Blahalla

New ClickFix Attack Targeting Windows and macOS Users to Deploy Infostealer Malware

gbhackers.com · 8 months ago

A sophisticated campaign uses the ClickFix social engineering technique to push information stealing malware to both Windows and macOS users. Attackers lure victims via search results for cracked software and fake verification pages that instruct users to copy and run obfuscated PowerShell or terminal commands, which fetch staged scripts such as gverify.js and then download the final payload into the user downloads folder. The payloads are infostealers that exfiltrate browser credentials, cryptocurrency wallet data, screenshots and other sensitive files, and security telemetry shows ClickFix based delivery has surged and expanded across platforms.
CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks

thehackernews.com · 8 months ago

CISA added a critical out of bounds write vulnerability in WatchGuard Fireware to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The flaw tracked as CVE-2025-9242 has a CVSS score of 9.3 and affects Fireware OS versions 11.10.2 through 11.12.4Update1, 12.0 through 12.11.3, and 2025.1, and may allow a remote unauthenticated attacker to execute arbitrary code in the iked process during the IKE handshake. More than 54,300 Firebox instances remained vulnerable as of November 12, 2025 with roughly 18,500 located in the United States, and CISA also added CVE-2025-62215 and CVE-2025-12480 to the KEV catalog. Federal Civilian Executive Branch agencies were advised to apply WatchGuard patches by December 3, 2025.
Critical Dell Data Lakehouse Flaw Allows Remote Attackers to Escalate Privileges

gbhackers.com · 8 months ago

A critical improper access control vulnerability in Dell Data Lakehouse allows a high privileged remote user to escalate privileges and could lead to full system compromise. The flaw is tracked as CVE-2025-46608, carries a CVSS v3.1 base score of 9.1, and affects Data Lakehouse versions prior to 1.6.0.0. Dell has published security updates and recommends upgrading to version 1.6.0.0 or later while restricting high privilege accounts and monitoring for unauthorized privilege escalation.
What CISOs need to know about new tools for securing MCP servers

www.csoonline.com · 8 months ago

Model Context Protocol lets AI agents connect to data sources, and early iterations lacked serious security but recent updates added OAuth and third-party authentication support and an official MCP registry. Significant vulnerabilities remain because authentication is optional and systems are prone to prompt injection, tool poisoning, token theft, cross-server attacks, and message tampering, putting high-risk uses such as financial transactions at particular risk. Organizations need fine-grained authorizations, least-privilege controls, comprehensive logging, and runtime protections, and vendors are offering MCP discovery, runtime monitoring, authentication and zero trust frameworks, and observability tools. Hyperscalers including AWS, Microsoft, and Google and vendors such as Cloudflare, Palo Alto Networks, SentinelOne, and startups including Akto and Invariant Labs are rolling out MCP security solutions to help enterprises harden deployments.
Beware of Fake Bitcoin Tools Concealing DarkComet RAT Malware

gbhackers.com · 8 months ago

A malware campaign is leveraging cryptocurrency lures to distribute the DarkComet remote access trojan via executables disguised as Bitcoin wallet applications. Samples were delivered inside RAR archives and UPX packed executables that spawn cmd and conhost processes, inject into notepad, establish persistence, and perform keylogging and credential theft. The unpacked samples were observed attempting TCP connections to kvejo991.ddns.net on port 1604 for command and control. Users are advised to obtain wallet and trading software only from verified sources and to avoid opening unsolicited compressed attachments or executables.
CISA Warns of Active Exploitation of WatchGuard Firebox Out-of-Bounds Write Flaw

gbhackers.com · 8 months ago

There is a critical out of bounds write vulnerability affecting WatchGuard Firebox firewalls that has been added to the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog. The vulnerability is tracked as CVE-2025-9242 and is reported to be under active exploitation in the wild, posing severe risk to organizations that rely on these devices for network security. Agencies and enterprises using WatchGuard Firebox devices are urged to prioritize vendor patches and apply available mitigations immediately.
Citrix NetScaler ADC and Gateway Flaw Allows Cross-Site Scripting (XSS) Attacks

gbhackers.com · 8 months ago

Cloud Software Group disclosed a cross-site scripting vulnerability in NetScaler ADC and NetScaler Gateway platforms. The flaw is tracked as CVE-2025-12101 and is classified under CWE-79, posing a moderate security risk to organizations that use these appliances for authentication and secure access. Administrators of affected systems should assess exposure and apply vendor guidance to mitigate potential XSS exploitation.
Hackers Using RMM Tools LogMeIn and PDQ Connect to Deploy Malware as Legitimate Software

gbhackers.com · 8 months ago

There is a campaign that abuses legitimate RMM tools LogMeIn Resolve and PDQ Connect by delivering them through fake download pages or malicious installers to install a Delphi backdoor called PatoRAT. Once installed attackers use the RMM tools to execute PowerShell and deploy PatoRAT, which supports remote control, data exfiltration, keylogging, screen capture, hidden VNC, plugin support, and other commands, and installs with attacker-controlled CompanyId values. Defenders are advised to restrict unauthorized RMM installations, block suspicious EXE and MSI downloads, monitor remote-access sessions, and take down malicious sites and domains.
Active Exploitation of Cisco and Citrix 0-Day Vulnerabilities Allows Webshell Deployment

gbhackers.com · 8 months ago

A sophisticated campaign is actively exploiting zero day vulnerabilities in Cisco Identity Services Engine and Citrix NetScaler, enabling pre authentication remote code execution and unauthorized administrative access. Attackers deployed custom in memory webshells that inject into Tomcat threads using Java reflection, monitor HTTP requests, use DES with non standard Base64 encoding, and require specific HTTP headers to operate, minimizing forensic traces. Observed affected vulnerabilities include CVE 2025 20337 for Cisco ISE and CVE 2025 5777 for Citrix NetScaler, and defenders are urged to apply vendor patches, restrict access to management endpoints, and hunt for indicators of compromise.
Firefox 145 and Chrome 142 Patch High-Severity Flaws in Latest Releases

www.securityweek.com · 8 months ago

Google and Mozilla released Chrome 142 and Firefox 145 updates that fix multiple high severity security defects. Chrome 142 fixes a high severity inappropriate implementation issue in the V8 JavaScript engine tracked as CVE 2025 13042 and is rolling out as version 142.0.7444.162 for Linux and macOS and as 142.0.7444.162 and 142.0.7444.163 for Windows. Firefox 145 addresses 16 vulnerabilities, including nine high severity flaws impacting graphics and WebGPU boundary conditions, a WebAssembly boundary issue, a JIT miscompilation and a race condition, and includes a memory safety flaw tracked as CVE 2025 13027 that affects Firefox 144 and Thunderbird 144. Neither vendor has reported exploitation in the wild and Mozilla also released updated ESR builds with additional fixes.
Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

thehackernews.com · 8 months ago

Researchers warn a worm like spam campaign named IndonesianFoods has flooded the npm registry since early 2024 with as many as 46,484 fake packages that masquerade as Next.js projects and use Indonesian names and food terms. The packages contain a dormant JavaScript worm in a single file such as auto.js that only runs if executed manually and when run it removes the private flag, generates random package names and versions, and publishes new packages in an infinite loop every seven to ten seconds, creating exponential dependency chains that strain the registry. Evidence indicates the campaign is financially motivated by inflating TEA protocol reward accounts, was operated from a small set of npm accounts, and GitHub has removed the malicious packages while researchers urge improved scanner detection for manually executed scripts.
Google Sues “Lighthouse” Over Massive Phishing Attacks

gbhackers.com · 8 months ago

Google has filed a lawsuit in the U S District Court for the Southern District of New York seeking to dismantle Lighthouse, an alleged Phishing as a Service operation that sells subscription phishing kits and templates used to impersonate organizations such as Google, the U S Postal Service and E ZPass. Google says Lighthouse users created about 200,000 fraudulent websites in a 20 day span and targeted more than one million potential victims across over 120 countries, with the company estimating the operation may have exposed between 12.7 million and 115 million U S credit card numbers. The complaint alleges the phishing pages logged keystrokes and misused more than a hundred templates showing Google branding, and Google is seeking monetary damages and court orders under racketeering, trademark and computer fraud laws while also supporting federal legislation to curb similar scams.
Google asks US court to shut down Lighthouse phishing-as-a-service operation

www.csoonline.com · 8 months ago

Google is asking a US court to dismantle the infrastructure behind Lighthouse, a phishing as a service operation that the company found using at least 107 website templates featuring Google branding on sign-in screens to trick users. Operators sell access to Lighthouse so threat actors can send text messages that appear to come from legitimate providers and lure victims into giving email credentials, banking information and other sensitive data. Google is also urging US lawmakers to adopt the GUARD Act, the Foreign Robocall Elimination Act and the SCAM Act to provide funding, create task forces and develop a national strategy against scam compounds and related fraud. Security experts say court orders and legislation could have only minimal impact because services can operate outside US jurisdiction, but any reduction in scams would ease the burden on IT teams, especially by curbing paid ads and malicious sites that direct victims to fraud.
Breaking mPDF with regex and logic

www.reddit.com · 8 months ago

mPDF, a widely used open source PHP library with roughly seventy million installs, can be induced to make outbound web requests because its CSS import extraction applies a regular expression to the entire HTML instead of restricting parsing to actual style blocks. That logic quirk lets an attacker trigger at import URL requests even when user input is sanitized with functions like htmlentities, and exploitation techniques include appending dot css query markers or using gopher URIs to reach internal services and speak native protocols such as Redis. The behavior was reported to the mPDF maintainer in May 2025 and a CVE request was filed and later rejected, with maintainers and MITRE noting that outbound requests controlled by input are intended behavior and do not qualify as a vulnerability. Recommended mitigations include avoiding passing user input to mPDF, disallowing characters like the at sign, parentheses, colon and slash in user input, or blacklisting strings such as colon slash slash when accepting user-supplied text.
'CitrixBleed 2' Wreaks Havoc as Zero-Day Bug

www.darkreading.com · 8 months ago

There are reports that the same advanced persistent threat exploited critical zero day vulnerabilities in Citrix NetScaler ADC and Gateway tracked as CVE-2025-5777 and in Cisco Identity Services Engine tracked as CVE-2025-20337, with the Citrix flaw widely referred to as CitrixBleed 2. Exploitation occurred in the wild before patches were widely deployed, with evidence that attackers used the Citrix zero day and then leveraged the Cisco ISE bug to gain pre authentication remote code execution as root and deploy a custom in-memory web shell masquerading as an IdentityAuditAction component. Security experts warn this pattern shows growing adversary interest in identity and access management infrastructure and advise organizations to reduce exposure by removing over privileged accounts, restricting external access to identity appliances, enabling high fidelity logging and anomaly detection, and adopting exposure centric mitigations alongside rapid detection and containment.
US announces ‘strike force’ to counter Southeast Asian cyber scams, sanctions Myanmar armed group

therecord.media · 8 months ago

The United States is establishing a Scam Center Strike Force made up of the Treasury Department, Justice Department, Secret Service, State Department and FBI to investigate, disrupt and prosecute Southeast Asian cyber scam compounds that have stolen billions from Americans. Officials estimate U.S. residents lost at least ten billion dollars in 2024 to romance schemes, fictitious investment scams and fraudulent cryptocurrency platforms, and the force will focus on Burma, Cambodia and Laos while using sanctions, seizures, criminal prosecutions and victim restitution and education. The Treasury announced sanctions targeting the Democratic Karen Benevolent Army, several of its leaders, and Thai companies accused of serving as links between armed groups and Chinese organized crime, with investigators tracing stolen funds to compounds such as Tai Chang and documenting widespread human trafficking and brutal abuse of forced workers at these sites.
Making .NET Serialization Gadgets by Hand

www.reddit.com · 8 months ago

There is a technical guide dated November 12, 2025 that explains how a.NET deserialization payload generation library for the go-exploit framework was built and how it can generate deserialization gadgets without requiring Windows. The guide breaks down.NET binary serialization into constituent record types, provides byte level hex dumps and Go code snippets to construct records and gadget chains by hand, and contrasts this manual approach with using ysoserial.net or embedding binary blobs. The library is presented as ready to use in Go programs to generate dynamic payloads and readers are directed to the go-exploit package for a complete implementation.
Google Looks to Dim 'Lighthouse' Phishing-as-a-Service Op

www.darkreading.com · 8 months ago

Google filed a federal lawsuit in the Southern District of New York against 25 unnamed individuals behind a phishing-as-a-service operation called Lighthouse, accusing the group known as the Smishing Triad of running large scale smishing campaigns and seeking relief under the RICO Act, the Lanham Act, and the Computer Fraud and Abuse Act. Lighthouse allegedly enabled operators to send enormous volumes of SMS phishing messages impersonating brands such as E ZPass and Google, harmed over one million victims across more than 120 countries, and was blamed for stealing an estimated 12.7 million to 115 million credit cards in the United States alone. The kit was offered for a monthly license with SMS and e commerce versions, included templates and domain setup tools, relied on Telegram and YouTube channels for training and community, and used stolen payment data to fund ads and stock pump and dump schemes, creating risks for consumers and enterprises.
Federal agencies not fully patching vulnerable Cisco devices amid ‘active exploitation,’ CISA warns

therecord.media · 8 months ago

Federal civilian agencies are not patching vulnerable Cisco devices sufficiently to protect themselves from an exploitation campaign that began in September, with CISA finding devices reported as patched that were actually updated to still-vulnerable software versions. CISA ordered agencies in an emergency directive to address two Cisco Adaptive Security Appliance vulnerabilities, CVE-2025-30333 and CVE-2025-20362, and warned that threat actors have been chaining the bugs and actively exploiting ASA devices. Security responders observed scanning and exploitation against federal and local government IP addresses attributed to the China-based Storm-1849 group, Cisco linked the campaign to the ArcaneDoor activity, and agencies were advised to apply fixes and replace compromised configurations and credentials.
Google sues to dismantle Chinese platform behind global toll scams

www.bleepingcomputer.com · 8 months ago

Google has filed a lawsuit seeking to dismantle Lighthouse, a Chinese phishing as a service platform that enabled smishing campaigns impersonating the U S Postal Service and E ZPass to steal credit card information. Google says Lighthouse affected over one million victims across 120 countries and that these kinds of scams may have stolen as many as 115 million payment cards in the United States between July 2023 and October 2024. The complaint alleges violations including the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act, and the Computer Fraud and Abuse Act, and investigators linked Lighthouse to a Chinese actor known as Wang Duo Yu who marketed kits and templates on Telegram. Google also says it found at least 107 phishing templates using Google branding and announced support for new U S policies while expanding AI based protections in Google Messages and improving account recovery.
Google sues to dismantle Chinese phishing platform behind US toll scams

www.bleepingcomputer.com · 8 months ago

Google has filed a lawsuit seeking to dismantle Lighthouse, a phishing as a service platform used in smishing campaigns that impersonate the United States Postal Service and E ZPass toll systems to steal payment information. The platform has been linked to over one million victims across 120 countries and to campaigns researchers estimate stole up to 115 million payment cards in the United States between July 2023 and October 2024. Lighthouse supplies phishing templates that display Google branding, can harvest login credentials and two factor codes, and has been tied to a Chinese operator known as Wang Duo Yu who markets kits on Telegram and sells subscriptions. Google alleges violations of racketeering, trademark and computer fraud laws and says it will support new United States policies while expanding AI and messaging protections to detect and block these scams.
Russia imposes 24-hour mobile internet blackout for travelers returning home

therecord.media · 8 months ago

Russian telecom operators have begun cutting mobile internet access for 24 hours for citizens returning from abroad as a cooling off measure aimed at preventing Ukrainian drones from using domestic SIM cards for navigation. When a SIM card enters Russia from abroad users must confirm it is being used by a person not installed in a drone and access can be restored sooner by solving a captcha or calling the operator for identification. The rule has caused unexpected outages in border regions where phones automatically connect to foreign carriers and some regions such as Ulyanovsk may keep restrictions in place until the end of the war around critical facilities. Officials are also moving to expand the FSBs authority to order mobile and internet shutdowns over broadly defined emerging threats while digital rights groups say the blackouts appear arbitrary and that most drones do not rely on mobile internet to operate.
British government unveils long-awaited landmark cybersecurity bill

therecord.media · 8 months ago

There is a landmark Cyber Security and Resilience Bill introduced to Parliament on November 12, 2025 that would impose large fines on companies that fail to secure themselves and would extend mandatory cybersecurity duties to a wider range of critical infrastructure and digital providers, including energy, transport, healthcare, water, data centers and certain IT companies. The law would allow regulators to designate critical suppliers such as diagnostics or chemical providers and bring managed service providers into scope, while giving the technology secretary powers to order specific actions like isolating high risk systems. Reporting thresholds are broadened to cover incidents that significantly affect confidentiality, integrity or availability even if no immediate disruption occurs, with requirements to notify regulators and the National Cyber Security Centre within 24 hours and provide a full report within 72 hours. The bill includes grace periods before enforcement, is not expected to take effect until 2027, and has drawn criticism for emphasizing resilience and recovery over more proactive measures to deter attackers.
‘Advanced’ hacker seen exploiting Cisco, Citrix zero-days

therecord.media · 8 months ago

Amazon said it uncovered a sophisticated campaign discovered in May in which an advanced threat actor exploited previously undisclosed zero day vulnerabilities in Citrix NetScaler appliances and in Cisco Identity Services Engine. Operators used custom malware and tailored backdoors with strong evasion to exploit CVE-2025-5777, known as Citrix Bleed Two, and CVE-2025-20337 to gain administrator level access before patches were broadly available. One IP linked to the exploit activity was tied to the RansomHub ransomware group and the bugs were used to target entities including the Pennsylvania Office of the Attorney General and the Netherlands Public Prosecution Service.
Microsoft Exchange 'Under Imminent Threat,' Act Now

www.darkreading.com · 8 months ago

Microsoft Exchange is being described as under imminent threat as attacks continue and the end of support for Exchange 2016 and 2019 in October will leave those servers without critical updates and patches. The Cybersecurity and Infrastructure Security Agency and the National Security Agency have issued best practices and warned that internet exposed Exchange instances and end of life servers will magnify risks. CISA issued an emergency directive mandating mitigation of a post authentication vulnerability tracked as CVE-2025-53786 and called the flaw a grave risk for hybrid joined Exchange configurations. Organizations are urged to avoid leaving Exchange internet exposed, perform internal lifecycle management, migrate to the Exchange Server Subscription Edition or to hosted cloud email solutions that update automatically, and Microsoft was urged to extend security updates and incentives to ease migrations.
The GitHub Security Blindspot: When Your Organisation Members’ Personal Repos Become Your Problem

www.reddit.com · 8 months ago

Personal GitHub repositories owned by organization members create an unmonitored attack surface because organization level protections stop at the organization boundary, allowing company code, credentials, and infrastructure details to be exposed. A bug bounty engagement found over 200 personal repositories matching an internal codebase in an organization of about one hundred developers, with five percent exposing hardcoded API keys or database credentials and eleven percent containing internal hostnames or documentation useful for reconnaissance. Mitigation is to extend the security perimeter by discovering all organization members and scanning their public repositories using GitHub GraphQL, incremental stateful scans, and secret detection tools such as TruffleHog, with real time alerts to security teams. Operational advice includes using minimal permission GitHub tokens, handling API rate limits with exponential backoff, maintaining an immutable audit trail, prioritizing developer education over heavy enforcement, and deploying scans via cron jobs or GitHub Actions.
Data broker Kochava agrees to change business practices to settle lawsuit

therecord.media · 8 months ago

Mobile device users who sued the data broker Kochava are seeking final approval of a settlement that would bar the company from sharing or selling data that reveals sensitive locations. Under the proposed deal Kochava would stop directly profiting from location data collected via software development kits embedded in apps, create an opt out tool to remove consumers from its database and place them on a blacklist to block future collection and sharing. The company is also facing separate litigation from the Federal Trade Commission which alleges Kochava sold precise geolocation data within ten feet of a device and other highly sensitive information in violation of the agency rule against unfair and deceptive practices. The settlement includes one and a half million dollars in attorneys fees and payments of two thousand five hundred dollars to each plaintiff not to exceed a total of seventeen thousand five hundred dollars.
PAN-SA-2025-0018 Chromium and Prisma Browser: Monthly Vulnerability Update (November 2025) (Severity: MEDIUM)

security.paloaltonetworks.com · 8 months ago

There are multiple Chromium security fixes and Prisma Browser updates addressing vulnerabilities rated Medium with suggested urgency Moderate, and there is no known malicious exploitation and no available workarounds. Users should update Prisma Browser to version 142.15.2.60 for the Chromium fixes and to version 142.15.6.60 for the Prisma Browser specific fixes. CVEs addressed include CVE-2025-12428, CVE-2025-12429, CVE-2025-12430, CVE-2025-12431, CVE-2025-12432, CVE-2025-12433, CVE-2025-12036, CVE-2025-12434, CVE-2025-12435, CVE-2025-12436, CVE-2025-12437, CVE-2025-12438, CVE-2025-12439, CVE-2025-12440, CVE-2025-12441, CVE-2025-12443, CVE-2025-12444, CVE-2025-12445, CVE-2025-12446, CVE-2025-12447, CVE-2025-4616, CVE-2025-4617, and CVE-2025-4618.
CVE-2025-4619 PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Packets (Severity: MEDIUM)

security.paloaltonetworks.com · 8 months ago

CVE-2025-4619 is a denial of service vulnerability in PAN-OS that allows an unauthenticated attacker to reboot a firewall by sending a specially crafted packet through the data plane, and repeated attempts can force the firewall into maintenance mode. The issue affects PA-Series, VM-Series, CN-Series and Prisma Access running certain PAN-OS 11.1, 11.2, and 10.2 builds but does not affect Cloud NGFW, and exposure requires url proxy or any decrypt-policy to be configured. The vulnerability has a CVSS base score of 6.6, has no known workarounds, and the recommended remediation is to upgrade to the fixed PAN-OS builds listed by the vendor.
Google files lawsuit to disrupt massive ‘Lighthouse’ smishing scheme

therecord.media · 8 months ago

Google filed a lawsuit in the Southern District of New York seeking to disrupt a Chinese cybercriminal operation that developed the Lighthouse phishing kit used to run widespread smishing campaigns and build fraudulent payment websites. The Lighthouse kit is sold as a phishing as a service product that provided scammers with templates and tools and was allegedly used to create about two hundred thousand fake websites in a twenty day period. Google alleges between 12.7 million and 115 million U.S. credit cards were compromised, found more than one hundred templates using Google branding, and is seeking an injunction while supporting new legislation including the SCAM Act to counter transnational scam operations.
Wie ChatGPT sich selbst eine Prompt Injection zufügt

www.csoonline.com · 8 months ago

Forscher von Tenable haben sieben neue Methoden aufgezeigt, mit denen Angreifer ChatGPT dazu bringen können, private Informationen aus Nutzerchats preiszugeben. Die Angriffe sind größtenteils indirekte Prompt Injections, die Funktionen wie die Browsing-Chain SearchGPT, die langfristige Kontextspeicherung und die Memories-Funktion ausnutzen, etwa durch manipulierte Webseiten, Blogkommentare oder unterschiedliche Inhalte für Crawler. Bei einer sogenannten Conversation Injection lässt sich der Output von SearchGPT so manipulieren, dass ChatGPT sich selbst eine Prompt Injection einfügt, und Angreifer können sensible Antworten später über Techniken wie das Laden externer Bilder in kodierter Form oder über getrackte Suchlinks rekonstruieren. Tenable meldete die Befunde an den Anbieter, es wurden teilweise Fixes umgesetzt, doch mehrere der beschriebenen Techniken funktionieren weiterhin.
DanaBot malware is back to infecting Windows after 6-month break

www.bleepingcomputer.com · 8 months ago

DanaBot malware has returned six months after law enforcement disrupted its operations, with security researchers identifying a new variant labeled version 669 that rebuilt its command and control infrastructure using Tor hidden services and backconnect nodes. The malware operates as a modular information stealer and loader targeting browser stored credentials and cryptocurrency wallet data and is distributed via malicious email attachments or links, search engine optimization poisoning, and malvertising campaigns. Researchers published new indicators of compromise and cryptocurrency addresses used to collect stolen funds, and organizations are advised to add those indicators to blocklists and update security tools.
China’s Cyber Silence Is More Worrying Than Russia’s Noise, Chief Cybersecurity Strategist Says

www.securityweek.com · 8 months ago

There is concern that China's relative silence in cyber operations is more worrying than Russia's noisy disruptive attacks because China may be withholding destructive techniques to preserve surprise and maximize future impact. Lessons from Ukraine highlight the need for continuous resilience enhancement, defense in depth, and international cooperation and intelligence sharing to withstand sustained cyber campaigns. Adoption of 5G's advanced features is slower than expected due to deployment costs and unclear use cases, creating a chicken and egg problem for industry and municipalities. There is growing alarm over the path from generative AI toward artificial general intelligence because AGI could automate large parts of society and might act against human interests unless humans remain firmly in the loop.
Holiday Fraud Trends 2025: The Top Cyber Threats to Watch This Season

www.techrepublic.com · 8 months ago

There are five key trends as holiday fraud accelerates in 2025, with attackers industrializing operations by combining AI, automation, stolen account data, and underground marketplaces. Fraud campaigns are starting weeks earlier, account takeover and credential stuffing are surging with hundreds of millions of stolen accounts listed, and gift cards remain the preferred monetization channel. AI powered bots are expected to dominate holiday web traffic by mimicking human behavior and evading traditional detection, while automation shortens the fraud lifecycle so compromised data moves from breach to resale in under five days. Organizations are advised to monitor earlier, protect account integrity with adaptive multi factor authentication, defend APIs with authentication and rate controls, unify fraud and security operations, and track criminal marketplaces for pre positioned configurations.
Phishing Tool Uses Smart Redirects to Bypass Detection

www.darkreading.com · 8 months ago

A new phishing tool called Quantum Route Redirect lowers the technical barrier for attackers by offering a preconfigured, one click platform that automates campaign setup and victim tracking. Its intelligent redirect system serves benign content to security scanners while sending real users to credential harvesting pages, enabling it to bypass Microsoft 365 defenses such as Exchange Online Protection, secure email gateways, and time of click analysis. Researchers have found around one thousand domains hosting the tool and linked campaigns that have compromised victims in ninety countries, with about three quarters of victims located in the United States. Defensive steps include deploying natural language processing based content and impersonation analysis, strengthening domain and URL filtering in email security and web application firewalls, and using sandboxing or managed inspection to detect malicious redirection.
Google Sues China-Based Hackers Behind $1 Billion Lighthouse Phishing Platform

thehackernews.com · 8 months ago

Google has filed a civil lawsuit in the United States District Court for the Southern District of New York against China based operators of a Phishing as a Service platform called Lighthouse that has ensnared more than one million users across 120 countries. The Lighthouse PhaaS is used to run large scale SMS phishing and smishing campaigns that impersonate trusted brands such as E ZPass and USPS to trick victims into clicking links about fake toll fees or package deliveries and steal financial information, and the operation is alleged to have generated over one billion dollars in illegal proceeds in the past three years. Google reports finding at least 107 fraudulent website templates using Google branding, is pursuing remedies under the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act and the Computer Fraud and Abuse Act to dismantle the infrastructure, and researchers link Lighthouse to a broader ecosystem including Lucid and Darcula and to smishing syndicates that may have compromised millions of payment cards.
How TTP-based Defenses Outperform Traditional IoC Hunting

www.securityweek.com · 8 months ago

There is rising ransomware risk and remediation cost, with the IBM 2025 Cost of a Breach report placing the average ransomware incident cost at about five point zero eight million dollars and over twenty thousand new CVEs published each year, making signature and IoC chasing increasingly impractical. Behavioral detection that focuses on tactics, techniques, and procedures mapped to the MITRE ATTACK framework outperforms traditional IoC hunting because TTPs represent harder to change attacker behaviors and enable earlier detection of actions such as privilege escalation, credential theft, and lateral movement. Effective implementation requires a converged, cloud native Secure Access Service Edge architecture that inspects traffic inline across remote users, branches, and cloud workloads, normalizes contextual telemetry, and enables centralized, automated policy enforcement and containment. Coordinated operational controls including inline threat prevention, SMB file activity monitoring, micro segmentation, zero trust network access, and managed detection and response should be applied through a centralized policy framework to accelerate containment and reduce business impact.
Microsoft fixes bug causing false Windows 10 end-of-support alerts

www.bleepingcomputer.com · 8 months ago

There was a bug after the October 2025 updates that caused Windows Update to display incorrect end of support warnings, but it was a cosmetic issue and affected devices continued to receive security updates. The bug affected Windows 10 22H2 Pro, Education, and Enterprise editions enrolled in the Extended Security Updates program with activated ESU keys, as well as Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021, which remain supported until January 2032 and January 2029 respectively. Microsoft deployed a cloud configuration update and released cumulative update KB5068781 on November 11, 2025 to resolve the issue, recommended installing the latest updates, and advised administrators who cannot deploy the update to use the Known Issue Rollback group policy because some devices may not receive the cloud fix if they are offline or blocked from dynamic updates.
Extending Zero Trust to AI Agents: “Never Trust, Always Verify” Goes Autonomous

www.bleepingcomputer.com · 8 months ago

Organizations are rapidly adopting autonomous AI agents that act, decide, and access sensitive data at machine speed, expanding the attack surface and exposing systems to risks that traditional Zero Trust frameworks were not designed to address. Security must treat agents as first class identities with unique auditable identities, enforce least privilege by default, apply dynamic context driven permissions, and continuously monitor agent behavior for anomalies. Effective guardrails include issuing scoped short lived tokens, tiered trust models that require human approval for high risk operations, strict access boundaries, and clear human ownership, and CISOs should expand Zero Trust to include identity first AI security architectures and monitoring tools.
Leading AI companies accidentally leak their passwords and digital keys on GitHub – what you need to know

www.fortra.com · 8 months ago

There are widespread accidental exposures of passwords, API keys, tokens, and digital keys on GitHub by many leading artificial intelligence companies, with security researchers who examined fifty firms finding that sixty five percent had exposed highly sensitive information. The exposed credentials could grant access to internal systems, training data, and private AI models, and included tokens tied to platforms such as Eleven Labs, LangChain, and Hugging Face, with the affected companies collectively worth over four hundred billion US dollars. Researchers reported that nearly half of notification attempts received no response and problems remained unresolved, and that common causes include human error, remnants in deleted forks and workflow logs, and the absence of clear reporting channels. The recommended mitigations are automated secret scanning before public commits, training developers not to hardcode real passwords, and establishing clear channels for security researchers to report exposed secrets.
New UK laws to strengthen critical infrastructure cyber defenses

www.bleepingcomputer.com · 8 months ago

The United Kingdom has introduced the Cyber Security and Resilience Bill to strengthen defenses for hospitals, energy systems, water supplies, and transport, building on existing NIS regulations and brought to Parliament on November 12, 2025. The law requires medium and large IT management, help desk, and cybersecurity service providers to meet mandatory security standards, maintain effective response plans, and report significant incidents to the National Cyber Security Centre and their regulator within 24 hours with full reports due in 72 hours. Regulators can designate critical suppliers such as healthcare diagnostic providers or water chemical suppliers, the Technology Secretary can direct actions like enhanced monitoring or system isolation during national security threats, and turnover based penalties will apply for serious breaches while protections extend to data centers and smart energy infrastructure. Government research estimates an average significant cyberattack costs about one hundred ninety thousand pounds and totals roughly fourteen point seven billion pounds annually, with incidents such as a Jaguar Land Rover attack causing estimated damages of at least one point nine billion pounds.
Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks

www.bleepingcomputer.com · 8 months ago

An advanced threat actor exploited critical zero day vulnerabilities CVE-2025-5777, known as Citrix Bleed 2 in NetScaler ADC and Gateway, and CVE-2025-20337 in Cisco Identity Services Engine to deploy custom malware and a stealthy web shell. Amazon MadPot honeypot telemetry showed exploitation occurred before public disclosure and patches, and the Cisco ISE flaw was leveraged to gain pre authentication administrative access and install an IdentityAuditAction web shell that registered an HTTP listener, used Java reflection, and employed DES with non standard base64 encoding to evade detection. The activity points to a highly resourced actor exploiting multiple undisclosed flaws with apparently indiscriminate targeting, and organizations are advised to apply available patches for CVE-2025-5777 and CVE-2025-20337 and to limit access to edge network devices.
Amazon Uncovers Attacks Exploited Cisco ISE and Citrix NetScaler as Zero-Day Flaws

thehackernews.com · 8 months ago

Amazon's threat intelligence team observed an advanced threat actor exploiting two then zero day flaws in Citrix NetScaler ADC and Cisco Identity Services Engine, tracked as CVE-2025-5777 and CVE-2025-20337 respectively. The Citrix flaw was associated with insufficient input validation enabling authentication bypass with a CVSS score of 9.3 and was patched in June 2025, while the Cisco ISE flaw allowed unauthenticated remote code execution as root with a CVSS score of 10.0 and was patched in July 2025. Exploitation culminated in deployment of a custom in memory web shell disguised as an IdentityAuditAction component that uses Java reflection to inject into running threads, registers as a Tomcat HTTP listener, and employs DES with nonstandard Base64 encoding to evade detection, prompting recommendations to restrict access to privileged management portals and implement defense in depth.
NHS patients to finally be informed if hackers published their STI and cancer test data

therecord.media · 8 months ago

Synnovis has begun notifying individuals whose sensitive pathology data, including sexual health and cancer test information, was published by the Qilin ransomware group after a June 2024 attack. The company says a complex investigation taking more than a year reconstructed unstructured and fragmented stolen data and that impacted organisations will be notified by 21 November 2025, with those organisations responsible for informing patients directly. An analysis by data breach specialists CaseMatrix suggests the published material affected more than 900,000 people and included names, dates of birth, NHS numbers and in some cases contact details, and Synnovis says it did not pay a ransom.
Miniatur Wunderland Hamburg warnt vor Datendiebstahl

www.csoonline.com · 8 months ago

Das Miniatur Wunderland Hamburg warnt Besucher vor einem Datenschutzvorfall, bei dem offenbar der Online-Ticketshop kompromittiert wurde und Kreditkartendaten an unberechtigte Dritte übertragen worden sein könnten. Betroffen sind Online-Käufe vom 6. Juni 2025 bis 29. Oktober 2025; Angreifer konnten Karteninhabername, Kartennummer, Sicherheitscode CVV und Gültigkeitsdatum einsehen. Der betroffene Server wurde nach Bekanntwerden isoliert. Ein Missbrauch der Daten kann zu unautorisierten Kartentransaktionen oder Identitätsdiebstahl führen, weitere Details zum Angriff liegen bisher nicht vor.
Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101) - watchTowr Labs

www.reddit.com · 8 months ago

There is a NetScaler memory leak tracked as WT-2025-0089 that occurs when an AAA virtual server is created without enabling the AAA feature, but Citrix judged the misconfiguration highly unlikely in internet-exposed environments and did not assign a CVE. There is a SAML RelayState reflected cross site scripting vulnerability tracked as WT-2025-0090 and assigned CVE-2025-12101, which can be triggered by a crafted POST to the CGI logout endpoint and may be exploitable via CSRF. watchTowr disclosed the issues to Cloud Software Group in late August 2025, Citrix confirmed its assessment and scheduled a fix, CVE-2025-12101 was assigned and published on November 11, 2025, and watchTowr published its research on November 12, 2025.
AppleScript Used to Deliver macOS Malware Disguised as Zoom & Teams Updates

gbhackers.com · 8 months ago

Since Apple removed the right click Gatekeeper override in August 2024, threat actors have shifted to using AppleScript scpt files to bypass security controls and distribute credential stealers disguised as legitimate Zoom and Microsoft Teams updates. Campaigns begin with social engineering via Telegram and Calendly that lures targets to run heavily obfuscated AppleScript files which fetch multi stage payloads including Nim compiled and C++ Mach O binaries that employ process injection, TLS encrypted WebSocket communications, and signal based persistence while stealing Keychain and browser credentials. Organizations are advised to block unsigned installers, obtain updates only from official vendor domains, and treat unexpected support links or meeting invites as suspicious to reduce the risk of compromise.
Google Sues Chinese Cybercriminals Behind ‘Lighthouse’ Phishing Kit

www.securityweek.com · 8 months ago

Google has filed a lawsuit accusing a China linked group known as Smishing Triad of operating Lighthouse, a phishing service kit used since at least 2023 to send impersonated SMS messages that trick recipients into handing over email credentials, banking details, and other sensitive information. The campaign used more than 194,000 malicious domains and enabled phishing sites that reportedly targeted over one million users across more than 120 countries and led to an estimated 12 million to 115 million United States credit card compromises. Google says it is seeking to dismantle the operation by seizing domains and subpoenaing registrars and hosting providers, bringing claims under the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act, and the Computer Fraud and Abuse Act, and backing bipartisan bills aimed at curbing scam operations.
SecureVibes Introduces Multi-Language Vulnerability Scanner Powered by Claude AI

gbhackers.com · 8 months ago

SecureVibes has unveiled a vulnerability scanner that leverages Anthropic Claude AI to provide intelligent security analysis across eleven programming languages. The system uses a multi agent architecture with coordinated agents for architecture mapping, STRIDE threat modeling, code review, and an optional dynamic application security testing phase to validate exploitability. The tool is designed to automate and deepen vulnerability detection for developers and security teams working with modern, diverse codebases.
UK cybersecurity bill brings tougher rules for critical infrastructure

www.csoonline.com · 8 months ago

The UK government has introduced the Cyber Security and Resilience Bill to harden national defenses across healthcare, energy, water, transport and digital services by imposing mandatory security standards and requiring significant cyber incidents to be reported within 24 hours. Noncompliance can trigger daily fines of up to 100,000 pounds or penalties tied to annual turnover, and the bill expands scope to include managed service providers, data centers and key suppliers while mandating a full incident report within 72 hours. The technology secretary would gain emergency powers to direct regulators and organizations, including NHS trusts and utilities, to take proportionate steps such as enhanced monitoring or temporary network isolation during major cyber incidents. The measure updates the NIS 2018 framework, supports the government resilience strategy and is expected to receive Royal Assent in 2026 after a series of disruptive attacks revealed vulnerabilities in critical infrastructure.