News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Mon 8 Sep 2025· 72 articles
-
18 Popular Code Packages Hacked, Rigged to Steal Crypto
Krebs on Security reports that at least 18 popular JavaScript code packages, downloaded more than two billion times weekly, were briefly compromised after a developer was phished, allowing attackers to add malicious code to NPM packages. The phishing…
Krebs on Security -
'MostereRAT' Malware Blends In, Blocks Security Tools
A new operation tracked by Fortinet’s FortiGuard Labs uses a banking malware turned remote access Trojan called MostereRAT to maintain long-term, persistent access on Windows systems. According to Fortinet, the campaign blends exotic techniques such as using…
Dark Reading -
Former WhatsApp security boss sues Meta for “systemic cybersecurity failures”
Former WhatsApp security chief Attaullah Baig has filed a federal whistleblower lawsuit in the US District Court for the District of Northern California, alleging that Meta prioritised user growth over security and that the company kept a range of security…
Ars Technica -
Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows
According to Cado Security Labs (now part of Darktrace), Meeten is a cross‑platform campaign (macOS and Windows) that deploys an infostealer called Realst and has targeted Web3 workers through AI‑generated fake Web3 companies and social media. The threat…
darktrace.com -
Salesloft Breached via GitHub Account Compromise
The breach began when a threat actor compromised Salesloft’s GitHub account earlier this year, triggering a massive supply chain attack that led to the compromise of hundreds of Salesforce instances via stolen OAuth tokens. The actor, tracked as UNC6395,…
Dark Reading -
Unpacking the Salesloft incident: Insights from Darktrace
Darktrace’s analysis of the Salesloft incident attributes a wide-scale data theft campaign to compromised OAuth tokens used by the Drift integration with Salesforce, which Google Threat Intelligence Group linked to UNC6395 and first publicised in late August…
darktrace.com -
9/8/25, 7:33 PM
Darktrace’s write‑up on Spinning YARN details a Linux malware campaign that targets misconfigured servers running Docker, Apache Hadoop YARN, Redis and Confluence, exploiting these web-facing services to deploy a cryptocurrency miner and maintain…
darktrace.com -
Hackers breached Salesloft ’s GitHub in March, and used stole tokens in a mass attack
Hackers breached Salesloft’s GitHub in March, with the threat actor UNC6395 stealing authentication tokens that were later used in a mass attack against several major tech customers, according to Mandiant. The investigation found reconnaissance activities in…
Security AffairsUNC6395 -
Vietnam’s national credit registration and reporting agency hacked; most of the population affected
Vietnam’s national credit registration and reporting agency is reported to have been hacked, with ShinyHunters claiming to have exfiltrated more than 160 million records from the Credit Institute of Vietnam, which runs the National Credit Information Center…
DataBreaches -
9/8/25, 6:24 PM
On 2 January 2024, Darktrace’s researchers reported a novel cryptojacking campaign dubbed “Commando Cat” that targets exposed Docker API endpoints, marking it as the second Docker-focused campaign of 2024 after the 9hits incident. The malware uses Docker as…
darktrace.com -
20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...)
The StepSecurity report reveals a massive NPM supply chain attack affecting over 20 widely-used packages, including chalk, debug, ansi-styles, color-convert, strip-ansi and more, with malicious versions published to steal cryptocurrency and redirect…
StepSecurity -
9/8/25, 4:31 PM
Darktrace’s Inside the SOC blog published on 18 January 2024 describes a campaign targeting vulnerable Docker services, observed by Cado Security Labs researchers (now part of Darktrace). According to Cado Security Labs, attackers deploy two containers to…
darktrace.com -
This “insidious” police tech claims to predict crime (Lock and Code S06E18)
Posted: September 8, 2025 by Malwarebytes Labs, the latest Lock and Code episode revisits a Florida project that aimed to predict crime. In Pasco County, the Sheriff's Department piloted an Intelligence-Led Policing programme that allegedly analysed…
Malwarebytes -
GitHub Account Compromise Led to Salesloft Drift Breach Affecting 22 Companies
According to Mandiant, the data breach tied to Salesloft’s Drift application began with the compromise of Salesloft’s GitHub account. The threat actor, tracked as UNC6395, accessed the Salesloft GitHub account from March through June 2025, and 22 companies…
The Hacker News -
Chinese Spies Impersonated US Lawmaker to Deliver Malware to Trade Groups: Report
According to the Wall Street Journal, China’s APT41 sent malicious emails on behalf of Rep. John Moolenaar to gather information ahead of US-China trade talks, impersonating a US lawmaker to target trade groups, law firms and government agencies. The…
SecurityWeek -
GPUGate Malware Uses Google Ads and Fake GitHub Commits to Target IT Firms
Cybersecurity researchers describe a new GPUGate malware campaign that uses paid Google search ads and a GitHub commit embedded in manipulated links to lure victims, exclusively targeting IT and software development companies in Western Europe since at least…
The Hacker News -
PromptLock Only PoC, but AI-Powered Ransomware Is Real
PromptLock is described as only a PoC, but the article notes that AI-powered ransomware is real. Samples were found in late August on VirusTotal, with ESET revealing it relied on OpenAI’s GPT-OSS:20b to generate Lua scripts and perform actions on targeted…
SecurityWeek -
Canadian investment platform Wealthsimple disclosed a data breach
Wealthsimple, the Canadian investment platform, disclosed a data breach that affected some customers and was traced to a supply chain attack via a trusted third‑party software package. The company said the security incident was detected on 30 August 2025 and…
Security Affairs -
The Critical Failure in Vulnerability Management
The Critical Failure in Vulnerability Management argues that the vulnerability management market is slowing as providers struggle to deliver real security value, with organisations seeking help to fix critical weaknesses, as reported by Amar Ramakrishnan, VP…
Dark Reading -
LunaLock Ransomware Attacking Artists to Steal and Encrypt Data
LunaLock is a newly surfaced ransomware strain attacking independent artists and their clients, demanding a hefty ransom in exchange for stolen artwork and leaked personal data. Emerging in early September 2025, the LunaLock group claims responsibility for…
gbhackers.com -
GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets
A supply chain attack dubbed GhostAction has targeted GitHub Action workflows, with SecurityWeek reporting that it affected hundreds of repositories and thousands of secrets. The campaign came to light after the GitHub account of the FastUUID project…
SecurityWeek -
Salesloft GitHub Account Compromised Months Before Salesforce Attack
According to Mandiant, the investigation into the incident found that the threat actor accessed the Salesloft GitHub account from March to June 2025, enabling them to download content from multiple repositories, add a guest user and establish workflows. The…
SecurityWeek -
iCloud Calendar infrastructure abused in PayPal phishing campaign
iCloud Calendar invites are being abused to mount PayPal phishing campaigns, with attackers leveraging legitimate calendar infrastructure rather than PayPal itself. According to BleepingComputer, the technique uses an iCloud Calendar event created by…
Malwarebytes -
Kimsuky Hackers’ Playbook Uncovered in Exposed ‘Kim’ Data Dump
A rare breach attributed to a North Korean–affiliated actor named “Kim” by the leakers has unveiled unprecedented insight into Kimsuky (APT43) operations, in what has been dubbed the “Kim” dump. The 9 GB dataset includes active bash histories, phishing…
gbhackers.comKimsuky -
Hackers Exploit Amazon SES to Blast Over 50,000 Malicious Emails Daily
Hackers are abusing Amazon’s Simple Email Service (SES) to blast over 50,000 malicious emails daily, a campaign described as a sophisticated cloud-based phishing operation. According to Wiz Research, the abuse was identified in May 2025, revealing how…
gbhackers.com -
PgAdmin Vulnerability Allows Attackers to Gain Unauthorized Account Access
A newly disclosed security flaw in pgAdmin4, the widely used open-source tool for managing PostgreSQL databases, has raised serious concerns among developers and database administrators worldwide. The vulnerability, tracked as CVE-2025-9636, is described as…
gbhackers.com -
Over 6,700 Private Repositories Made Public in Nx Supply Chain Attack
Hackers behind the Nx supply chain attack used stolen secrets to publish more than 6,700 private repositories publicly, Wiz says in its assessment. The second phase of the operation saw compromised NPM tokens used to create a wave of public repositories…
SecurityWeek -
CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure
CISA plans to delay the publication of its cybersecurity incident reporting rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022. According to Inside Privacy, an entry on the Spring 2025 Unified Agenda released on 4…
DataBreaches -
Web Application Firewall Bypassed via JS Injection with Parameter Pollution
In a recent autonomous penetration test, researchers demonstrated a novel cross-site scripting (XSS) bypass that sidesteps even highly restrictive Web Application Firewalls (WAFs). The find involved an ASP[.]NET application protected by a tightly configured…
gbhackers.com -
⚡ Weekly Recap: Drift Breach Chaos, Zero-Days Active, Patch Warnings, Smarter Threats & More
The weekly recap centres on the Salesloft–Drift breach, where attackers stole OAuth tokens and accessed Salesforce data from some of the biggest names in tech. It notes that Drift will be taken offline “in the very near future” to review and bolster…
The Hacker News -
You Didn’t Get Phished — You Onboarded the Attacker
The Hacker News argues that attackers can infiltrate organisations not through phishing, but by onboarding a malicious insider who looks like a legitimate hire. In the piece, a fictitious “Jordan from Colorado” is hired, logs in on day one, and is given…
The Hacker News -
U.S. Officials Investigating Cyber Threat Aimed at China Trade Talks
U.S. authorities have launched an investigation into a sophisticated malware-laden email that appears designed to glean intelligence on the Trump administration’s sensitive trade negotiations with Beijing, according to Reuters reporting. The malware embedded…
gbhackers.com -
Venezuela’s President Maduro said his Huawei Mate X6 cannot be hacked by US cyber spies
Venezuela’s President Nicolás Maduro showcased a Huawei Mate X6, reportedly gifted by China’s President Xi Jinping, and claimed that US cyber spies cannot hack it. He described the device as “the best phone in the world” during a press conference on 1…
Security Affairs -
Fintech Firm Wealthsimple Says Supply Chain Attack Resulted in Data Breach
Wealthsimple has disclosed that a data breach resulted from a supply chain attack involving a software package from a trusted third party, with the incident discovered on 30 August 2025, according to Wealthsimple. The breach affected personal information…
SecurityWeek -
How Microsoft Azure Storage Logs Help Investigate Security Breaches
Azure Storage logs can be a vital source of evidence when a security breach occurs, helping investigators detect unauthorized access, trace attacker activity, and protect sensitive data, according to Azure. The article notes that Storage logs track actions…
gbhackers.com -
iOS 0-Day, 55M U.S. Citizens’ Data, and Stealer Tools Hit Dark Web Forums
According to SOCRadar, a surge in underground listings shows an alleged iOS 18.x.x zero-day remote code execution exploit, a database claimed to contain 55 million U.S. citizen records, a Discord-focused malware named “Trap Stealer 2025,” and…
SOCRadar -
macOS Under Attack: Atomic Stealer Hidden in Pirated Software
Atomic macOS Stealer (AMOS) is a data-theft malware identified by Trend Micro as Trojan.MacOS.Amos[.]PFH, targeting macOS users seeking cracked software. It spreads via two infection vectors: malicious DMG installers distributed as fake cracked applications,…
gbhackers.com -
Cybersecurity M&A Roundup: 27 Deals Announced in August 2025
Twenty-seven cybersecurity merger and acquisition deals were announced in August 2025, according to SecurityWeek, marking a notable drop from earlier months. Notable moves include Accenture to acquire CyberCX, with terms not officially disclosed; Australian…
SecurityWeek -
Australian Authorities Expose Ransomware Gangs and Their Hidden Careers
Australian authorities have published a study that analysed 865 ransomware attacks across Australia, Canada, New Zealand and the United Kingdom between 2020 and 2022, revealing that in 2022 there were 309 attacks carried out by 42 ransomware organisations.…
gbhackers.com -
Mozilla to End Support for Firefox on 32-bit Linux in 2026
According to Mozilla Foundation, beginning with Firefox version 145.0, support for 32-bit Linux will officially end, with versions 144 and earlier remaining available for download in 32-bit builds but no further updates. The move comes as most modern Linux…
SecurityOnline
