Cybersecurity Brief – 2025-12-16

Tue, 16 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

SoundCloud confirmed a security breach resulting in the theft of a user database containing member data and subsequent disruption of VPN access for users.
Askul Corporation, a Japanese e-commerce company, disclosed that RansomHouse hackers stole approximately 740,000 customer records in an October ransomware attack.
PornHub is being extorted by the ShinyHunters gang following the theft of Premium member search and watch history data, reportedly accessed via a Mixpanel data breach.
700Credit, a U.S.-based financial services provider, reported a data breach impacting 5.8 million individuals, with stolen data including names, addresses, dates of birth, and Social Security numbers.

FreePBX patched multiple critical vulnerabilities, including an authentication bypass, SQL injection, and file upload flaws, all of which could enable remote code execution.
Atlassian released updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira to address a critical Apache Tika vulnerability.
Apple patched two actively exploited WebKit zero-days in macOS and iOS, which are linked to a previously patched Chrome flaw. The vulnerabilities were used in sophisticated attacks.
React2Shell (CVE-2025-55182) remote code execution vulnerability continues to be actively exploited, with new exploits surfacing.
Microsoft confirmed that December 2025 security updates are causing failures in Message Queuing (MSMQ) and breaking VPN networking for Windows Subsystem for Linux (WSL) users.

Five additional Chinese threat groups have been linked by Google to ongoing exploitation of the React2Shell vulnerability for malware delivery. Iranian threat actors have also been observed leveraging the same flaw.
The ShadyPanda threat group was identified as responsible for a large-scale campaign hijacking popular Chrome and Edge browser extensions.
Phantom Stealer is being distributed via phishing emails with malicious ISO attachments, targeting various sectors in Russia.
The pro-Russia CyberVolk ransomware group’s VolkLocker variant was found to contain a flaw that allows victims to decrypt their files without paying ransom.
SantaStealer, a new information stealer malware offered as malware-as-a-service, is being promoted on Telegram and hacker forums, featuring in-memory operation to evade file-based detection.

Phishing attacks are increasingly abusing free Cloudflare Pages to host phishing portals, aiding in evasion of security scanners.
Phishing trends in 2025 show a shift beyond email, with increased use of social platforms, search ads, and browser-based techniques to bypass multi-factor authentication and steal session tokens.
Deepfake attacks are becoming more realistic and compelling, raising concerns about their use in social engineering and disinformation.
Militant and extremist groups are experimenting with AI technologies, including propaganda and deepfakes, to expand their influence.
A Chrome browser extension with a “Featured” badge and six million users was discovered intercepting and collecting user prompts from AI chatbots.
PayPal closed a loophole that allowed scammers to send legitimate-looking emails from service@paypal.com, which were used to push tech support scams.
Pig butchering scams are being highlighted as a growing global crisis, involving large-scale, long-term social engineering fraud.

Google announced the discontinuation of its dark web monitoring/report tool in early 2026, impacting users’ ability to monitor exposure of personal information on the dark web.
The French Ministry of the Interior confirmed a cyberattack that compromised its email servers.
Cyber insurance managing general agents (MGAs) are increasingly shaping policies to better reflect real-world cyber risk, with a focus on sector-specific expertise.
A third individual pleaded guilty in the U.S. for involvement in a credential stuffing attack against DraftKings, underlining ongoing law enforcement activity against cybercrime.

Fri, 28 Nov 2025 00:00:00 +0000

OpenAI disclosed a data breach affecting ChatGPT API customers, resulting from a compromise at third-party analytics provider Mixpanel. Limited identifying information of API customers was exposed. Multiple Mixpanel customers were impacted by the incident.
Asahi, a Japanese company, suffered a ransomware attack that resulted in the theft of personal information of customers and employees, impacting approximately 2 million individuals and significantly disrupting operations.
The CodeRED emergency alert system in the US experienced a ransomware attack, leading to a nationwide outage and a data breach, putting millions at risk.
Amazon and the FBI have issued warnings regarding a surge in account takeover attacks targeting holiday shoppers, with scammers impersonating brands to gain access to user accounts.

The APT group Tomiris has adopted new tools and techniques, including multi-language reverse shells and the use of open-source frameworks Havoc and AdaptixC2. The group has also been observed using Discord and Telegram for command and control communications.
Bloody Wolf, a threat actor, has expanded its campaign targeting Kyrgyzstan and Uzbekistan, delivering NetSupport RAT via Java-based attacks since at least June 2025.

Increased use of open-source command and control frameworks (Havoc, AdaptixC2) and mainstream messaging platforms (Discord, Telegram) for malicious communications by APT groups.
Growing prevalence of AI-powered malware, voice phishing (vishing) campaigns, and scams leveraging advanced technologies, as highlighted in recent threat bulletins.
Rise in attacks exploiting digital trust, including brand impersonation and account takeover targeting consumers during high-activity periods such as holidays.

Microsoft has announced a 2026 update to Entra ID’s Content Security Policy that will block unauthorized script injection attacks during authentication, aiming to strengthen login security.