News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Mon 20 Oct 2025· 52 articles
-
The Golden Scale: Notable Threat Updates and Looking Ahead
According to Unit 42, the Scattered LAPSUS$ Hunters group has continued to push updates via their Telegram channel, including notices around the Salesforce data theft extortion activity and related discussions in the SLSH 6.0 part 3 channel. The group set a…
unit42.paloaltonetworks.comScattered Lapsus Hunters -
NSO permanently barred from targeting WhatsApp users with Pegasus spyware
A federal judge has ordered spyware maker NSO to stop using its Pegasus app to target or infect users of WhatsApp, in a ruling issued on 20 October 2025 by Phyllis J. Hamilton of the US District Court of the District of Northern California. According to the…
Ars Technica -
Russian Lynk group leaks sensitive UK MoD files, including info on eight military bases
Russian cybercrime group Lynx breached Dodd Group, a contractor for the UK Ministry of Defence, stealing and leaking hundreds of sensitive files on eight RAF and Royal Navy bases, according to The Daily Mail. The incident is described as having occurred on…
Security Affairs -
ColdRiver Drops Fresh Malware on Targets
A sweeping cyber espionage campaign attributed to a Russia-linked group shows how quickly elite hacking teams can pivot when exposed, with NATO governments, former diplomats, and high-profile NGO figures targeted. In May this year, according to Google Threat…
Dark ReadingCallisto -
International Sting Takes Down SIM Box Criminal Network
Seven individuals were arrested in an operation codenamed SIMCARTEL, with law enforcement in Austria, Estonia and Latvia coordinating the takedown of a massive SIM card fraud network that provided fake phone numbers from more than 80 countries to criminals.…
Dark Reading -
Is Your Car a BYOD Risk? Researchers Demonstrate How
Is Your Car a BYOD Risk? researchers have demonstrated that a car can serve as an initial access vector into a corporate network, with a PoC attack chain unfolding from a parked vehicle to company Linux servers and ESXi hypervisors. At BSides NYC on Oct 18,…
Dark Reading -
Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets
According to CISA, five security flaws were added to the Known Exploited Vulnerabilities Catalog, including CVE-2025-61884, a server-side request forgery in the Oracle E-Business Suite Runtime component that could grant unauthorized access to data and is…
The Hacker News -
South Korea Seeks to Arrest Dozens of Online Scam Suspects Repatriated From Cambodia
According to the Associated Press, 64 South Korean nationals repatriated from Cambodia are facing formal arrest after police urged local courts to issue arrest warrants for 58 of them. Authorities detained the group in Cambodia over several months and flew…
SecurityWeek -
Flawed Vendor Guidance Exposes Enterprises to Avoidable Risk
Oracle’s latest guidance around its Web Application Firewall guidance is criticised as flawed, with a zero-day vulnerability in Oracle E-Business Suite prompting warnings that many enterprises misconfigured their exposure. The incident has been linked to…
Dark Reading -
Massive AWS Outage Halt The Internet – Disrupting Snapchat, Prime Video, Canva, and More
An outage believed to be caused by a DNS resolution failure struck Amazon Web Services on 20 October 2025, beginning at 12:11 a.m. PDT in AWS’s US-East-1 region in Northern Virginia and knocking several major platforms offline, including Snapchat, Amazon…
gbhackers.com -
131 Malicious Chrome Extensions Discovered Targeting WhatsApp Users
A new wave of spamware targeting WhatsApp Web users has emerged, with the Socket Threat Research Team revealing 131 malicious Chrome extensions flooding the Chrome Web Store. The extensions are not traditional malware but high‑risk automation tools that vin…
gbhackers.com -
Winos 4.0 Malware Uses Weaponized PDFs Posing as Government Departments to Infect Windows Machines
Security researchers are tracking a high-severity malware campaign that uses weaponized PDF files to distribute the Winos 4.0 malware, with the threat actors impersonating government departments to lure users into opening the documents. The campaign, first…
gbhackers.com -
Inside the attack chain: Threat activity targeting Azure Blob Storage
Azure Blob Storage, a core data storage service, is described as a high‑value target because it handles vast amounts of unstructured data across workloads such as AI, analytics, HPC, and backups, making it attractive to threat actors.
Microsoft -
Hackers Say They Have Personal Data of Thousands of NSA and Other Government Officials
A hacking group that previously doxed hundreds of government officials has now claimed to have built dossiers on tens of thousands of U.S. government employees, including NSA officials, by mining its caches of stolen Salesforce customer data. According to…
DataBreaches -
New Microchip Tech Protects Vehicles from Laser Attacks
New research underlines a multi-layer, insulating FD-SOI design that makers argue can shield automotive microchips from laser fault injection attacks[.]According to the French Alternative Energies and Atomic Energy Commission (CEA) and Soitec, this Fully…
Dark Reading -
John Bolton Indictment Provides Interesting Details About Hack of His AOL Account and Extortion Attempt
According to Kim Zetter, the FBI investigated former national security adviser John Bolton after he admitted in July 2021 that hackers—believed to be from Iran—had breached his private AOL email account and extorted him over classified information. The…
DataBreaches -
Self-Propagating GlassWorm Attacks VS Code Supply Chain
A self-propagating worm called GlassWorm is targeting Visual Studio Code extensions in a sophisticated supply-chain attack that has infected 35,800 developer machines so far. Researchers at Koi Security flagged the malware on 18 October after the CodeJoy…
Dark Reading -
What does Google know about me? (Lock and Code S06E21)
In the Malwarebytes article about Lock and Code S06E21, it notes that Google dominates much of the modern web, with a search engine handling billions of requests a day and Google Analytics embedded on tens of millions of websites. It also highlights Google’s…
Malwarebytes -
To Be (A Robot) or Not to Be: New Malware Attributed to Russia State-Sponsored COLDRIVER
Written by: Wesley Shields Introduction COLDRIVER, a Russian state-sponsored threat group known for targeting high profile individuals in NGOs, policy advisors and dissidents, swiftly shifted operations after the May 2025 public disclosure of its LOSTKEYS…
Google Cloud -
Chinese gangs made over $1 billion targeting Americans with scam texts
According to an article in The Wall Street Journal, Chinese gangs have turned scam texts into a billion-dollar, highly sophisticated business targeting Americans, with more than $1 billion earned in just three years. The reports highlight toll, postage, and…
Malwarebytes -
CAPI Backdoor targets Russia’s auto and e-commerce sectors
According to Seqrite Labs, a new campaign named Operation MotorBeacon targets Russia’s auto and e-commerce sectors with a previously unknown .NET malware dubbed CAPI Backdoor. The attack chain begins with spearphishing emails that carry a ZIP archive titled…
Security Affairs -
SIM Farm Dismantled in Europe, Seven Arrested
Seven individuals were arrested in a coordinated operation against a SIM farm and the sophisticated cybercrime-as-a-service platform it supported. The suspects ran a CaaS that allowed illegitimate users to rent phone numbers and create fake social media…
SecurityWeek -
Lumma Stealer Activity Drops After Doxxing
Lumma Stealer activity has declined in the wake of an underground doxxing campaign that exposed the identities of five alleged core group members, according to SecurityWeek. The doxxing, which published personal details including passport numbers and bank…
SecurityWeek -
ConnectWise Patches Critical Flaw in Automate RMM Tool
ConnectWise has rolled out patches for two vulnerabilities in the Automate remote monitoring and management tool that could allow attackers to perform man-in-the-middle attacks. Last week, ConnectWise released Automate version 2025.9 with patches for…
SecurityWeek -
⚡ Weekly Recap: F5 Breached, Linux Rootkits, Pixnapping Attack, EtherHiding & More
The weekly recap highlights a nation-state–level breach of F5, with attackers reportedly stealing BIG-IP source code and information about undisclosed vulnerabilities after infiltrating the network for at least 12 months, using a malware family dubbed…
The Hacker News -
10/20/25, 12:00 PM
According to Darktrace, Salt Typhoon—a China-linked cyber espionage group also tracked as Earth Estries, GhostEmperor and UNC2286—was observed targeting a European telecommunications organisation, with activity aligning to its known TTPs such as DLL…
darktrace.com -
Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches
ClickFix, FileFix, fake CAPTCHA and related techniques describe attacks where users are tricked into running malicious browser code after copying from the clipboard. According to Push Security, ClickFix is known to be regularly used by the Interlock…
The Hacker News -
131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign
Cybersecurity researchers have uncovered a coordinated campaign that used 131 rebranded clones of a WhatsApp Web automation Chrome extension to spam Brazilian users at scale. The 131 spamware extensions share the same codebase, design patterns and…
The Hacker News -
PoC Released for Linux-PAM Vulnerability Enabling Local Root Privilege Escalation
A new proof-of-concept (PoC) has been released for a serious vulnerability tracked as CVE-2025-8941, affecting the Pluggable Authentication Modules (PAM) used across Linux distributions. The flaw, rated 7.8 (High) on the CVSS scale, allows local attackers to…
gbhackers.com -
Vulnerability in Dolby Decoder Can Allow Zero-Click Attacks
A high-severity vulnerability in Dolby’s Unified Decoder could be exploited for remote code execution without user interaction in certain cases. The flaw, tracked as CVE-2025-54957 with a CVSS score of 7.0, stems from an out-of-bounds write in the decoder…
SecurityWeek -
NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million
According to SecurityWeek, NSO was ordered to stop targeting WhatsApp, with a permanent injunction granted by US District Court Judge Phyllis Hamilton dated 17 October 2025. The ruling bars NSO from reverse engineering WhatsApp, from creating new WhatsApp…
SecurityWeek -
F5 breach exposes 262,000 BIG-IP systems worldwide
Over 262,000 F5 BIG-IP devices were exposed online after F5 confirmed a breach by a nation-state actor who stole BIG-IP source code and data on undisclosed vulnerabilities. The Shadowserver Foundation found 262,269 BIG-IP systems exposed online, with over…
Security Affairs -
American Airlines Subsidiary Envoy Air Hit by Oracle Hack
Envoy Air, which operates the American Eagle brand for American Airlines, has confirmed it was impacted by the Oracle E-Business Suite campaign, with the attackers claiming a leak of more than 26 GB of archive data. The hackers have listed American Airlines…
SecurityWeek -
A week in security (October 13 – October 19)
According to Malwarebytes Labs, a roundup of security news for October 13–19 highlighted several high‑profile incidents and scam trends. Prosper reported on October 17, 2025 that, although no funds or accounts were accessed, the stolen data could still…
Malwarebytes -
MSS Claims NSA Used 42 Cyber Tools in Multi-Stage Attack on Beijing Time Systems
The MSS has claimed that the U.S. National Security Agency conducted a multi-stage cyber operation targeting the National Time Service Center (NTSC) in Beijing Time, with activity dating back to 25 March 2022. According to details shared in the WeChat post,…
The Hacker News -
China finds “irrefutable evidence” of US NSA cyberattacks on time Authority
According to Bloomberg, China’s Ministry of State Security says it has found irrefutable evidence that the US National Security Agency conducted cyber intrusions into China’s National Time Service Center, part of the Chinese Academy of Sciences, which…
Security Affairs -
Critical Squid Proxy Flaw (CVE-2025-62168, CVSS 10.0) Leaks HTTP Credentials and Security Tokens via Error Handling
The developers of Squid have disclosed and patched a critical information disclosure vulnerability, tracked as CVE-2025-62168 with a CVSS of 10.0, affecting all Squid versions up to and including 7.1 depending on configuration. According to Squid Project’s…
SecurityOnline -
GlassWorm Supply Chain Worm Uses Invisible Unicode and Solana Blockchain for Stealth C2
Cybersecurity researchers at Koi Security have uncovered GlassWorm, the world’s first self-propagating malware targeting VS Code extensions on the OpenVSX Marketplace, which combines invisible Unicode injection with a Solana blockchain-based C2 and Google…
SecurityOnline -
China Accuses US of Cyberattack on National Time Center
China on 19 October 2025 accused the US National Security Agency of carrying out cyberattacks on its National Time Service Center, warning that any damage to related facilities could disrupt network communications, financial systems and power supply,…
SecurityWeek -
SEQRITE Labs Uncovers “CAPI Backdoor” Campaign Targeting Russia’s Automobile and E-Commerce Sectors
SEQRITE Labs have uncovered a targeted spear-phishing campaign aimed at organisations in Russia’s automobile and e-commerce sectors, active since early October 2025. The operation deploys a previously undocumented .NET-based backdoor named CAPI, designed for…
SecurityOnline
