SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 72

Security Affairs Malware Newsletter Round 72, authored by Pierluigi Paganini, was published on 23 November 2025 and presents a curated collection of malware-related articles from the international landscape. The round includes items such as Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery, RONINGLOADER: DragonBreath’s New Path to PPL Abuse, and npm Malware Campaign Uses Adspect Cloaking to Deliver Malicious Redirects.

It also features GPT Trade: Fake Google Play Store drops BTMob Spyware and UASecurity Miner on Android Devices, Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads, and Sturnus: Mobile Banking Malware bypassing WhatsApp, Telegram and Signal Encryption. Additional highlighted links cover broader topics like LLM-generated malware improvements and campaigns involving Salesforce, as well as a note on Tsundere: an emerging botnet abusing Blockchain and Node.js.

The newsletter serves as a digest of recent malware research and campaigns, with follow-up reads from security researchers and industry publications.