ShadyPanda on DanSec Daily

Cybersecurity Brief – 2026-01-01

Thu, 01 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Trust Wallet Chrome Extension Hack: Trust Wallet disclosed that a supply chain attack involving the Shai-Hulud worm in November 2025 compromised its Chrome extension, resulting in the theft of $8.5 million from 2,520 wallets. The attacker exploited exposed developer GitHub secrets to publish a backdoored browser extension.
Unleash Protocol Hack: The decentralized intellectual property platform Unleash Protocol suffered a loss of approximately $3.9 million in cryptocurrency after an unauthorized contract upgrade enabled asset withdrawals, attributed to a multisig hijack.
European Space Agency Breach: The European Space Agency confirmed that external science servers were compromised and that a hacker is offering to sell stolen data. An investigation is ongoing.
DarkSpectre Browser Extension Campaigns: The threat actor behind previous ShadyPanda and GhostPoster campaigns has been attributed to a third campaign, DarkSpectre, impacting 2.2 million users. In total, the campaigns have affected 8.8 million users worldwide.
Ivanti EPMM Attacks: April/May zero-day exploitations of Ivanti’s mobile device management platform resulted in the compromise of thousands of organisations by a Chinese APT.

Newly Discovered Vulnerabilities

IBM API Connect: IBM disclosed a critical authentication bypass vulnerability (CVE-2025-13915, CVSS 9.8) in API Connect that could allow remote attackers to access applications. Customers have been urged to patch immediately.
React2Shell Flaw in Next.js: The RondoDox botnet is actively exploiting the critical React2Shell vulnerability (CVE-2025-55182) to breach Next.js servers, deploying malware and cryptominers.

Notable Threat Actor Activity

North Korean Fraudulent Job Applicants: Amazon reported blocking more than 1,800 suspected North Korean job applicants since April 2024, indicating ongoing attempts by North Korean actors to infiltrate Western technology companies.
Shai-Hulud Worm Activity: Researchers have identified a new, modified strain of the Shai-Hulud worm on the npm registry, showing continued evolution and testing of payloads following the Trust Wallet supply chain attack.
RondoDox Botnet: Actively exploiting the React2Shell vulnerability to compromise Next.js servers.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks on Browser Extensions: The Shai-Hulud campaign demonstrates continued targeting of browser extension supply chains, leveraging compromised developer credentials to distribute malicious updates.
Malicious Browser Extensions: Large-scale campaigns such as DarkSpectre, ShadyPanda, and GhostPoster highlight the persistent threat from malicious browser extensions, impacting millions of users globally.
Cryptocurrency Platform Targeting: Both Trust Wallet and Unleash Protocol incidents reflect ongoing targeting of cryptocurrency platforms through supply chain and contract manipulation attacks.
IoT and Cloud Reliance: Reports discuss the risks associated with IoT device dependence on cloud services, with outages causing widespread disruption to connected devices.
AI and Identity Security: Industry predictions for 2026 note increased adoption of agentic AI, expansion of identity governance and administration (IGA) in the mid-market, SOC-identity team collaboration, and identity platform consolidation. Growing skepticism about AI’s ROI and economic sustainability is also noted.

Regulatory or Policy Developments

Disney COPPA Settlement: Disney agreed to pay a $10 million civil penalty to settle claims of violating the Children’s Online Privacy Protection Act (COPPA) by mislabeling videos and allowing targeted advertising data collection on YouTube.
Age Verification Laws: Enforcement of age checks in 2025 led to widespread internet access issues, with some websites blocking entire countries and users increasingly turning to VPNs to bypass restrictions.
Device Bans at Public Events: The NYC mayoral inauguration explicitly banned Flipper Zero and Raspberry Pi devices, reflecting growing concerns about the use of hacking tools at high-profile events.

Cybersecurity Brief – 2025-12-16

Tue, 16 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

SoundCloud confirmed a security breach resulting in the theft of a user database containing member data and subsequent disruption of VPN access for users.
Askul Corporation, a Japanese e-commerce company, disclosed that RansomHouse hackers stole approximately 740,000 customer records in an October ransomware attack.
PornHub is being extorted by the ShinyHunters gang following the theft of Premium member search and watch history data, reportedly accessed via a Mixpanel data breach.
700Credit, a U.S.-based financial services provider, reported a data breach impacting 5.8 million individuals, with stolen data including names, addresses, dates of birth, and Social Security numbers.

Newly Discovered Vulnerabilities

FreePBX patched multiple critical vulnerabilities, including an authentication bypass, SQL injection, and file upload flaws, all of which could enable remote code execution.
Atlassian released updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira to address a critical Apache Tika vulnerability.
Apple patched two actively exploited WebKit zero-days in macOS and iOS, which are linked to a previously patched Chrome flaw. The vulnerabilities were used in sophisticated attacks.
React2Shell (CVE-2025-55182) remote code execution vulnerability continues to be actively exploited, with new exploits surfacing.
Microsoft confirmed that December 2025 security updates are causing failures in Message Queuing (MSMQ) and breaking VPN networking for Windows Subsystem for Linux (WSL) users.

Notable Threat Actor Activity

Five additional Chinese threat groups have been linked by Google to ongoing exploitation of the React2Shell vulnerability for malware delivery. Iranian threat actors have also been observed leveraging the same flaw.
The ShadyPanda threat group was identified as responsible for a large-scale campaign hijacking popular Chrome and Edge browser extensions.
Phantom Stealer is being distributed via phishing emails with malicious ISO attachments, targeting various sectors in Russia.
The pro-Russia CyberVolk ransomware group’s VolkLocker variant was found to contain a flaw that allows victims to decrypt their files without paying ransom.
SantaStealer, a new information stealer malware offered as malware-as-a-service, is being promoted on Telegram and hacker forums, featuring in-memory operation to evade file-based detection.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly abusing free Cloudflare Pages to host phishing portals, aiding in evasion of security scanners.
Phishing trends in 2025 show a shift beyond email, with increased use of social platforms, search ads, and browser-based techniques to bypass multi-factor authentication and steal session tokens.
Deepfake attacks are becoming more realistic and compelling, raising concerns about their use in social engineering and disinformation.
Militant and extremist groups are experimenting with AI technologies, including propaganda and deepfakes, to expand their influence.
A Chrome browser extension with a “Featured” badge and six million users was discovered intercepting and collecting user prompts from AI chatbots.
PayPal closed a loophole that allowed scammers to send legitimate-looking emails from service@paypal.com, which were used to push tech support scams.
Pig butchering scams are being highlighted as a growing global crisis, involving large-scale, long-term social engineering fraud.

Regulatory or Policy Developments Affecting the Security Industry

Google announced the discontinuation of its dark web monitoring/report tool in early 2026, impacting users’ ability to monitor exposure of personal information on the dark web.
The French Ministry of the Interior confirmed a cyberattack that compromised its email servers.
Cyber insurance managing general agents (MGAs) are increasingly shaping policies to better reflect real-world cyber risk, with a focus on sector-specific expertise.
A third individual pleaded guilty in the U.S. for involvement in a credential stuffing attack against DraftKings, underlining ongoing law enforcement activity against cybercrime.

Cybersecurity Brief – 2025-12-04

Thu, 04 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Cloudflare mitigated a record-breaking 29.7 Tbps distributed denial-of-service (DDoS) attack attributed to the Aisuru botnet, which leveraged up to 4 million infected hosts and launched over 1,300 attacks in three months.
Marquis Software Solutions reported a data breach impacting over 74 US banks and credit unions.
French retailer Leroy Merlin disclosed a data breach that compromised customer personal data in France.
Freedom Mobile, a major Canadian wireless carrier, suffered a breach exposing customer data after attackers accessed its customer account management platform.
The University of Phoenix and the University of Pennsylvania confirmed data breaches linked to the exploitation of vulnerable Oracle E-Business Suite instances in a campaign attributed to the Clop ransomware group.
WordPress sites using the King Addons for Elementor plugin are being actively compromised via exploitation of a critical vulnerability (CVE-2025-8489), allowing attackers to create admin accounts and take over sites.

Newly Discovered Vulnerabilities

Critical vulnerabilities in React Server Components (RSC), tracked as CVE-2025-5518 and another CVE, allow unauthenticated remote code execution; these flaws may impact more than a third of cloud service providers.
The King Addons for Elementor WordPress plugin (CVE-2025-8489, CVSS 9.8) is under active attack, enabling privilege escalation to administrative permissions.
Microsoft silently patched a high-severity Windows LNK vulnerability that has been exploited by multiple state-backed and cybercrime groups as a zero-day since 2017. The November 2025 Patch Tuesday update addressed the issue, and Windows now displays additional LNK file properties to help identify malicious code.
Three critical vulnerabilities were disclosed in Picklescan, an open-source utility for scanning PyTorch models. These flaws allow malicious PyTorch models to evade scans and execute arbitrary code.
Chrome 143 stable release addressed 13 vulnerabilities, including a high-severity flaw in the V8 JavaScript engine.

Notable Threat Actor Activity

Kaspersky identified Shai Hulud 2.0, a new version of the npm worm now equipped with wiper functionality, targeting organizations in Russia, India, Brazil, China, and other countries.
The Water Saci threat actor has evolved its banking trojan campaign in Brazil, now using a multi-layered infection chain involving HTA files, PDFs, and propagation via WhatsApp and RelayNFC for NFC relay fraud. AI-enhanced Python variants are targeting enterprise users of banks and cryptocurrency exchanges.
The MuddyWater APT (linked to Iran) targeted Israeli organizations using new evasion tactics, including techniques mimicking the retro Snake mobile game.
The ShadyPanda group, believed to be China-based, has been using malicious Chrome and Edge browser extensions to spy on millions of users globally.
A malicious Rust crate was discovered targeting Web3 developer systems across Windows, macOS, and Linux, capable of OS-specific malware delivery and stealthy execution.
DragonForce ransomware, in collaboration with the Scattered Spider group, has expanded operations in 2025, leveraging advanced social engineering and initial access techniques.
Attackers are increasingly using Evilginx to steal session cookies, enabling bypass of multi-factor authentication (MFA) protections.
There is a rise in attackers abusing legitimate Remote Monitoring and Management (RMM) tools to gain remote control of victim systems.

Trends, Tools, or Tactics of Interest

The Aisuru botnet’s scale and DDoS throughput set new records, highlighting the growing potency of botnet-driven attacks.
Matrix Push C2, a new criminal toolkit, is abusing browser push notifications to launch social engineering attacks.
Use of AI tools is fueling more sophisticated cybercrime, lowering barriers for less-skilled actors and enhancing the quality of phishing and malware campaigns.
Attackers are increasingly targeting enterprises during off-hours, weekends, and holidays, exploiting reduced staffing and slower response times.
Content Delivery Networks (CDNs) remain a primary mitigation for DDoS and aggressive bot traffic, but attackers are attempting to bypass these protections.
Fileless attack techniques and abuse of legitimate IT tools are increasingly observed, complicating detection and response for defenders.

Regulatory or Policy Developments

The Arizona Attorney General has filed a lawsuit against Chinese online retailer Temu, alleging unauthorized and undisclosed access to and harvesting of user data through its mobile application.
CISA and partners released a new joint guide focused on the secure integration of artificial intelligence in operational technology environments.
Google is expanding Android’s in-call scam protection for financial applications in the US, aiming to address rising phone-based fraud.
Russia has blocked access to the Roblox gaming platform, citing the distribution of LGBT-related content and extremist material as justification.

Cybersecurity Brief – 2025-12-02

Tue, 02 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, South Korea’s largest retailer, suffered a data breach impacting 33.7 million customers, exposing personal information.
The CodeRED Emergency Alert Platform was shut down following a cyberattack attributed to the Inc ransomware gang, which claims to have stolen sensitive subscriber data.
The open-source SmartTube YouTube app for Android TV was compromised after an attacker accessed the developer’s signing keys, resulting in a malicious update being distributed to users.
OpenAI experienced a data breach that resulted in exposure of sensitive information, as reported in recent threat intelligence updates.

Newly Discovered Vulnerabilities

CVE-2025-61260: A command injection vulnerability was disclosed in OpenAI Codex CLI, allowing malicious project-local configuration files to execute arbitrary commands.
CISA added CVE-2021-26829, a vulnerability in ScadaBR (an open-source industrial control system), to its Known Exploited Vulnerabilities catalog following a hacktivist ICS attack.
A new variant of the Shai-hulud self-replicating npm-package poisoning worm was identified, capable of stealing credentials and secrets from AWS, Google Cloud Platform, and Azure.
Glassworm malware has returned in a third wave, with 24 new malicious packages uploaded to the OpenVSX and Microsoft Visual Studio Code marketplaces.

Notable Threat Actor Activity

ShadyPanda, a threat actor, has been linked to a seven-year-long campaign using malicious Chrome and Edge browser extensions, amassing over 4.3 million installs. Initially legitimate, these extensions evolved into spyware for data exfiltration.
The Russian-speaking Tomiris group is conducting a cyber-espionage campaign targeting government and diplomatic entities in CIS member states and Central Asia, deploying new tools and tactics.
The Inc ransomware gang claimed responsibility for the CodeRED platform attack, stating it exfiltrated sensitive subscriber data.
Russian cybercriminals have developed and are distributing Albiriox, a new Android banking trojan offered as malware-as-a-service (MaaS), targeting over 400 financial apps and enabling on-device fraud and remote control.

Trends, Tools, or Tactics of Interest

Increase in holiday-themed scams, particularly targeting mobile-first shoppers, as reported by Malwarebytes.
Attackers are leveraging trusted software supply chains, including code packages and browser extensions, to deliver malware (e.g., Glassworm, ShadyPanda).
The emergence of AI-powered browsers is raising new security concerns due to their novel architectures and integration with AI agents.
Threat actors are using deepfakes, fake resumes, and stolen identities to infiltrate organisations via hiring pipelines, increasing insider threat risks.
Law enforcement in Switzerland and Germany dismantled the Cryptomixer cryptocurrency mixing service, which facilitated laundering of over €1.3 billion in Bitcoin for cybercriminals. Approximately $29 million in Bitcoin was seized.
Albiriox malware is being marketed as a MaaS solution for $720 per month, reflecting the ongoing professionalisation of cybercrime services.

Regulatory or Policy Developments Affecting the Security Industry

India’s telecommunications ministry has mandated that all new mobile devices must come pre-installed with the government-backed cybersecurity app Sanchar Saathi within 90 days, aiming to combat telecom fraud.