SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 75

Security Affairs’ Malware Newsletter Round 75, dated 14 December 2025 and authored by Pierluigi Paganini, presents a curated digest of recent malware research and threat activity. The roundup features links to analyses and reports on a range of topics, from UDPGangster campaigns targeting multiple countries to ransomware trends in Bank Secrecy Act data between 2022 and 2024.

It also highlights software and threat developments such as the return of ClayRat with expanded features, SEEDSNATCHER targeting Android crypto wallets, and the newly identified FvncBot Android banking trojan targeting Poland. Other items include Broadside, a Mirai botnet variant; JSSMUGGLER’s multi-stage Iframe and JavaScript delivery technique; and a look at EtherRAT, which the report notes as DPRK use of a novel Ethereum implant in React2Shell attacks.

The newsletter closes with additional entries on Gogs zero-day exploitation, GeminiJack zero-click data exfiltration, a Chrome zero-day actively exploited, and a suite of related malware and security research links.