Major Incidents or Breaches

  • Jaguar Land Rover (JLR) reported a 43% decline in third-quarter wholesale volumes following a cyberattack in September 2025.
  • Sedgwick confirmed a security breach at its federal contractor subsidiary, Sedgwick Government Solutions.
  • Two malicious Chrome extensions, installed by approximately 900,000 users, were found exfiltrating ChatGPT and DeepSeek conversations and browsing data.
  • NordVPN denied a breach after a threat actor leaked data allegedly sourced from the company; an internal investigation is ongoing.
  • Researchers linked dozens of major data breaches to a single initial access broker using credentials exfiltrated by information stealers.
  • A phishing campaign is actively abusing Google Cloud Integration Application infrastructure to steal Microsoft 365 credentials, bypassing standard email filters.

Newly Discovered Vulnerabilities

  • A critical remote code execution vulnerability (CVE-2026-0625, CVSS 9.3) in legacy D-Link DSL gateway routers is under active exploitation. The affected devices are out of support.
  • An unpatched firmware flaw in the TOTOLINK EX200 wireless range extender allows remote authenticated attackers full device takeover.
  • A critical Dolby vulnerability (CVE-2025-54957) in Android, discovered by Google researchers, has been patched.
  • AI-powered VS Code forks (Cursor, Windsurf, Google Antigravity, Trae) recommend non-existent extensions, creating a supply chain risk in the Open VSX ecosystem.

Notable Threat Actor Activity

  • The Kimwolf Android botnet, an Aisuru malware variant, has infected over two million hosts by exploiting vulnerabilities in residential proxy networks to target internal devices.
  • Scattered Lapsus$ Hunters (ShinyHunters) were lured into a honeypot using synthetic data and fake accounts, allowing researchers to gather intelligence on their infrastructure and tactics.
  • A campaign named PHALT#BLYX targets the hospitality sector with fake booking emails that redirect hotel staff to counterfeit blue screen of death (BSoD) pages, leading to DCRat remote access trojan infections.
  • Chinese threat actors increased cyberattacks on Taiwan’s energy sector tenfold in 2025 compared to the previous year, according to Taiwan’s National Security Bureau.
  • An initial access broker has been linked to numerous major data breaches using credentials harvested by information-stealing malware.

Trends, Tools, or Tactics of Interest

  • Generative AI is accelerating credential attacks against Active Directory, enabling faster and more effective password cracking.
  • AI-generated images and videos are being used in misinformation campaigns during breaking news events, complicating verification and increasing the risk of disinformation.
  • Paid AI-powered tools capable of generating “undressed” images are becoming more accessible and mainstream via platforms such as X (formerly Twitter).
  • The ClickFix campaign uses legitimate Microsoft tools and social engineering (fake BSoD errors) to deploy DCRat RAT, particularly targeting the hospitality industry.
  • Tailsnitch, a new tool for auditing Tailscale configurations, has been released to improve overlay network security.
  • Debate continues around whether prompt injection and sandbox-related issues in Microsoft Copilot constitute true security vulnerabilities or are inherent limitations of AI systems.
  • Cyber risk management is shifting focus toward resilience and rapid recovery rather than solely prevention.

Regulatory or Policy Developments

  • Disney was fined $10 million by the FTC for violating children’s privacy laws by mislabeling kid-focused YouTube videos.
  • Microsoft canceled its planned daily limit of 2,000 external recipients for Exchange Online bulk email senders.
  • Thirty significant cybersecurity M&A deals were announced in December 2025, involving major industry players such as Akamai, Red Hat, Checkmarx, Silent Push, and ServiceNow.