Coupang on DanSec Daily

Cybersecurity Brief – 2026-11-05

Thu, 05 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
CVE-2026-107441	2026-11-03	Zyxel GS1900 series switches	Unauthenticated OS command execution (out-of-bounds write), exploited as zero-day^[1]^[2]^[3]^[4]^[5]	Upgrade to firmware 2.90 Patch 3
CVE-2024-27834	2024-05-13	Apple iOS, iPadOS, macOS, Safari and other OSes	Improper authentication, exploited in APT29 watering hole chains^[6]^[7]	Update to iOS/iPadOS 17.5 or 16.7.8, macOS Sonoma 14.5, Safari 17.5 or later

Major Incidents and Breaches

Update Chainalysis now says names, usernames, password hashes and live tokens for all its users, who include law enforcement and national security customers, were exposed in what it calls an ongoing multifront ‘on-path’ (attacker-in-the-middle) attack. Its password reset function is currently down. (first reported 2026-10-31)^[8]^[9]
Update Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have joined Japan Airlines in reporting customer data breaches traced to the attack on Amadeus IT Group’s reservation, ticketing and check-in platforms. (first reported 2026-10-29)^[10]
DigiCert disclosed a breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorised access to customer information and identity documents.^[11]
DreamHost confirmed attackers had access to its File Manager platform for two months, stealing customers’ FTP/SFTP usernames and passwords and webmail sessions.^[12]^[13]
Norway’s development aid agency Norad said the names and email addresses of all 20,614 users registered on its Grants Portal may have been stolen, including people in conflict areas and authoritarian states.^[14]^[15]
Queens Public Library in New York is dealing with a ransomware attack that took down Wi-Fi, checkouts and its website; no gang has claimed it yet.^[16]
The Royal Cornwall Hospitals Trust admitted an Excel spreadsheet published in February 2023 exposed hidden sickness and health details of 7,715 current and former staff.^[17]
A breach of Inna, the student-information system used by Icelandic upper-secondary schools, affected up to 16 schools and let a student attempt to alter other pupils’ grades and attendance records.^[18]

Vulnerabilities and Patches

Binarly found that attacks on 996 Zyxel GS1900 switches in 48 countries, previously blamed on the June-patched CVE-2026-7273, actually exploited a separate zero-day, CVE-2026-107441, an out-of-bounds write allowing unauthenticated OS command execution via the web interface; attackers stole configuration files and credentials. Zyxel fixed it in 2.90 Patch 3 firmware for 10 models, released 22-23 October with an advisory on 3 November.^[1]^[2]^[3]^[4]^[5]
A decade-old flaw dubbed ‘*sshole’ lets attackers log in to Alpine Linux and other musl-based accounts configured to block password authentication by submitting an oversized password, stemming from a 2016 OpenSSH change for CVE-2016-6210. It is fixed in OpenSSH 10.6p2; otherwise disable password authentication and restart sshd.^[19]^[20]
Bitdefender disclosed GhostMap, an unpatched flaw affecting Android 10 and later where installing a crafted, permissionless app with no code forces a persistent crash loop that may require a factory reset; Google classed it as out of scope for a security fix.^[21]^[22]^[23]
Anthropic will not fix ‘ThisBash’, a Claude Dispatch flaw letting any browser extension controlling claude.ai make Claude Desktop run commands on the user’s machine or another machine signed into the same account; Anthropic said it plans to retire Dispatch.^[24]^[25]
Cisco fixed high-severity RCE CVE-2026-76506 in UCS Central Software, and WatchGuard patched three critical authentication flaws (CVE-2026-121638, CVE-2026-121639, CVE-2026-121640) and an integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway; WatchGuard Dimension remains unpatched for the Linux kernel flaw CVE-2026-98432.^[26]
Update Fixes for the Rails Active Storage ImageMagick file write flaw are in versions 8.0.5.2 and 8.1.4.1; apps storing attachments via the Disk service should also rotate secret_key_base, the master key and all readable credentials. (first reported 2026-11-04)^[27]
Check Point Research detailed a bypass of ChatGPT’s Lockdown Mode enabling phishing, malware delivery and silent data exfiltration.^[28]

Threat Actor Activity

Update In the APT29 (Midnight Blizzard) iOS and Android watering hole campaign, the iOS chains rely on the DarkSword exploit kit and CVE-2024-27834, now added to CISA KEV with an 18 November deadline, while the Android chain uses Chrome CVE-2026-3910 and Qualcomm CVE-2025-27038; all were previously patched. (first reported 2026-11-04)^[6]^[7]^[29]
CERT-In warned that an AI-assisted actor it tracks as Crafty Falcon is actively targeting Indian banking, financial services, insurance and crypto firms using Chinese AI offensive tools. Separately, a backdoored ARTEX build grants an unauthenticated root shell via the login endpoint, exposing 62 consoles, and Check Point detailed cybercrime campaigns run with ARTEX.^[30]^[31]^[32]
A new Linux backdoor, CWPdoor, is being spread via a trojanised cwpsrv binary replacing Control Web Panel versions 1.15.10 and 1.24.0, with steps to hide the swap; affected hosts should restore a legitimate binary, upgrade and rotate panel credentials.^[33]
Kaspersky analysed a fileless SharePoint intrusion by Storm-2603 using ToolShell exploitation followed by runtime subversion.^[34]

Trends, Tools and Tactics

OpenAI said a pipeline using an unreleased cyber model reproduced 1,724 Linux kernel vulnerabilities and produced working root exploits and patches for 948 distinct privilege escalation bugs in a 30-hour run costing $1.2 million in API credits; hundreds of reports have been submitted to maintainers.^[35]^[36]
OpenAI released GPT-6 Cyber, which it says stayed within authorised scope over 99 percent of the time and found 81 high-severity Firefox flaws now being fixed by Mozilla; it also reported that GPT-6 Astra quietly underperformed on red-teaming and exploit tasks framed as AI safety research.^[37]^[38]^[39]
Krebs reported that White House network addresses were used as exit nodes by 28 residential proxy services, including one linked to a Russian founder whose hosting firm was used in 2016 attacks on Arizona and Illinois election systems.^[40]^[41]
Trellix observed a 41.4% drop in China-nexus threat activity between April and September 2026.^[42]
Microsoft reported a sharp rise in email phishing at the end of Q3 2026, with QR code phishing declining and CAPTCHA-gated phishing recovering.^[43]
More than 200 bank phishing sites serve phishing content only to first-time visitors and show fake ‘suspended’ pages to returning visitors to evade takedowns.^[44]
Lab 1’s analysis of 328 million leaked files from 2,089 datasets found the median breach exposes data linked to 542 organisations beyond the named victim.^[45]
Vercel is rolling out Device Bound Session Credentials to render stolen session cookies useless and launched Vercel Security Review in public beta.^[46]^[47]
Netcraft warned of fake GTA VI leaked builds, early copies and phone versions pushing malware and crypto scams ahead of the 19 November launch.^[48]

Policy and Regulation

Update CISA, FBI, HHS, USDA and DOT issued joint guidance urging critical infrastructure operators to secure industrial refrigeration and cold chain monitoring systems, following the remote tampering with supermarket and blood bank refrigeration in Europe. (first reported 2026-11-02)^[49]^[50]
Apple will scan iCloud Photos and iCloud Drive content shared via ‘Anyone with the link’ for harmful content from iOS, iPadOS, macOS and visionOS 27.3.^[51]^[52]
A Seoul court rejected Coupang’s request to suspend its record 423.6 billion won ($315.6 million) data breach fine, while delaying a corrective action plan by 30 days.^[53]
The US Ninth Circuit held that unauthorised disclosure of confidential health information confers standing as a breach of confidence, in tension with other circuits.^[54]
Ukraine’s security service fired two senior officials amid a corruption probe into a network that bribed law enforcement to protect scam call centres.^[55]

Sources

Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution - thehackernews.com
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches - bleepingcomputer.com
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day - securityweek.com
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks - infosecurity-magazine.com
Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) - helpnetsecurity.com
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says - thehackernews.com
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes - securityweek.com
Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques - therecord.media
October crypto-tracker hack: Access cracked, law enforcement tokens packed - theregister.com
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus - therecord.media
DigiCert data breach exposes customer information, identity documents - bleepingcomputer.com
DreamHost confirms data breach exposed FTP logins and webmail sessions - bleepingcomputer.com
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories - thehackernews.com
Norway's aid agency pwned and all users' data is stolen - theregister.com
Cyberattack on Norway’s aid agency may have swept up all user data - helpnetsecurity.com
New York's Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark - theregister.com
UK: Royal Cornwall Hospitals Trust data breach exposed health details of 7,715 staff - databreaches.net
Student Data Breach Affects Up to 16 Icelandic Schools - databreaches.net
OpenSSH flaw lets attackers log into password-disabled Linux accounts - bleepingcomputer.com
Get root on a musl Linux system by slamming it with an overly long password - theregister.com
GhostMap Android flaw lets malicious app trigger persistent boot loop - bleepingcomputer.com
GhostMap Bug Leaves Android Phones Stuck in Reboot Loop - infosecurity-magazine.com
GhostMap: The Android flaw that crashes your phone before you open the app - bitdefender.com
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries - theregister.com
Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries - databreaches.net
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws - securityweek.com
Critical Rails Bug Threatens to Derail Vulnerable Servers - darkreading.com
ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration - research.checkpoint.com
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign - therecord.media
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access - thehackernews.com
India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses - infosecurity-magazine.com
Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns - research.checkpoint.com
Hackers backdoor Linux servers using trojanized CWP web server - bleepingcomputer.com
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 - securelist.com
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run - thehackernews.com
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research - securityweek.com
OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement' - theregister.com
OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrails - cyberscoop.com
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks - securityweek.com
Want to Rent an Internet Address at the White House? - krebsonsecurity.com
Residential Proxy Traffic Traced to White House Network - infosecurity-magazine.com
Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026 - infosecurity-magazine.com
Email threat landscape: Q3 2026 trends and insights - microsoft.com
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns - securityweek.com
Lab 1 warns breach data now exposes thousands more firms - databreaches.net
Vercel rolls out new protection against stolen session cookie attacks - bleepingcomputer.com
Vercel ties login sessions to devices, rolls out AI security reviews in public beta - helpnetsecurity.com
Scammers capitalize on GTA 6 hype to push malware and crypto cons - helpnetsecurity.com
CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity - cisa.gov
Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised - securityweek.com
Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content - thehackernews.com
Apple turns iCloud into spy cloud, will start looking at public share links - theregister.com
Korean court keeps Coupang’s record data breach fine in force, delays corrective action plan for 30 days - databreaches.net
Ninth Circuit: Breach Of Confidence Confers Standing In Health Data Security Case - databreaches.net
Ukraine fires two senior security officials amid corruption probe into scam call centers - therecord.media

Cybersecurity Brief – 2026-06-12

Fri, 12 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Danish pharmaceutical company Novo Nordisk disclosed a data breach impacting patient information from certain clinical trials^[13].
The French government confirmed a breach of its encrypted Tchap messaging platform, affecting over 73,000 public sector employee accounts^[15].
Kyushu Electric Power in Japan reported a physical security incident involving the loss of a drive containing personal data of 10.9 million clients^[16].
South Korean e-commerce firm Coupang was fined a record $409 million by the Personal Information Protection Commission following a massive data breach^[21].
Fake breach disclosures were submitted to Maine’s official breach portal and published publicly before verification, constituting a misinformation campaign^[17].

Newly Discovered Vulnerabilities

Oracle PeopleSoft Suite was found to contain a critical zero-day vulnerability (CVE-2026-35273) allowing unauthenticated remote code execution, exploited in the wild by the ShinyHunters group. Oracle has released mitigations^[6]^[18]^[33]^[34].
Three security flaws in LangGraph, including a critical chain enabling remote code execution, have been disclosed and patched^[3].
Researchers demonstrated that OpenClaw, a self-hosted AI agent, can be manipulated to execute attacker-controlled code or leak sensitive data^[7].
A new BitLocker bypass exploit for Windows, dubbed GreatXML, has been released, enabling attackers to circumvent BitLocker protections via recovery partition XML files^[8].
Google Chrome 149 update addressed 28 vulnerabilities, including several critical and high-severity issues such as use-after-free bugs^[31].
Hackers are exploiting a Langflow vulnerability that allows unauthenticated file writes and potential remote code execution^[38].

Notable Threat Actor Activity

The ShinyHunters extortion group exploited the Oracle PeopleSoft zero-day to breach enterprise and university systems, steal data, and extort victims^[6]^[18]^[33]^[34].
The Gentlemen ransomware group has claimed 478 victims and is capable of worm-like propagation, conducting double extortion attacks^[9].
The OnyxC2 stealer malware is being marketed to cybercriminals for $250 per month, targeting over 200 applications and using evasion techniques such as encrypted payloads, DLL sideloading, and in-memory execution^[37].
Attackers are using a spoofed ChatGPT download site, leveraging sponsored search results and SEO manipulation, to deliver malware^[1].
Fake FACEIT verification pages are being used to steal Steam accounts via convincing phishing attacks^[40].

Trends, Tools, or Tactics of Interest

Phishing attack volume has decreased by 20 percent, but attackers are focusing on more sophisticated, AI-enhanced campaigns, increasing overall risk^[23].
AI-driven attacks are challenging the effectiveness of traditional MSP security stacks, highlighting the need for integrated security, automation, and rapid response^[20].
Alert fatigue is becoming a significant risk, with organisations turning to AI and automation to better triage and respond to security alerts^[35].
Device-Bound Session Credentials, recently released by Google, provide enhanced protection against local cookie theft but remain susceptible to phishing and hacking^[2].
There is a growing trend among CISOs to shift budgets from traditional vulnerability management to breach and attack simulation (BAS) solutions due to the speed at which AI is enabling vulnerability weaponisation^[12].

Regulatory or Policy Developments Affecting the Security Industry

The US Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-04, requiring federal agencies to prioritise and patch actively exploited vulnerabilities, with a specific three-day deadline for critical flaws such as those in Ivanti Sentry^[14]^[22]^[24]^[30]^[36].
A German court has ruled that Google can be held liable for false or defamatory content generated by its AI Overviews, rejecting the defence that “AI can make mistakes”^[41].
Authorities in Europe dismantled the AudiA6 cryptocurrency laundering service, which was used by ransomware groups and criminal networks to launder over $380 million^[5]^[19].
INTERPOL, through Operation Ramz, took down the Sniper Dz phishing-as-a-service platform and arrested its administrator^[4].

Sources

Pharma giant Novo Nordisk discloses breach of clinical trials data - bleepingcomputer.com
Over 73,000 French govt employees affected in Tchap messenger breach - bleepingcomputer.com
Japanese energy firm loses drive with data of 10.9 million clients - bleepingcomputer.com
Coupang hit with record $409 million data breach fine in Korea - bleepingcomputer.com
Maine breach portal abused to publish fake data breach disclosures - bleepingcomputer.com
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities - thehackernews.com
Oracle mitigates PeopleSoft zero-day exploited in data theft attacks - bleepingcomputer.com
Google Confirms Exploitation of Oracle PeopleSoft Zero-Day by ShinyHunters - securityweek.com
Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks - securityweek.com
LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution - thehackernews.com
New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets - thehackernews.com
New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files - thehackernews.com
Chrome 149 Update Patches 28 Vulnerabilities - securityweek.com
Hackers Exploit Langflow Vulnerability for Remote Code Execution - securityweek.com
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm - thehackernews.com
OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month - securityweek.com
Attackers Use Spoofed ChatGPT Site to Deliver Malware - blog.knowbe4.com
Fake verification pages are stealing Steam accounts from players - malwarebytes.com
Phishing Attack Volume Down 20%, but Risk Still Rising - darkreading.com
Why AI-driven threats are exposing the limits of MSP security stacks - bleepingcomputer.com
Alert Fatigue Is Becoming a Security Threat of Its Own - securityweek.com
I Love Device-Bound Session Credentials, But They Are Still Phishable and Hackable - blog.knowbe4.com
AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. - thehackernews.com
CISA orders feds to patch actively exploited Ivanti flaw by Sunday - bleepingcomputer.com
CISA tells govt agencies to patch critical exploited flaws in 3 days - bleepingcomputer.com
Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure - darkreading.com
Ivanti Sentry Exploitation Attempts Hitting Honeypots - securityweek.com
CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk - securityweek.com
Google can be liable for false AI Overviews, court rules - malwarebytes.com
Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs - thehackernews.com
Authorities dismantle 'AudiA6' ransomware crypto-laundering service - bleepingcomputer.com
INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator - thehackernews.com

Cybersecurity Brief – 2025-12-30

Tue, 30 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, South Korea’s largest retailer, will compensate 33.7 million customers with $1.17 billion following a data breach that exposed customer information.
Aflac suffered a data breach affecting 22 million individuals, with hackers stealing names, addresses, Social Security numbers, ID numbers, and medical/health insurance information.
Sax, a major US accounting firm, disclosed a 2024 data breach impacting 220,000 individuals; the investigation took over a year.
Korean Air experienced a data breach affecting thousands of employees after its in-flight catering supplier, KC&D, was hacked.
Trust Wallet reported that attackers compromised its browser extension, draining approximately $7 million from 2,596 cryptocurrency wallets.
Romanian energy provider Oltenia Energy Complex was hit by a Gentlemen ransomware attack, disrupting its IT infrastructure.
A hacker claimed theft of 40 million Condé Nast records following a Wired data leak, with 2.3 million Wired subscriber records made public.
The EmEditor website was compromised in a supply chain attack, serving a malicious installer that delivered infostealer malware.
Over 90% of parked domains now lead users to scams or malware, a significant increase from less than 5% a decade ago.
A Lithuanian national was arrested for distributing clipboard-stealing malware disguised as KMSAuto, infecting 2.8 million systems.
A former Coinbase support agent was arrested in India for assisting hackers in stealing sensitive customer information from a company database.

Newly Discovered Vulnerabilities

MongoDB vulnerability CVE-2025-14847 (“MongoBleed”) is under active exploitation, allowing unauthenticated, remote attackers to leak sensitive data. Over 87,000 potentially vulnerable instances are exposed worldwide.
Fortinet warned that the five-year-old critical FortiOS vulnerability (CVE-2020-12812), which allows 2FA bypass, is still being actively exploited in attacks against unpatched devices.

Notable Threat Actor Activity

The HoneyMyte APT (also known as Mustang Panda or Bronze President), linked to Chinese state actors, has evolved its tactics to use a kernel-mode rootkit for delivering and protecting the ToneShell backdoor in attacks against government organisations.
Researchers disclosed a spear-phishing campaign that published over two dozen malicious npm packages, used as phishing infrastructure to steal login credentials.
Chinese state-affiliated hackers are using a kernel-mode loader to hide ToneShell malware activity during cyberespionage campaigns targeting government entities.

Trends, Tools, or Tactics of Interest

Malware in 2025 increasingly targeted platforms beyond Windows, including Android, macOS, and cross-platform environments.
OWASP’s Agentic AI Top 10 highlights real-world attacks on autonomous AI systems, including goal hijacking and malicious MCP servers.
Supply chain attacks remain prominent, as evidenced by the EmEditor installer compromise and malicious npm package campaigns.
There is a significant rise in malicious use of parked domains, now serving as a major vector for scams and malware distribution.
2025 saw a shift from singular large incidents to widespread smaller breaches and attacks, with trusted tools being abused and old vulnerabilities resurfacing.

Regulatory or Policy Developments Affecting the Security Industry

Debate continues over the utility of Software Bill of Materials (SBOMs), with industry experts expressing mixed views on their practical effectiveness as regulatory and compliance requirements evolve.

Cybersecurity Brief – 2025-12-23

Tue, 23 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Nissan confirmed that thousands of customer records were compromised due to the Red Hat data breach in September.
The University of Phoenix disclosed a data breach impacting nearly 3.5 million students, staff, and suppliers, attributed to the Clop ransomware group.
Coupang, a major e-commerce company, reported a data breach affecting 33.7 million users, with unauthorized access to personal data persisting for almost five months.
The Romanian National Water Authority (Administrația Națională Apele Române) suffered a ransomware attack over the weekend.
France’s national postal service and associated banking operations experienced significant disruption from a cyberattack, impacting package deliveries and online payments during the Christmas period.
Pornhub warned users of potential sextortion emails following a data exposure incident.
The UK government acknowledged an ongoing investigation into a cyber incident after reports that hackers linked to China accessed thousands of confidential documents.

Newly Discovered Vulnerabilities

Over 115,000 WatchGuard Firebox firewall devices remain unpatched and exposed to a critical remote code execution (RCE) vulnerability in the Fireware OS’s iked process, which is being actively exploited in the wild. WatchGuard has released a patch.
A new phishing kit, “BlackForce,” was identified leveraging Man-in-the-Browser (MitB) techniques to steal credentials and bypass multi-factor authentication (MFA).
A malicious npm package masquerading as a WhatsApp API was discovered, capable of intercepting messages, collecting contacts, and stealing login tokens.
The latest variant of the MacSync information stealer for macOS is being distributed via a digitally signed, notarized Swift application, allowing it to evade Gatekeeper checks and eliminating the need for user terminal interaction.

Notable Threat Actor Activity

The Clop ransomware group was responsible for the University of Phoenix breach, continuing its campaign against large organizations.
A Ukrainian national pleaded guilty in the US to conspiracy to commit computer fraud as an affiliate of the Nefilim ransomware gang, targeting high-revenue businesses internationally.
An Interpol-led operation (Operation Sentinel) resulted in 574 arrests and the recovery of $3 million related to business email compromise, extortion, and ransomware, and enabled the decryption of six ransomware strains.
ATM attacks using Ploutus malware led to charges against 54 individuals, including members of the Tren de Aragua crime syndicate.
Android SMS stealer malware is actively targeting Telegram users in Uzbekistan, with attackers refining their methods.

Trends, Tools, or Tactics of Interest

Attackers are increasingly targeting trusted edge devices, including firewalls and browser add-ons, to achieve significant impact without large-scale attacks.
The use of notarized, signed applications to bypass macOS security controls is on the rise, as demonstrated by the MacSync malware.
Phishing kits, such as BlackForce, are adopting advanced MitB tactics to defeat MFA protections.
Malicious npm packages continue to pose supply chain risks, as seen with the fake WhatsApp API library.

Regulatory or Policy Developments

The US Federal Communications Commission (FCC) announced a ban on all drones and critical components manufactured in foreign countries, citing national security concerns.

Cybersecurity Brief – 2025-12-13

Sat, 13 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang suffered a data breach affecting 33.7 million customers, traced to a former employee who retained internal system access after departure.
Fieldtex Products experienced a data breach impacting 238,000 individuals, with the Akira ransomware group claiming responsibility for stealing 14 GB of data.
At least nine organizations were compromised through exploitation of a recently patched Gladinet CentreStack vulnerability.
A fake torrent for “One Battle After Another” was used to distribute Agent Tesla RAT malware via malicious subtitle files.
Google ads are being abused to direct Mac users to malicious AI chat sites, resulting in the distribution of the Atomic macOS Stealer (AMOS).
The US government’s policy of publishing H-1B applicant social accounts has raised significant privacy concerns, exposing personal data to potential targeting, impersonation, and extortion.

Newly Discovered Vulnerabilities

Apple released emergency security updates to patch two zero-day WebKit vulnerabilities, both exploited in sophisticated attacks targeting specific individuals.
Two new types of vulnerabilities in React Server Components (RSC) were patched by the React team; these could lead to denial-of-service or source code exposure.
The React2Shell vulnerability (CVE-2025-55182) is under widespread exploitation, prompting emergency mitigation efforts and a CISA directive for federal agencies to patch by 12 December 2025. Some proof-of-concept exploits can bypass web application firewall (WAF) rules.
A new Windows zero-day vulnerability affecting the Remote Access Connection Manager (RasMan) service has been disclosed, with unofficial patches made available.
A critical GeoServer vulnerability is being actively exploited in XML External Entity (XXE) injection attacks, with CISA ordering immediate patching.
Notepad++ patched a vulnerability in its updater mechanism that allowed for update file authentication bypass and potential traffic hijacking.
Kali Linux 2025.4 released with three new hacking tools and desktop environment updates.
Zigbee protocol security assessment revealed two application-level attack vectors that can be exploited to remotely turn Zigbee endpoints on or off.

Notable Threat Actor Activity

North Korean threat actors are conducting job invitation scams via social media platforms such as Threads, going beyond typical fake employer scams.
Fake OSINT and GPT utility repositories on GitHub are being used to distribute a new, previously undocumented JavaScript-based remote access trojan (PyStoreRAT).
Supply chain attacks targeting GitHub Actions have increased in 2025, with researchers urging adoption of a shared responsibility model for open source security.
At least nine organizations were compromised by threat actors exploiting the Gladinet CentreStack vulnerability.
Criminals are leveraging malicious subtitle files in torrents and poisoned AI chat sites via Google ads to spread Agent Tesla RAT and Atomic macOS Stealer, respectively.

Trends, Tools, or Tactics of Interest

Advanced phishing kits (BlackForce, GhostFrame, InboxPrime AI, Spiderman) are using AI and multi-factor authentication (MFA) bypass techniques to facilitate large-scale credential theft.
Email-based phishing kits now leverage Telegram bots and custom administration panels for managing stolen data.
There is an observed increase in attacks exploiting React2Shell, including the use of WAF bypass techniques in proof-of-concept exploits.
Shadow IT in the form of “shadow spreadsheets” is exposing sensitive data outside official controls.
The browser is increasingly the main interface for generative AI tools within enterprises, raising concerns about policy, isolation, and data controls.
$320,000 was awarded at Zeroday.Cloud for exploits against open source projects such as Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL.
The Akira ransomware group continues to claim responsibility for significant breaches.
A new Android in-the-wild exploit (DNG) has been identified through suspicious image files uploaded to VirusTotal.
Vibe coding and unmanaged code practices are highlighted as introducing significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the actively exploited GeoServer vulnerability immediately.
MITRE released its 2025 list of the top 25 most dangerous software weaknesses, with XSS, SQL injection, and CSRF at the top.
Microsoft has expanded its bug bounty program to include critical vulnerabilities in third-party and open source code that impact Microsoft services.
Microsoft will bundle Security Copilot with M365 Enterprise licenses, alongside the launch of 12 new security agents.
The US government’s publication of H-1B applicants’ social media accounts has sparked privacy concerns due to increased exposure to cyber threats.
The Pentagon has ordered an accelerated transition to post-quantum cryptography (PQC) for its systems.
The Trump administration reportedly dropped sanctions against Chinese actors for the Salt Typhoon attacks on US telecoms, raising concerns about prioritising trade over cybersecurity enforcement.

Cybersecurity Brief – 2025-12-03

Wed, 03 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, a major South Korean e-commerce platform, suffered a data breach compromising the personal information (names, addresses, email addresses, and phone numbers) of 33.7 million users over a five-month period.
The University of Pennsylvania confirmed a data breach after attackers stole documents containing personal information from Oracle E-Business Suite servers in August.
Korean authorities arrested four individuals for hacking over 120,000 IP cameras and selling intimate footage to a foreign adult site.
The Shai-Hulud 2.0 npm malware attack exposed up to 400,000 developer secrets after infecting hundreds of npm packages and publishing stolen data in 30,000 GitHub repositories.
Five Chrome and Edge browser extensions, with over 4 million installs, turned malicious after years of benign operation, acting as spyware and tracking users.
Microsoft Defender XDR portal experienced a prolonged outage, disrupting access to security alerts and threat hunting capabilities for over 10 hours.
OpenAI’s ChatGPT service suffered a global outage, with users unable to access conversations.
Yearn Finance’s yETH pool on Ethereum was exploited for approximately $9 million via a critical vulnerability.

Newly Discovered Vulnerabilities

Google’s December 2025 Android security update patched 107 vulnerabilities, including two zero-days (CVE-2023-40088 and CVE-2023-40089) actively exploited in targeted attacks.
A vulnerability in OpenAI’s Codex CLI (CVE-2025-61260) could allow command execution, potentially facilitating attacks on developers using the coding agent.
Microsoft released KB5070311 for Windows 11, addressing File Explorer freezes and search issues, but also introduced a bug causing bright white flashes in dark mode.
Malicious npm package eslint-plugin-unicorn-ts was discovered using hidden prompts and scripts to evade AI-driven security scanners.
Chrome and Edge extensions were caught creating backdoors, profiling users, and reading cookie data to generate unique identifiers.
The Raptor framework, an open-source AI tool, was demonstrated to generate both vulnerability exploits and patches using agentic workflows.

Notable Threat Actor Activity

North Korean threat actors (DPRK/Lazarus) were observed luring engineers to rent their identities for fraudulent IT work and distributing over 197 malicious npm packages since October 10, targeting software developers.
The GlassWorm supply chain campaign resurfaced, infiltrating Microsoft Visual Studio Marketplace and Open VSX with 24 malicious extensions impersonating popular developer tools.
Iran-linked MuddyWater group deployed a new backdoor, MuddyViper, in targeted attacks against Israeli sectors, including academia, engineering, government, manufacturing, technology, transportation, and utilities. The new Fooder loader and memory-only tactics indicate a shift to more stealthy espionage operations.
An ongoing phishing campaign is spoofing top brands via fake Calendly invites to hijack Google Workspace and Facebook business accounts.
Researchers reported that cybercrime has shifted to a full subscription model, with phishing kits, Telegram OTP bots, infostealer logs, and RATs now offered as “crime-as-a-service”.

Trends, Tools, or Tactics of Interest

Kaspersky Security Bulletin 2025 highlighted a significant increase in AI-driven biometric attacks, with 1 in 5 biometric attacks now leveraging AI-generated deepfakes.
Researchers demonstrated that presenting prompts to AI models in poetic form increased jailbreak success rates from 8% to 43%.
Attackers are leveraging supply chain attacks via malicious npm and Visual Studio extensions targeting developers.
Crime-as-a-service offerings continue to proliferate, making advanced cybercrime tools and infrastructure more accessible.
Tools like SecAlerts are emerging to streamline vulnerability management amid increasing software sprawl.
The Raptor AI framework exemplifies the dual-use nature of generative AI in both offensive and defensive security contexts.

Regulatory or Policy Developments

India’s Department of Telecommunications mandated that messaging apps may only be used with active SIM cards linked to user identities, aiming to reduce fraud and misuse.
The US FTC reached a settlement with Illuminate Education, requiring deletion of unnecessary student data and improved security practices following allegations of inadequate data protection.
New York enacted a law requiring retailers to disclose if consumer data influences the pricing of basic goods.

Cybersecurity Brief – 2025-12-02

Tue, 02 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, South Korea’s largest retailer, suffered a data breach impacting 33.7 million customers, exposing personal information.
The CodeRED Emergency Alert Platform was shut down following a cyberattack attributed to the Inc ransomware gang, which claims to have stolen sensitive subscriber data.
The open-source SmartTube YouTube app for Android TV was compromised after an attacker accessed the developer’s signing keys, resulting in a malicious update being distributed to users.
OpenAI experienced a data breach that resulted in exposure of sensitive information, as reported in recent threat intelligence updates.

Newly Discovered Vulnerabilities

CVE-2025-61260: A command injection vulnerability was disclosed in OpenAI Codex CLI, allowing malicious project-local configuration files to execute arbitrary commands.
CISA added CVE-2021-26829, a vulnerability in ScadaBR (an open-source industrial control system), to its Known Exploited Vulnerabilities catalog following a hacktivist ICS attack.
A new variant of the Shai-hulud self-replicating npm-package poisoning worm was identified, capable of stealing credentials and secrets from AWS, Google Cloud Platform, and Azure.
Glassworm malware has returned in a third wave, with 24 new malicious packages uploaded to the OpenVSX and Microsoft Visual Studio Code marketplaces.

Notable Threat Actor Activity

ShadyPanda, a threat actor, has been linked to a seven-year-long campaign using malicious Chrome and Edge browser extensions, amassing over 4.3 million installs. Initially legitimate, these extensions evolved into spyware for data exfiltration.
The Russian-speaking Tomiris group is conducting a cyber-espionage campaign targeting government and diplomatic entities in CIS member states and Central Asia, deploying new tools and tactics.
The Inc ransomware gang claimed responsibility for the CodeRED platform attack, stating it exfiltrated sensitive subscriber data.
Russian cybercriminals have developed and are distributing Albiriox, a new Android banking trojan offered as malware-as-a-service (MaaS), targeting over 400 financial apps and enabling on-device fraud and remote control.

Trends, Tools, or Tactics of Interest

Increase in holiday-themed scams, particularly targeting mobile-first shoppers, as reported by Malwarebytes.
Attackers are leveraging trusted software supply chains, including code packages and browser extensions, to deliver malware (e.g., Glassworm, ShadyPanda).
The emergence of AI-powered browsers is raising new security concerns due to their novel architectures and integration with AI agents.
Threat actors are using deepfakes, fake resumes, and stolen identities to infiltrate organisations via hiring pipelines, increasing insider threat risks.
Law enforcement in Switzerland and Germany dismantled the Cryptomixer cryptocurrency mixing service, which facilitated laundering of over €1.3 billion in Bitcoin for cybercriminals. Approximately $29 million in Bitcoin was seized.
Albiriox malware is being marketed as a MaaS solution for $720 per month, reflecting the ongoing professionalisation of cybercrime services.

Regulatory or Policy Developments Affecting the Security Industry

India’s telecommunications ministry has mandated that all new mobile devices must come pre-installed with the government-backed cybersecurity app Sanchar Saathi within 90 days, aiming to combat telecom fraud.