A week in security (November 24 – November 30)

The Malwarebytes Labs report for the week of November 24 to November 30, 2025, highlights several significant cybersecurity threats and incidents. Key points include: 1. An overview of CVSS v4.0, which characterizes and scores vulnerabilities. 2. A nationwide outage and data breach of the CodeRED alert system, putting millions at risk. 3. Increased account takeover attacks targeting holiday shoppers, as warned by Amazon and the FBI. 4.

Scammers using fake LinkedIn job postings to distribute Flexible Ferret malware to Mac users. 5. A new ClickFix wave infecting users through hidden malware in images and fake Windows updates. 6. WhatsApp's closure of a loophole that allowed data collection on 3.5 billion accounts. 7. The financial risks associated with illegal streaming and modded Amazon Fire TV Sticks. 8. Black Friday scams offering fake gifts from well-known brands. 9.

The Matrix Push C2 campaign exploiting browser notifications for phishing and malware delivery. The report emphasizes the importance of cybersecurity awareness and protection.