and data exfiltration. There is a timed performance benchmark that creates and encrypts a temporary file to decide whether to perform full or partial multi threaded encryption so operators can maximize impact without overloading hosts, and the malware deletes shadow copies, empties the Recycle Bin, stops backup services, and forcibly terminates virtual machines before encrypting. The Windows variant contains modules that target SQL databases, network shares, local drives, and Hyper V, encrypted files are appended with a.zpsc extension and a readmeyouwshacked.txt ransom note is dropped, operators run an extortion site and a forum, and observed ransom demands reached one million dollars in Bitcoin with links to the former HelloKitty operation noted.
CISA warns of Akira ransomware Linux encryptor targeting Nutanix VMs

www.bleepingcomputer.com · 8 months ago

US government agencies warn that Akira ransomware operators have begun encrypting Nutanix AHV virtual machine disk files, targeting.qcow2 virtual disks and expanding their capabilities beyond VMware ESXi and Hyper V. In June 2025 Akira actors abused the SonicWall vulnerability tracked as CVE-2024-40766 to gain access, and they have also exploited Veeam Backup and Replication vulnerabilities CVE-2023-27532 and CVE-2024-40711 to access and delete backups. The actors commonly use stolen or brute forced VPN and SSH credentials, lateral movement tools and administrative account creation, can exfiltrate data in as little as two hours, and agencies urge regular offline backups, enforced multifactor authentication, and rapid patching of known exploited vulnerabilities.
New ‘IndonesianFoods’ worm floods npm with 100,000 packages

www.bleepingcomputer.com · 8 months ago

A self spreading package called IndonesianFoods is flooding the npm registry by automatically publishing new packages roughly every seven seconds and has produced over 100,000 packages and counting. The published packages do not currently contain active malware for developers, but researchers warn an update could introduce dangerous payloads and that the automation risks broad supply chain compromise. Attackers abused the TEA Protocol and used thousands of interconnected packages to inflate impact scores and earn TEA tokens, with mass publishing starting in 2023, monetization in 2024, and the worm like replication loop added in 2025. Developers are advised to lock dependency versions, monitor for abnormal publishing patterns, and implement strict digital signature validation to mitigate the risk.
FBI: Akira gang has received nearly $250 million in ransoms

therecord.media · 8 months ago

U.S. and European law enforcement released updated guidance to help organizations defend against the Akira ransomware gang, which is believed to have collected more than 244 million dollars in ransom proceeds as of late September 2025. The updates expand an April 2024 advisory with a new list of tactics and exploited vulnerabilities, noting that Akira gains initial access by stealing VPN credentials or exploiting vulnerabilities such as CVE-2024-40766, using brute force, credential theft, password spraying with tools like SharpDomainSpray, and abusing remote access tools including AnyDesk and LogMeIn while sometimes uninstalling endpoint detection and response software and stealing data within hours of access. The gang has targeted manufacturing, education, IT, and healthcare, has claimed responsibility for dozens of high profile incidents including attacks on universities and critical suppliers, and is assessed to have links to the defunct Conti ransomware operation though no direct ties to the Russian state have been established.
Cisco Unified Contact Center Express Remote Code Execution Vulnerabilities

sec.cloudapps.cisco.com · 8 months ago

There are multiple vulnerabilities in the Java Remote Method Invocation RMI process of Cisco Unified Contact Center Express that could allow an unauthenticated remote attacker to upload arbitrary files, bypass authentication, execute arbitrary commands, and elevate privileges to root. ([]()) Cisco has released software updates that address these vulnerabilities and there are no workarounds. The security impact rating is Critical and the vulnerabilities are tracked as CVE-2025-20354 and CVE-2025-20358. ([]())
Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data

thehackernews.com · 8 months ago

There are more than 4,300 domains registered since the start of the year by a Russian speaking threat running a mass phishing campaign that began around February 2025 and targets hotel guests and hospitality organizations. The campaign uses a sophisticated phishing kit that serves customized pages based on a unique ADCODE in the URL and cookie, impersonates major travel brands with logos, supports 43 languages, and presents fake Cloudflare style CAPTCHA and booking related domain names to appear legitimate. Phishing emails urge recipients to confirm bookings within 24 hours and redirect victims through chains of pages that request deposits and full card details including CVV, attempt background transaction processing, and prompt a fake 3D Secure verification via a support chat while exfiltrating data to Telegram bots. The activity has focused on Central and Eastern Europe and shows the industrialization of phishing as a service, with links to other campaigns that deployed malware such as PureRAT and used WhatsApp or email follow ups to target customers.
Drawbot: Let’s Hack Something Cute! — Atredis Partners

www.reddit.com · 8 months ago

Researchers reverse engineered a childrens drawing robot and discovered its cards encode an eight bit barcode read by multiplexed optical sensors, allowing signal emulation. They dumped two SPI NOR flash chips, determined one held audio and the other contained coordinate based drawing slots, forced a full 16 megabyte read to enumerate 254 images, and wrote tools to extract and render the images as SVG. Using a Raspberry Pi to emulate barcode inputs and flashrom to write a modified image slot, they successfully overwrote a slot and got the robot to draw a custom image.
RCE flaw in ImunifyAV puts millions of Linux-hosted sites at risk

www.bleepingcomputer.com · 8 months ago

There is a remote code execution vulnerability in the ImunifyAV malware scanner for Linux servers rooted in AI-Bolit deobfuscation logic that executes attacker controlled function names and affects AI-Bolit versions prior to 32.7.4.0. An attacker can trigger the flaw by placing an obfuscated PHP file that will be deobfuscated during scans, allowing dangerous PHP functions such as system, exec, shellexec, passthru, and eval to run, which can lead to website compromise and, on shared hosting where the scanner runs with elevated privileges, full server takeover. CloudLinux has released and backported fixes and urges administrators to update to version 32.7.4.0 or newer, and at the time of disclosure no CVE identifier, detection guidance, or confirmed active exploitation were available.
EOL-Software gefährdet Unternehmenssicherheit

www.csoonline.com · 8 months ago

There are widespread uses of end of life software in enterprises, with telemetry from twenty-seven million devices across eighteen hundred companies showing twenty-six percent of Linux systems and eight percent of Windows systems running outdated versions. There are significant gaps in protection and control as thirty-nine percent of network registered IT devices lack active endpoint protection and thirty-two point five percent of devices operate outside IT control, while seventy-seven percent of networks are poorly segmented, placing low security devices alongside high value targets. Edge devices such as routers, videoconferencing systems, IoT and OT gear often run unpatched embedded Linux kernels, use default credentials and face zero day vulnerabilities, making them among the riskiest assets. To reduce risk organizations should minimize internet exposure, remove default credentials, prioritize patching and segmentation, maintain continuous agentless visibility and a full software and firmware inventory including end of life status, and apply compensating controls when replacement is not feasible.
Orgs Move to SSO, Passkeys to Solve Bad Password Habits

www.darkreading.com · 8 months ago

In 2025 employees still use weak, easily guessable passwords, and organizations are increasingly moving to reduce or eliminate passwords by adopting single sign-on and passkeys. Survey responses indicate about one third of organizations now use SSO or passkeys, around a fifth use password managers, 17 percent require passphrases, and just over a quarter force complex password rules. Industry reports show rapid growth in passwordless adoption, with some surveys reporting implementation or plans for passkeys in the 70 to 92 percent range, and organizations citing reduced phishing risk, fewer reset tickets, and better user experience as benefits. Persistent barriers include lack of support for modern authentication in legacy applications, user resistance from workflow disruption, and upfront migration costs that can cause organizational paralysis.
Washington Post data breach impacts nearly 10K employees, contractors

www.bleepingcomputer.com · 8 months ago

Nearly 10,000 Washington Post employees and contractors were notified that personal and financial data were exposed after threat actors accessed parts of the newspaper's network between July 10 and August 22 by exploiting a zero day in Oracle E Business Suite. The vulnerability is tracked as CVE-2025-61884 and has been linked to the Clop ransomware group, which stole data and attempted extortion in late September. The Post's investigation, concluded on October 27, found 9,720 individuals had full names, bank account and routing numbers, Social Security numbers, and tax and ID numbers compromised. Impacted individuals were offered 12 months of identity protection through IDX and advised to consider credit freezes and fraud alerts.
Google Sues China-Based ‘Lighthouse’ Phishing Service After $1B+ Scams Target Millions

www.techrepublic.com · 8 months ago

Google is suing a Chinese phishing network accused of stealing more than one billion dollars and targeting millions of people worldwide, and is asking US racketeering and computer fraud courts to shut down the Lighthouse phishing as a service platform. Lighthouse operates on a subscription model paid in cryptocurrency and offers thousands of fraudulent email, SMS, and website templates plus high volume sending tools, with cybersecurity data attributing 200,000 fraudulent websites created in a 20 day period and claims of sending up to 200,000 text messages a day. Google says a court win would let it work with cellular networks and domain hosting providers to take the platform down, while it also expands AI based scam detection and promotes passkeys and two factor authentication to protect users.
ChatGPT Vulnerability Exposed Underlying Cloud Infrastructure

www.securityweek.com · 8 months ago

A researcher discovered a server side request forgery flaw in ChatGPT custom GPT Actions that accepted unvalidated user provided URLs. The flaw allowed querying the Azure Instance Metadata Service to obtain the ChatGPT Azure IMDS identity access token, which could be used to access underlying Azure cloud infrastructure. The issue was reported to OpenAI through its bug bounty program on BugCrowd, was rated high severity and was quickly patched.
1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium

www.securityweek.com · 8 months ago

A major international law enforcement operation called Operation Endgame 3.0 disrupted the infrastructure supporting the Rhadamanthys infostealer, the VenomRAT remote access trojan, and the Elysium botnet, with authorities from the United States, Australia, Canada and eight European countries cooperating alongside cybersecurity companies and non profit organizations. Police searched eleven locations in Germany, Greece and the Netherlands, arrested one individual in Greece, seized twenty domains and disrupted or took down more than one thousand servers worldwide. Investigators reported hundreds of thousands of infected machines containing several million stolen credentials, identified more than two million compromised email addresses and seven point four million passwords shared with Have I Been Pwned, and said a suspect had access to over one hundred thousand crypto wallets potentially worth millions of euros.
Phishing campaign targets customers of major Italian web hosting provider

therecord.media · 8 months ago

Researchers uncovered a large scale phishing campaign targeting customers of one of Italy's largest web hosting and IT service providers that impersonated Aruba S dot p dot A and serves more than five million customers. The operation used a sophisticated phishing kit sold as a service that imitates login and payment pages, preloads user data, filters CAPTCHAs to evade security scanners, and instantly exfiltrates credentials and credit card details via Telegram bots. Victims received emails claiming service expiration or failed payments that redirected them to fake login or payment pages where credentials, payment card information, and one time passwords were captured, often after prompting a small payment of around five dollars. Researchers said Telegram was central to the campaign's coordination and promotion and have not attributed the operation to a specific threat actor.
CISA Updates Guidance on Patching Cisco Devices Targeted in China-Linked Attacks

www.securityweek.com · 8 months ago

CISA has issued updated guidance after China linked ArcaneDoor actors exploited two Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense vulnerabilities that permit attackers to send crafted requests to the VPN web server to execute arbitrary code as root or access restricted URLs without authentication. The flaws are tracked as CVE-2025-20333 and CVE-2025-20362, were discovered in May, and Cisco released patches on September 25 while warning on November 6 of a new variant that can trigger device reloads and cause denial of service. CISA issued Emergency Directive 25-03 directing federal agencies to identify all affected ASA and Firepower devices, collect forensics, report inventories to CISA by October 2, disconnect end of support devices, and upgrade or apply the minimum fixed software versions published by CISA after finding some agencies had marked appliances as patched despite remaining vulnerable. CISA also published fresh mitigation guidance and recommends additional actions for devices not updated to the necessary versions by September 26, 2025 to mitigate ongoing and new threat activity.
Kerberoasting in 2025: How to protect your service accounts

www.bleepingcomputer.com · 8 months ago

Kerberoasting remains a major Active Directory threat because attackers can request service tickets for accounts with Service Principal Names and then crack the ticket offline to recover the account password, using tools such as GetUserSPNs.py and Rubeus. These attacks are hard to detect because cracking happens offline, they do not require malware, and they start from legitimate user accounts, allowing attackers to evade many standard defenses. Effective defenses include regularly auditing AD accounts and passwords, enforcing long unique nonreusable credentials for SPN accounts of at least 25 characters with regular rotation, using group managed service accounts that have automatically generated 120 character passwords, preferring AES encryption over RC4, removing unnecessary SPNs, and deploying multifactor authentication and user awareness to reduce initial compromise.
Two key cyber laws are back as president signs bill to end shutdown

therecord.media · 8 months ago

President Donald Trump signed a government funding bill that ended a 43 day shutdown and temporarily reinstated the 2015 Cybersecurity and Infrastructure Security Act and the State and Local Cybersecurity Grant Program. The measure restores the information sharing statute and the grant program through January 30, preserves antitrust and liability safeguards for private sector cyberthreat sharing, and continues roughly one billion dollars in funding awarded to state and local governments since 2022. Officials warned the renewal is a short term fix and urged Congress to move quickly to pass longer term reauthorizations to avoid future lapses.
Google Sues to Disrupt Chinese SMS Phishing Triad

krebsonsecurity.com · 8 months ago

There is a lawsuit filed November 12, 2025 in the Southern District of New York in which Google sued 25 unnamed defendants to unmask and disrupt Lighthouse, a China based mobile phishing service that Google says has harmed more than one million victims across 120 countries. Lighthouse is part of a Smishing Triad that supplies phishing templates and infrastructure used to spoof hundreds of trusted brands, send millions of fraudulent text messages, and automatically attempt to enroll stolen payment card data into Apple and Google mobile wallets by tricking victims into providing one time bank codes. Researchers report the operation offers more than 600 phishing templates for over 400 entities, rotates domains rapidly with about 25,000 phishing domains active during any eight day period, and is organized into developer, data broker, spammer, theft, and administrative groups. Google alleges trademark infringement and RICO violations and is seeking court relief intended to disrupt the enterprise and potentially pressure Chinese hosting providers to take down domains and enable further enforcement.
Phishing Emails Alert: How Spam Filters Can Steal Your Email Logins in an Instant

gbhackers.com · 8 months ago

Cybercriminals are spoofing internal email delivery and spam filter notifications to trick employees into clicking a Move to Inbox button that redirects through legitimate looking domains to phishing pages designed to steal login credentials that can expose email, cloud storage, and other accounts. The attack uses redirects through domains including cbssports to land victims on mdbgo.io pages that accept a base64 encoded target address, serve a fake login screen with the victim domain prefilled, and harvest credentials in real time via a websocket which can also capture or prompt for two factor authentication codes. Indicators of compromise include multiple mdbgo.io subdomains and several disposable or compromised redirect domains, and recommended defenses are to verify sender addresses and destination URLs before signing in, avoid unsolicited attachments and links, enable multi factor authentication, and change passwords immediately if credentials were entered.
Malicious npm Package with 206K Downloads Targeting GitHub Repositories to Steal Tokens

gbhackers.com · 8 months ago

There was a typosquatting campaign discovered on November 7, 2025 by Veracode Threat Research that deployed a malicious npm package named atacitons slash artifact which mimicked the legitimate atactions slash artifact and accumulated over 206,000 downloads before being removed. Six malicious versions contained a post install hook that downloaded an obfuscated binary called harness which executed a verify dot js script to check for GITHUB underscore environment variables, exfiltrate encrypted repository tokens, and included a time based kill switch that stopped execution after November 6, 2025, indicating the campaign specifically targeted GitHub owned repositories. Veracode said it notified npm and protected its customers with Veracode Package Firewall while reporting shows the suspect versions were removed and some outlets later described the activity as linked to a GitHub Red Team exercise.
Rogue MCP servers can take over Cursor’s built-in browser

www.csoonline.com · 8 months ago

Security researchers have demonstrated that a malicious Model Context Protocol server can inject JavaScript into Cursor s built in browser, replacing pages with attacker controlled content to harvest credentials and steal session cookies. Because Cursor is a Visual Studio Code fork built on Electron and does not perform the same file integrity checks as VS Code, MCP servers inherit IDE privileges and can be expanded to execute arbitrary actions that could fully compromise a developer workstation. Recommended defenses include vetting and restricting IDE extensions and MCP servers, reviewing server code and repositories before installing, avoiding auto run agent modes, using API keys with restricted permissions, and enforcing organizational policies and access controls.
Coyote, Maverick Banking Trojans Run Rampant in Brazil

www.darkreading.com · 8 months ago

Multiple banking Trojans have been claiming victims in Brazil by targeting desktop WhatsApp users, seizing banking and cryptocurrency credentials, and self replicating through infected users' contact lists. Security researchers analyzed two related strains named Coyote and Maverick and found both are written in dot NET, use similar banking application monitoring routines, and spread when a zip attachment containing a Windows LNK shortcut executes PowerShell to launch a multistage attack. Maverick uniquely checks whether a victim is based in Brazil and self terminates if not, and telemetry from multiple vendors shows hundreds to several thousand infections concentrated in Brazil across public sector and other industries. Researchers recommend employee training on phishing, stronger access controls, and advanced real time monitoring to mitigate these localized banking malware campaigns.
SmartApeSG Uses ClickFix to Deploy NetSupport RAT

gbhackers.com · 8 months ago

A campaign known as SmartApeSG, tracked as ZPHP and HANEYMANEY, has shifted from fake browser update pages to ClickFix style fake CAPTCHA landing pages that instruct victims to paste and run clipboard PowerShell commands, leading to the installation of NetSupport RAT. Infections typically begin on compromised websites that redirect users to loader domains masquerading as services such as DocuSign or Okta, where a PowerShell command downloads a passworded ZIP containing a legitimate Java executable used to sideload a malicious DLL loader that retrieves encrypted payloads and launches the NetSupport client in memory. NetSupport RAT provides full remote access capabilities including screen and input control, file transfer and data exfiltration, and researchers have observed follow-on payloads such as StealC, Latrodectus and Lumma Stealer in these campaigns.
Case Study: University of West England uses Sophos solutions to protect thousands of students across multiple campuses

news.sophos.com · 8 months ago

There is heavy investment in cybersecurity at the University of the West of England to protect 38,000 students across multiple campuses after facing limited visibility and alert fatigue. In 2023 the university replaced legacy antivirus with Sophos Managed Detection and Response which provides 24 hour seven day a week expert monitoring, threat hunting, daily alert triage, real time containment, and integration across the technology stack, and now protects over ten thousand devices. The shift from reactive to resilient operations has produced a quantified reduction in cyber risk and greater confidence, while a 2025 study found that forty nine percent of higher education ransomware attacks stem from unknown vulnerabilities.
Threat Actors Use JSON Storage for Hosting and Delivering Malware via Trojanized Code

gbhackers.com · 8 months ago

There is a sophisticated campaign attributed to North Korean aligned threat actors that weaponizes legitimate JSON storage services to host and deliver trojanized code to software developers worldwide. The operation known as Contagious Interview leverages fake job interviews and trojanized packages to evade security controls, abuse trusted infrastructure, and establish persistent system access. This tactic broadens attackers ability to compromise development environments and supply chain components, increasing the risk of data theft and persistent backdoors.
Hackers Infiltrate npm Registry with 43,000 Spam Packages, Linger for Nearly Two Years

gbhackers.com · 8 months ago

There are over 43,000 malicious npm packages published across at least 11 accounts in a coordinated spam campaign called IndonesianFoods that lingered in the registry for nearly two years. The packages use a distinctive naming scheme that combines Indonesian personal names and food terms and embed a single JavaScript file such as auto.js that, if run manually, publishes new packages in an endless loop at a cadence of roughly one package every seven to ten seconds. The operation aims to pollute the registry and create worm like dependency chains that can pull large trees of junk packages when a single package is installed, rather than to immediately steal credentials or data.
Tens of Thousands of Malicious NPM Packages Distribute Self-Replicating Worm

www.securityweek.com · 8 months ago

There are more than 43,900 malicious npm packages linked to 11 accounts using Indonesian names and foods, while JFrog observed over 80,000 similar self replicating packages across 18 accounts. The malware generates random package names, alters package json to make packages public, assigns random version numbers, and uses stolen npm credentials to publish a new package about every seven seconds in a continuous loop, with the code disguised as a legitimate Next JS application and focused on spamming rather than data theft. The campaign floods the npm registry, wastes infrastructure and pollutes search results, creating supply chain risks and possibly serving as a dry run for future campaigns that could deliver real malicious payloads.