Pornhub on DanSec Daily

Cybersecurity Brief – 2025-12-23

Tue, 23 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Nissan confirmed that thousands of customer records were compromised due to the Red Hat data breach in September.
The University of Phoenix disclosed a data breach impacting nearly 3.5 million students, staff, and suppliers, attributed to the Clop ransomware group.
Coupang, a major e-commerce company, reported a data breach affecting 33.7 million users, with unauthorized access to personal data persisting for almost five months.
The Romanian National Water Authority (Administrația Națională Apele Române) suffered a ransomware attack over the weekend.
France’s national postal service and associated banking operations experienced significant disruption from a cyberattack, impacting package deliveries and online payments during the Christmas period.
Pornhub warned users of potential sextortion emails following a data exposure incident.
The UK government acknowledged an ongoing investigation into a cyber incident after reports that hackers linked to China accessed thousands of confidential documents.

Newly Discovered Vulnerabilities

Over 115,000 WatchGuard Firebox firewall devices remain unpatched and exposed to a critical remote code execution (RCE) vulnerability in the Fireware OS’s iked process, which is being actively exploited in the wild. WatchGuard has released a patch.
A new phishing kit, “BlackForce,” was identified leveraging Man-in-the-Browser (MitB) techniques to steal credentials and bypass multi-factor authentication (MFA).
A malicious npm package masquerading as a WhatsApp API was discovered, capable of intercepting messages, collecting contacts, and stealing login tokens.
The latest variant of the MacSync information stealer for macOS is being distributed via a digitally signed, notarized Swift application, allowing it to evade Gatekeeper checks and eliminating the need for user terminal interaction.

Notable Threat Actor Activity

The Clop ransomware group was responsible for the University of Phoenix breach, continuing its campaign against large organizations.
A Ukrainian national pleaded guilty in the US to conspiracy to commit computer fraud as an affiliate of the Nefilim ransomware gang, targeting high-revenue businesses internationally.
An Interpol-led operation (Operation Sentinel) resulted in 574 arrests and the recovery of $3 million related to business email compromise, extortion, and ransomware, and enabled the decryption of six ransomware strains.
ATM attacks using Ploutus malware led to charges against 54 individuals, including members of the Tren de Aragua crime syndicate.
Android SMS stealer malware is actively targeting Telegram users in Uzbekistan, with attackers refining their methods.

Trends, Tools, or Tactics of Interest

Attackers are increasingly targeting trusted edge devices, including firewalls and browser add-ons, to achieve significant impact without large-scale attacks.
The use of notarized, signed applications to bypass macOS security controls is on the rise, as demonstrated by the MacSync malware.
Phishing kits, such as BlackForce, are adopting advanced MitB tactics to defeat MFA protections.
Malicious npm packages continue to pose supply chain risks, as seen with the fake WhatsApp API library.

Regulatory or Policy Developments

The US Federal Communications Commission (FCC) announced a ban on all drones and critical components manufactured in foreign countries, citing national security concerns.

Cybersecurity Brief – 2025-12-22

Mon, 22 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers stole millions of PornHub users’ data for extortion purposes.
The U.S. Department of Justice indicted 54 individuals for a multi-million dollar ATM jackpotting scheme involving the use of Ploutus malware.

Newly Discovered Vulnerabilities

Cisco disclosed a zero-day vulnerability for which no patch is currently available.

Notable Threat Actor Activity

The Iranian Infy (aka Prince of Persia) APT group has resurfaced after nearly five years of inactivity, exhibiting new malware activity.

Trends, Tools, or Tactics of Interest

Android malware operations are increasingly merging the use of malicious dropper apps with SMS theft and remote access trojan (RAT) capabilities at scale, as seen in campaigns distributing the Wonderland SMS stealer.
RansomHouse ransomware-as-a-service has upgraded its encryptor, moving from a single-phase linear technique to a multi-layered data processing method, enhancing the complexity of its encryption process.

Cybersecurity Brief – 2025-12-21

Sun, 21 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

PornHub has suffered a data breach in which hackers stole data belonging to millions of users. The attackers are reportedly using the stolen information for extortion purposes.

Notable Threat Actor Activity

The Iranian APT group Infy (also known as Prince of Persia) has resurfaced after nearly five years of inactivity. New malware activity attributed to Infy has been observed targeting victims in Sweden.
RansomHouse ransomware-as-a-service operators have upgraded their encryption techniques, moving from a single-phase linear approach to a more complex, multi-layered data processing method.
The U.S. Department of Justice has indicted 54 individuals involved in a large-scale ATM jackpotting scheme. The conspiracy utilised Ploutus malware to compromise ATMs and steal millions of dollars.

Newly Discovered Vulnerabilities

Cisco has disclosed a zero-day vulnerability for which there is currently no available patch.

Trends, Tools, or Tactics of Interest

RansomHouse’s enhancement of its encryptor to a multi-layered data processing model indicates a trend toward increased sophistication in ransomware encryption techniques.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of Justice’s action against the ATM jackpotting scheme demonstrates ongoing law enforcement efforts targeting cybercrime operations involving malware and large-scale financial theft.

Cybersecurity Brief – 2025-12-16

Tue, 16 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

SoundCloud confirmed a security breach resulting in the theft of a user database containing member data and subsequent disruption of VPN access for users.
Askul Corporation, a Japanese e-commerce company, disclosed that RansomHouse hackers stole approximately 740,000 customer records in an October ransomware attack.
PornHub is being extorted by the ShinyHunters gang following the theft of Premium member search and watch history data, reportedly accessed via a Mixpanel data breach.
700Credit, a U.S.-based financial services provider, reported a data breach impacting 5.8 million individuals, with stolen data including names, addresses, dates of birth, and Social Security numbers.

Newly Discovered Vulnerabilities

FreePBX patched multiple critical vulnerabilities, including an authentication bypass, SQL injection, and file upload flaws, all of which could enable remote code execution.
Atlassian released updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira to address a critical Apache Tika vulnerability.
Apple patched two actively exploited WebKit zero-days in macOS and iOS, which are linked to a previously patched Chrome flaw. The vulnerabilities were used in sophisticated attacks.
React2Shell (CVE-2025-55182) remote code execution vulnerability continues to be actively exploited, with new exploits surfacing.
Microsoft confirmed that December 2025 security updates are causing failures in Message Queuing (MSMQ) and breaking VPN networking for Windows Subsystem for Linux (WSL) users.

Notable Threat Actor Activity

Five additional Chinese threat groups have been linked by Google to ongoing exploitation of the React2Shell vulnerability for malware delivery. Iranian threat actors have also been observed leveraging the same flaw.
The ShadyPanda threat group was identified as responsible for a large-scale campaign hijacking popular Chrome and Edge browser extensions.
Phantom Stealer is being distributed via phishing emails with malicious ISO attachments, targeting various sectors in Russia.
The pro-Russia CyberVolk ransomware group’s VolkLocker variant was found to contain a flaw that allows victims to decrypt their files without paying ransom.
SantaStealer, a new information stealer malware offered as malware-as-a-service, is being promoted on Telegram and hacker forums, featuring in-memory operation to evade file-based detection.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly abusing free Cloudflare Pages to host phishing portals, aiding in evasion of security scanners.
Phishing trends in 2025 show a shift beyond email, with increased use of social platforms, search ads, and browser-based techniques to bypass multi-factor authentication and steal session tokens.
Deepfake attacks are becoming more realistic and compelling, raising concerns about their use in social engineering and disinformation.
Militant and extremist groups are experimenting with AI technologies, including propaganda and deepfakes, to expand their influence.
A Chrome browser extension with a “Featured” badge and six million users was discovered intercepting and collecting user prompts from AI chatbots.
PayPal closed a loophole that allowed scammers to send legitimate-looking emails from service@paypal.com, which were used to push tech support scams.
Pig butchering scams are being highlighted as a growing global crisis, involving large-scale, long-term social engineering fraud.

Regulatory or Policy Developments Affecting the Security Industry

Google announced the discontinuation of its dark web monitoring/report tool in early 2026, impacting users’ ability to monitor exposure of personal information on the dark web.
The French Ministry of the Interior confirmed a cyberattack that compromised its email servers.
Cyber insurance managing general agents (MGAs) are increasingly shaping policies to better reflect real-world cyber risk, with a focus on sector-specific expertise.
A third individual pleaded guilty in the U.S. for involvement in a credential stuffing attack against DraftKings, underlining ongoing law enforcement activity against cybercrime.