https://blog.dansec.red/cves/cve-2025-61260/Recent content in CVE-2025-61260 on DanSec DailyHugoen-gbWed, 03 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-03-cybersecurity-news/Wed, 03 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-03-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Coupang, a major South Korean e-commerce platform, suffered a data breach compromising the personal information (names, addresses, email addresses, and phone numbers) of 33.7 million users over a five-month period.</li> <li>The University of Pennsylvania confirmed a data breach after attackers stole documents containing personal information from Oracle E-Business Suite servers in August.</li> <li>Korean authorities arrested four individuals for hacking over 120,000 IP cameras and selling intimate footage to a foreign adult site.</li> <li>The Shai-Hulud 2.0 npm malware attack exposed up to 400,000 developer secrets after infecting hundreds of npm packages and publishing stolen data in 30,000 GitHub repositories.</li> <li>Five Chrome and Edge browser extensions, with over 4 million installs, turned malicious after years of benign operation, acting as spyware and tracking users.</li> <li>Microsoft Defender XDR portal experienced a prolonged outage, disrupting access to security alerts and threat hunting capabilities for over 10 hours.</li> <li>OpenAI’s ChatGPT service suffered a global outage, with users unable to access conversations.</li> <li>Yearn Finance’s yETH pool on Ethereum was exploited for approximately $9 million via a critical vulnerability.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Google’s December 2025 Android security update patched 107 vulnerabilities, including two zero-days (CVE-2023-40088 and CVE-2023-40089) actively exploited in targeted attacks.</li> <li>A vulnerability in OpenAI’s Codex CLI (CVE-2025-61260) could allow command execution, potentially facilitating attacks on developers using the coding agent.</li> <li>Microsoft released KB5070311 for Windows 11, addressing File Explorer freezes and search issues, but also introduced a bug causing bright white flashes in dark mode.</li> <li>Malicious npm package eslint-plugin-unicorn-ts was discovered using hidden prompts and scripts to evade AI-driven security scanners.</li> <li>Chrome and Edge extensions were caught creating backdoors, profiling users, and reading cookie data to generate unique identifiers.</li> <li>The Raptor framework, an open-source AI tool, was demonstrated to generate both vulnerability exploits and patches using agentic workflows.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>North Korean threat actors (DPRK/Lazarus) were observed luring engineers to rent their identities for fraudulent IT work and distributing over 197 malicious npm packages since October 10, targeting software developers.</li> <li>The GlassWorm supply chain campaign resurfaced, infiltrating Microsoft Visual Studio Marketplace and Open VSX with 24 malicious extensions impersonating popular developer tools.</li> <li>Iran-linked MuddyWater group deployed a new backdoor, MuddyViper, in targeted attacks against Israeli sectors, including academia, engineering, government, manufacturing, technology, transportation, and utilities. The new Fooder loader and memory-only tactics indicate a shift to more stealthy espionage operations.</li> <li>An ongoing phishing campaign is spoofing top brands via fake Calendly invites to hijack Google Workspace and Facebook business accounts.</li> <li>Researchers reported that cybercrime has shifted to a full subscription model, with phishing kits, Telegram OTP bots, infostealer logs, and RATs now offered as “crime-as-a-service”.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Kaspersky Security Bulletin 2025 highlighted a significant increase in AI-driven biometric attacks, with 1 in 5 biometric attacks now leveraging AI-generated deepfakes.</li> <li>Researchers demonstrated that presenting prompts to AI models in poetic form increased jailbreak success rates from 8% to 43%.</li> <li>Attackers are leveraging supply chain attacks via malicious npm and Visual Studio extensions targeting developers.</li> <li>Crime-as-a-service offerings continue to proliferate, making advanced cybercrime tools and infrastructure more accessible.</li> <li>Tools like SecAlerts are emerging to streamline vulnerability management amid increasing software sprawl.</li> <li>The Raptor AI framework exemplifies the dual-use nature of generative AI in both offensive and defensive security contexts.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>India’s Department of Telecommunications mandated that messaging apps may only be used with active SIM cards linked to user identities, aiming to reduce fraud and misuse.</li> <li>The US FTC reached a settlement with Illuminate Education, requiring deletion of unnecessary student data and improved security practices following allegations of inadequate data protection.</li> <li>New York enacted a law requiring retailers to disclose if consumer data influences the pricing of basic goods.</li> </ul>https://blog.dansec.red/posts/2025-12-02-cybersecurity-news/Tue, 02 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-02-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Coupang, South Korea&rsquo;s largest retailer, suffered a data breach impacting 33.7 million customers, exposing personal information.</li> <li>The CodeRED Emergency Alert Platform was shut down following a cyberattack attributed to the Inc ransomware gang, which claims to have stolen sensitive subscriber data.</li> <li>The open-source SmartTube YouTube app for Android TV was compromised after an attacker accessed the developer&rsquo;s signing keys, resulting in a malicious update being distributed to users.</li> <li>OpenAI experienced a data breach that resulted in exposure of sensitive information, as reported in recent threat intelligence updates.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>CVE-2025-61260: A command injection vulnerability was disclosed in OpenAI Codex CLI, allowing malicious project-local configuration files to execute arbitrary commands.</li> <li>CISA added CVE-2021-26829, a vulnerability in ScadaBR (an open-source industrial control system), to its Known Exploited Vulnerabilities catalog following a hacktivist ICS attack.</li> <li>A new variant of the Shai-hulud self-replicating npm-package poisoning worm was identified, capable of stealing credentials and secrets from AWS, Google Cloud Platform, and Azure.</li> <li>Glassworm malware has returned in a third wave, with 24 new malicious packages uploaded to the OpenVSX and Microsoft Visual Studio Code marketplaces.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>ShadyPanda, a threat actor, has been linked to a seven-year-long campaign using malicious Chrome and Edge browser extensions, amassing over 4.3 million installs. Initially legitimate, these extensions evolved into spyware for data exfiltration.</li> <li>The Russian-speaking Tomiris group is conducting a cyber-espionage campaign targeting government and diplomatic entities in CIS member states and Central Asia, deploying new tools and tactics.</li> <li>The Inc ransomware gang claimed responsibility for the CodeRED platform attack, stating it exfiltrated sensitive subscriber data.</li> <li>Russian cybercriminals have developed and are distributing Albiriox, a new Android banking trojan offered as malware-as-a-service (MaaS), targeting over 400 financial apps and enabling on-device fraud and remote control.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Increase in holiday-themed scams, particularly targeting mobile-first shoppers, as reported by Malwarebytes.</li> <li>Attackers are leveraging trusted software supply chains, including code packages and browser extensions, to deliver malware (e.g., Glassworm, ShadyPanda).</li> <li>The emergence of AI-powered browsers is raising new security concerns due to their novel architectures and integration with AI agents.</li> <li>Threat actors are using deepfakes, fake resumes, and stolen identities to infiltrate organisations via hiring pipelines, increasing insider threat risks.</li> <li>Law enforcement in Switzerland and Germany dismantled the Cryptomixer cryptocurrency mixing service, which facilitated laundering of over €1.3 billion in Bitcoin for cybercriminals. Approximately $29 million in Bitcoin was seized.</li> <li>Albiriox malware is being marketed as a MaaS solution for $720 per month, reflecting the ongoing professionalisation of cybercrime services.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>India’s telecommunications ministry has mandated that all new mobile devices must come pre-installed with the government-backed cybersecurity app Sanchar Saathi within 90 days, aiming to combat telecom fraud.</li> </ul>