News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Wed 17 Sep 2025· 77 articles
-
JLR ‘cyber shockwave ripping through UK industry’ as supplier share price plummets by 55%
Shares in a British automaker supplier plummeted 55% on Wednesday after it warned that a cyberattack on Jaguar Land Rover was impacting its business, according to a senior politician. Autins, which supplies specialist insulation components for Jaguar…
DataBreaches -
ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks
According to BleepingComputer, the ShinyHunters extortion group claims to have stolen over 1.5 billion Salesforce records from 760 companies using compromised Salesloft Drift OAuth tokens. For the past year, the threat actors have been targeting Salesforce…
DataBreachesShinyHunters -
APT413 articles this day · gbhackers.com first
China-linked APT41 targets government, think tanks, and academics tied to US-China trade and policy · Chinese TA415 Uses VS Code Remote Tunnels to Spy on U.S. Economic Policy Experts
3 outlets-
China-linked APT41 targets government, think tanks, and academics tied to US-China trade and policy
According to Proofpoint, the China-linked cyber espionage group TA415 impersonated a U.S. lawmaker in phishing campaigns targeting government, think tanks, and academics tied to U.S.-China trade and policy. In July and August 2025, TA415 presented themselves…
Security Affairs -
Chinese TA415 Uses VS Code Remote Tunnels to Spy on U.S. Economic Policy Experts
According to Proofpoint, a China-aligned threat actor known as TA415 has been attributed to spear-phishing campaigns targeting the U.S. government, think tanks, and academic organisations with US-China economic-themed lures. The activity, observed throughout…
The Hacker News -
China-Aligned TA415 Exploits Google Sheets & Calendar for C2
China-aligned TA415 has adopted Google Sheets and Google Calendar as covert command-and-control (C2) channels in a sustained espionage campaign targeting U.S. government, academic, and think-tank entities. By blending malicious operations into trusted cloud…
gbhackers.com
-
-
Microsoft Disrupts 'RaccoonO365' Phishing Service
Microsoft and Cloudflare teamed up to disrupt the phishing service known as RaccoonO365, with Microsoft noting that 338 websites linked to the operation were seized under a court order in the Southern District of New York. According to Cloudflare, which…
Dark Reading -
"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack
According to Unit 42, Palo Alto Networks is investigating an active and widespread software supply chain attack targeting the Node Package Manager (npm) ecosystem. A novel, self-replicating worm, tracked as "Shai-Hulud," is responsible for the compromise of…
unit42.paloaltonetworks.com -
'Scattered Lapsus$ Hunters,' Others Announce End of Hacking Spree
In a development that surprised many in the cybersecurity community, several well-known threat actors and groups, including the newly formed “Scattered Lapsus$ Hunters,” announced they were shutting down their operations. The farewell letter, posted last…
Dark ReadingScattered Spider -
TA558 Uses AI-Generated Scripts to Deploy Venom RAT in Brazil Hotel Attacks
The threat actor TA558 has been attributed to a fresh wave of attacks delivering Venom RAT to hotels in Brazil and other Spanish-speaking markets, with Russian cybersecurity vendor Kaspersky tracking the activity in a cluster it calls RevengeHotels.…
The Hacker NewsRevengeHotels -
New in Syteca Release 7.21: Agentless Access, Sensitive Data Masking, and Smooth Session Playback
Syteca has launched Release 7.21, a major update described as improving user privacy, access management, oversight, and the user experience. The release introduces real-time sensitive data masking, enabling automatic detection and obscuring of confidential…
gbhackers.com -
Tiffany discloses data breach involving gift cards — second breach disclosure in recent months
Tiffany & Co. has disclosed a second data breach this year involving Tiffany gift cards, affecting 2,590 people. The notification to affected individuals, submitted to the Maine Attorney General’s Office, states the cybersecurity incident occurred on or…
DataBreaches -
Legion: AWS Credential Harvester and SMTP Hijacker
According to Darktrace, Legion is a Python-based credential harvester and hacktool surfaced by Cado Security Labs, designed to exploit a range of services for email abuse. The malware targets credentials from misconfigured web servers and even includes…
darktrace.com -
New in Syteca Release 7.21: Agentless Access, Sensitive Data Masking, and Smooth Session Playback
Syteca has rolled out release 7.21, adding agentless access, real-time sensitive data masking, and smoother session playback to its platform, with the aim of boosting visibility and control over internal security while reducing IT overhead. The update…
SecurityOnline -
Virtual Event Today: Attack Surface Management Summit
SecurityWeek’s Attack Surface Management Virtual Summit is now LIVE and runs today from 11AM – 4PM ET, inviting cybersecurity leaders and practitioners to explore strategies, tools, and innovations shaping the future of ASM. The event aims to help…
SecurityWeek -
Irregular Raises $80 Million for AI Security Testing Lab
Israeli company Irregular, formerly known as Pattern Labs, announced on 17 September 2025 that it has raised $80 million for its AI security lab. Founded by Dan Lahav (CEO) and Omer Nevo (CTO), Irregular says it has created a frontier AI security lab that…
SecurityWeek -
Microsoft and Cloudflare teamed up to dismantle the RaccoonO365 phishing service
Microsoft and Cloudflare disrupted the RaccoonO365 phishing operation, a phishing‑as‑a‑service platform used to steal Microsoft 365 credentials, with Microsoft’s Digital Crimes Unit seizing 338 websites and cutting off criminals’ access to victims. In a…
Security Affairs -
AI-Powered Sign-up Fraud Is Scaling Fast
Security experts warn that attackers wielding AI are rapidly shifting their focus to sign-up fraud, gunning for new accounts rather than existing ones. The article, dated 17 September 2025, notes that in 2024, 46% of all registration attempts on the platform…
Dark Reading -
223 malicious apps removed from the Google Play Store after ad fraud campaign discovered
On 17 September 2025, Malwarebytes reports that 224 malicious apps were removed from the Google Play Store after a large ad fraud campaign was uncovered. According to the Satori Threat Intelligence and Research team, the apps were downloaded more than 38…
Malwarebytes -
RegScale Raises $30 Million for GRC Platform
RegScale has raised over $30 million in an oversubscribed Series B funding round, bringing the company’s total funding to more than $50 million, according to SecurityWeek. The round was led by Washington Harbour Partners, with participation from M12, Hitachi…
SecurityWeek -
MuddyWater Deploys Custom Multi-Stage Malware Hidden Behind Cloudflare
Since early 2025, MuddyWater, the Iranian state-sponsored APT, has evolved its tactics from broad RMM campaigns to targeted spearphishing and bespoke backdoors, the article notes. The group now deploys custom, multi-stage malware hidden behind mainstream…
gbhackers.comMuddyWater -
Microsoft OneDrive Auto-Sync Flaw Leaks Enterprise Secrets from SharePoint Online
A new report from Entro Labs reveals that one in five exposed secrets in large organisations can be traced back to SharePoint, not a flaw in SharePoint itself but OneDrive’s default auto-sync. OneDrive for Business includes a Known Folder Move option that…
gbhackers.com -
BeaverTail Malware Delivered Through Malicious Repositories Targets Retailers
According to Oliver Smith, GitLab Threat Intelligence, BeaverTail and InvisibleFerret malware have been distributed since at least May 2025, with the operation run by North Korean actors tracked as Contagious Interview and Famous Chollima. The campaign uses…
gbhackers.com -
Self-propagating supply chain attack hits 187 npm packages
Security researchers have identified at least 187 npm packages compromised in an ongoing supply chain attack, with a malicious self-propagating payload to infect other packages, according to Bleeping Computer. The coordinated worm-style campaign dubbed…
DataBreaches -
Details Emerge on Chinese Hacking Operation Impersonating US Lawmaker
SecurityWeek reports that a Chinese state-backed operation, TA415 (also known as APT41, Barium, Brass Typhoon, Bronze Atlas, Wicked Panda and Winnti), conducted a phishing campaign in July and August 2025 aimed at US government, think tank and academic…
SecurityWeek -
New Magecart Attack Injects Malicious JavaScript to Steal Payment Data
A new Magecart-style campaign has emerged that uses malicious JavaScript injections to skim payment data from online checkout forms, with the exploit described as surfacing after a cryptic hint from a security researcher about an active campaign hosted on…
gbhackers.com -
August 2025: SaaS Supply Chain Breaches, Telecom Data Exposures, and Ransomware Campaigns
August 2025 saw a surge of high‑impact cyber incidents, with SaaS supply chain and data‑exposure events dominating headlines. The Salesloft Drift integration breach exposed over 700 organisations after threat actors used stolen OAuth tokens to access…
SOCRadar -
BreachForums Owner Sent to Prison in Resentencing
The owner of the cybercrime site BreachForums, Conor Brian Fitzpatrick, 22, of Peekskill, New York, was resentenced to three years in prison for operating BreachForums and possessing child sexual abuse material. He had previously pleaded guilty in July 2023…
SecurityWeek -
Scalekit Raises $5.5 Million to Secure AI Agent Authentication
Scalekit has announced a seed funding round of $5.5 million, co-led by Together Fund and Z47 with support from several angel investors. Founded in 2024, the US-based cybersecurity startup offers an authentication stack designed to verify AI agent identities…
SecurityWeek -
From Quantum Hacks to AI Defenses – Expert Guide to Building Unbreakable Cyber Resilience
The Hacker News reports on a webinar-led guide titled From Quantum Hacks to AI Defenses – Expert Guide to Building Unbreakable Cyber Resilience, scheduled as part of its Cyber Resilience coverage on 17 September 2025. According to IBM, cyber breaches average…
The Hacker News -
Latvian health authority official and IT company head fined for data breach
According to Latvian Public Media, the Kurzeme Regional Court has overturned an earlier acquittal and found an official of a state institution guilty of disclosing confidential information, and a board member of an IT company guilty of inciting a public…
DataBreaches -
Apple Patches 0-Day Vulnerabilities in Older iPhones and iPads
Apple has released critical security updates for older iPhone and iPad models after a zero-day vulnerability was reportedly exploited in targeted attacks. The updates for iOS 16.7.12 and iPadOS 16.7.12, issued on 15 September 2025, address a flaw tracked as…
gbhackers.com -
Chaos Mesh Critical Vulnerabilities Expose Kubernetes Clusters to Takeover
Security Research recently uncovered four CVEs—CVE-2025-59358, CVE-2025-59359, CVE-2025-59360, and CVE-2025-59361—in the default configuration of Chaos Mesh, a popular open‑source Chaos Engineering platform for Kubernetes, exposed via the Chaos Controller…
gbhackers.com -
Decade-Old Pixie Dust Wi-Fi Hack Still Impacts Many Devices
According to NetRise, 20 device models from six vendors remain vulnerable to the Pixie Dust Wi‑Fi attack, with TP-Link accounting for about half of the models analysed. NetRise’s study of 24 routers, access points, range extenders and powerline/Wi‑Fi hybrids…
SecurityWeek -
Rethinking AI Data Security: A Buyer's Guide
The Hacker News reports that the AI data security market is already crowded, with vendors from traditional DLP to next-gen SSE rebranding around “AI security,” which can muddy the waters for buyers. A new buyer’s guide for AI data security tries to bridge…
The Hacker News -
Hackers Exploit AdaptixC2, an Emerging Open-Source C2 Tool
Hackers are leveraging AdaptixC2, an open-source post-exploitation and adversarial emulation framework, to control compromised endpoints, with Unit 42 researchers noting its use in real campaigns in May 2025. According to Unit 42, the first campaign…
gbhackers.com -
Ransomware’s new frontier: Extortion attacks evolve in Asia Pacific
According to Akamai Technologies, the cybersecurity and cloud computing company that powers and protects business online, bad actors are using a new quadruple extortion tactic in ransomware campaigns, while double extortion remains the most common approach.…
DataBreaches -
Airline data broker selling 5 billion passenger records to US government
According to 404 Media, the data broker Airlines Reporting Corporation (ARC) provides access to a searchable database of at least five billion passenger records, updated daily, to federal agencies. The article notes that ARC is owned and operated by at least…
Malwarebytes -
Google Play Flooded With 224 Malicious Apps, 38 Million Downloads Deliver Malware
A global ad fraud operation named SlopAds involved 224 Android apps that together amassed more than 38 million downloads across 228 countries and territories. These apps, presented as AI-themed utilities, used obfuscation such as steganography and hidden…
gbhackers.com -
CVE-2025-9242: Critical WatchGuard Flaw Allows Remote Code Execution
CVE-2025-9242 is a critical vulnerability in WatchGuard’s Fireware OS that could allow a remote unauthenticated attacker to execute arbitrary code on vulnerable Firebox devices, with a CVSS v4 score of 9.3. The flaw lies in the iked process and affects…
SecurityOnline -
DoJ resentenced former BreachForums admin to three years in prison
According to the U.S. Department of Justice (DoJ), the former BreachForums administrator Conor Brian Fitzpatrick was resentenced to three years in prison. The DoJ says he ran BreachForums, a cybercrime marketplace that traded stolen data, cybercrime tools…
Security Affairs
