News

Tue 28 Oct 2025· 76 articles

1. 10:00

   Hackers Target Swedish Power Grid Operator

   Hacker activity targeted Svenska kraftnät, Sweden’s state-owned power grid operator, with the incident described as a data breach that was discovered on a Saturday and involved an isolated external file transfer solution. According to Svenska kraftnät, the…

   SecurityWeek
2. 09:21

   Ransomware payments hit record low: only 23% Pay in Q3 2025

   Only 23% of ransomware victims paid attackers in Q3 2025, the lowest rate recorded and continuing a six-year downward trend, according to Coveware. The average ransom payment dropped to $376,941 in Q3 2025, down 66% from Q2, while the median fell to…

   Security Affairs
   
3. 09:13

   New GhostGrab Android Malware Silently Steals Banking Login Details and Intercept SMS for OTPs

   A new Android threat named GhostGrab is reported to quietly steal banking login details and intercept SMS messages to capture one-time passwords, combining these data theft capabilities with covert cryptocurrency mining for a dual monetisation approach.…

   gbhackers.com
   
4. 09:12

   Lazarus Group3 articles this day · SecurityOnline first

   BlueNoroff Shifts Tactics: Targets C-Suite and Managers with New Infiltration Methods · Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs

   Show 3 articles3 outlets
5. 08:43

   Critical QNAP .NET Flaw Lets Attackers Bypass Security Protections

   According to QNAP, a critical flaw in Microsoft ASP[.]NET Core has been found in NetBak PC Agent, tracked as CVE-2025-55315, which can allow authenticated attackers to bypass security controls via HTTP Request Smuggling. The vulnerability carries a CVSS…

   gbhackers.com
   
6. 08:22

   Chrome Zero-Day Exploited to Deliver Italian Memento Labs' LeetAgent Spyware

   According to new findings from Kaspersky, a now-patched Google Chrome zero-day flaw was exploited to deliver an espionage-related tool from Italian information technology and services provider Memento Labs, known as LeetAgent. The vulnerability,…

   The Hacker News
7. 08:07

   Sweden’s Power Grid Operator Admits Data Breach Linked to Everest Ransomware Gang

   According to Svenska kraftnät, Sweden’s national power grid operator, the organisation confirmed a significant data breach exposing certain information to unauthorised parties, disclosed on 26 October 2025 and linked to the Everest ransomware gang. The…

   gbhackers.com
   
8. 08:05

   Water Saci Hackers Use WhatsApp to Deploy Persistent SORVEPOTEL Malware

   Trend Micro Research has identified a significant evolution in the Water Saci malware campaign, moving away from traditional .NET-based delivery methods to script-driven techniques and using WhatsApp as the primary infection vector. On 8 October 2025,…

   gbhackers.comWater Saci
   
9. 06:56

   CISA Alerts on Critical Veeder-Root Flaws Allowing Attackers to Execute System Commands

   According to CISA, the agency has issued a critical security alert released on 23 October 2025 about serious vulnerabilities in Veeder-Root’s TLS4B Automatic Tank Gauge System. Two critical flaws were identified, with security researchers at Bitsight…

   gbhackers.com
   
10. 06:27

    X warns users to re-enroll passkeys and YubiKeys for 2FA by Nov 10

    X warns users who rely on passkeys or hardware security keys such as YubiKeys for two-factor authentication (2FA) to re-enrol by 10 November 2025 to avoid account lockout, with accounts that have not re-enrolled at risk of being locked until action is taken.…

    Security Affairs
    
11. 06:16

    Gamaredon Phishing Campaign Exploits WinRAR Vulnerability to Target Government Agencies

    According to GBHackers News, Gamaredon, also tracked as Primitive Bear and Shuckworm, has orchestrated a sophisticated phishing campaign aimed at government entities by exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR. The attackers deliver…

    gbhackers.com
    
12. 05:29

    Apache Tomcat Flaws Allow Remote Code Execution on Vulnerable Servers

    According to The Apache Software Foundation, two security vulnerabilities affect multiple Apache Tomcat versions, with one flaw posing a serious risk of remote code execution on vulnerable servers. The issues are CVE-2025-55752, a directory traversal via…

    gbhackers.com
    
13. 05:29

    Beware of Free Video Game Cheats that Deliver Infostealer Malwares

    The piece highlights how the pursuit of a free edge in competitive gaming has drawn cybercriminals into distributing infostealer malwares disguised as cheats. It notes that the industry has seen high-stakes temptations, from CS2 and other popular titles to…

    gbhackers.com
    
14. 05:13

    OpenAI Atlas Browser Vulnerability Lets Attackers Execute Malicious Scripts in ChatGPT

    OpenAI’s ChatGPT Atlas browser is described as having a critical vulnerability that lets attackers inject harmful instructions into ChatGPT’s memory and execute remote code, according to LayerX’s findings. The flaw uses a Cross-Site Request Forgery attack to…

    gbhackers.com
    
15. 04:16

    Critical .NET Flaw (CVE-2025-55315) in QNAP: NAS Backup Utility Vulnerable to Credential Theft

    According to Microsoft, the critical vulnerability CVE-2025-55315 carries a CVSS score of 9.8 and affects ASP[.]NET, with attackers potentially intercepting credentials or bypassing front-end controls via HTTP request smuggling. Earlier, QNAP issued a…

    SecurityOnline
    
16. 04:11

    Microsoft Teams Will Auto-Track Office Location via Wi-Fi

    Microsoft Teams is set to gain a feature that detects Wi‑Fi networks to automatically update a user’s location status, with the aim of marking staff as “in the office” when they connect to the office Wi‑Fi and changing to indicate elsewhere when they switch…

    SecurityOnline
    
17. 04:07

    Grokipedia Launches: Elon Musk’s xAI Debuts AI Encyclopedia to Rival Wikipedia

    According to Daily CyberSecurity, Elon Musk’s artificial intelligence company xAI has unveiled Grokipedia, a new AI-powered encyclopedia built on its Grok AI model and positioned as a direct competitor to Wikipedia. Unlike Wikipedia, Grokipedia’s content is…

    SecurityOnline
    
18. 04:01

    RIP Twitter.com: X Retires Old Domain, Forcing Passkey Reset by Nov 10

    Elon Musk’s social media platform X (formerly Twitter) has announced that it will permanently retire the old domain Twitter[.]com, which previously redirected to X[.]com. Once the old domain is deactivated, users will not be able to access posts or data via…

    SecurityOnline
    
19. 04:01

    RAZOR TIGER2 articles this day · SecurityOnline first

    SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats · SideWinder APT Shifts to PDF/ClickOnce Chain to Target South Asian Diplomacy with StealerBot

    Show 2 articles2 outlets
20. 03:56

    One in Nine: Amazon Prepares for Massive Layoff of 30,000 Corporate Staff

    Tech giant Amazon is reportedly preparing for another massive round of layoffs, with plans to cut as many as 30,000 employees. According to Reuters, layoff notices will begin rolling out via email on Tuesday local time. The article notes that, using 2023…

    SecurityOnline
    
21. 03:51

    Privacy Win: Firefox Mandates Clear Data Collection Disclosure for All Extensions

    Firefox is tightening privacy rules for extensions, requiring all newly published extensions to declare whether they collect or transmit personal information, with existing extensions not being immediately affected. Beginning 3 November 2025, the policy…

    SecurityOnline
    
22. 03:46

    Values Over Cash: Python Foundation Rejects $1.5M US Grant Over Anti-DEI Clause

    According to the Python Software Foundation, which submitted a proposal to the U.S. National Science Foundation in January 2025 under the Open Source Ecosystem Safety, and Privacy initiative, the grant would address vulnerabilities in Python and PyPI. The…

    SecurityOnline
    
23. 03:41

    Google Debunks False Gmail Breach Rumors as Credentials Leak Again

    On 28 October 2025, Google debunked claims of a Gmail breach, clarifying that the discussion was about insecure account practices rather than a new attack. According to Google’s Security Team, media misinterpretations alleged that data from 2.5 billion Gmail…

    SecurityOnline
    
24. 03:29

    Qilin RaaS Expands Global Impact: 40+ Victims/Month, Cyberduck Abuse, and WDigest Credential Theft

    According to Cisco Talos, Qilin ransomware group has sustained a high operational tempo in the second half of 2025, publishing over 40 victim cases per month on its leak site and remaining one of the most impactful ransomware groups worldwide. Active since…

    SecurityOnline
    
25. 02:54

    Kaspersky Exposes Chrome Zero-Day RCE (CVE-2025-2783) Delivering Memento Labs Spyware in ForumTroll Campaign

    Kaspersky researchers uncovered a sophisticated espionage campaign, dubbed Operation ForumTroll, that exploited a zero-day in Google Chrome (CVE-2025-2783) to deliver commercial spyware linked to Memento Labs, formerly Hacking Team. The attackers began with…

    SecurityOnlineOperation ForumTroll
    
26. 02:45

    High-Severity OpenVPN Flaw (CVE-2025-10680) Allows Script Injection on Linux/macOS via Malicious DNS Server

    Security researchers have disclosed a high-severity vulnerability in OpenVPN, tracked as CVE-2025-10680 (CVSS 8.8), affecting OpenVPN 2.7_alpha1 through 2.7_beta1 releases. The flaw exposes Unix-like systems to script injection when connecting to untrusted…

    SecurityOnline
    
27. 02:27

    First Ever: Android Baohuo Backdoor Hides in Telegram X Clone, Uses Redis Database for C2 Commands

    Cybersecurity researchers have identified Android.Backdoor.Baohuo.1[.]origin hiding in maliciously modified versions of the Telegram X messenger, operating through a Redis database for remote command execution alongside traditional C2 servers. The campaign…

    SecurityOnline
    
28. 01:43

    Apache Tomcat Patches URL Rewrite Bypass (CVE-2025-55752) Risking RCE and Console ANSI Injection

    On 28 October 2025, Apache Tomcat patches were issued for three newly disclosed vulnerabilities, CVE-2025-55752, CVE-2025-55754 and CVE-2025-61795, affecting Tomcat 9, 10 and 11 across several release lines. The most severe, CVE-2025-55752, could potentially…

    SecurityOnline
    
29. 00:16

    Caminho Loader-as-a-Service Uses LSB Steganography to Hide .NET Payloads in Archive.org Images

    Caminho Loader-as-a-Service uses Least Significant Bit steganography to conceal .NET payloads inside image files hosted on Archive[.]org, according to Arctic Wolf. The operation has been active since March 2025, with notable evolution in June 2025 when…

    SecurityOnline
    
30. 00:11

    GhostGrab Android Malware Combines Covert Monero Mining with Financial Credential Theft

    GhostGrab is described by CYFIRMA as a sophisticated Android malware family that blends covert Monero mining with financialCredential theft, representing a significant escalation in mobile threats. The malware turns infected devices into Monero miners,…

    SecurityOnline
    
31. 00:07

    RedTiger Infostealer Weaponizes Python Red-Teaming Tool to Hack Discord Accounts and Steal Crypto Wallets

    Netskope Threat Labs has discovered a rapidly spreading Python-based infostealer named RedTiger, repurposed from an open-source red-teaming tool to target Discord users, gamers, and cryptocurrency wallets, with the malware released publicly in 2024.…

    SecurityOnline
    
32. 00:04

    Finally: iOS 26.1 Unlocks Seamless Background Photo Uploads for All Apps

    Finally, iOS 26.1 unlocks seamless background photo uploads for all apps, with Apple relaxing a long-standing constraint that required backup apps to stay open in the foreground. On 28 October 2025, the release introduces a new PhotoKit capability called…

    SecurityOnline
    
33. 00:01

    Bing Wallpaper Update Clicks the Desktop to Force-Launch Bing Search

    Bing Wallpaper, a desktop application from Microsoft linked to Bing’s Image of the Day, now opens Bing Search by default when users click any empty area on the desktop, a change described as more intrusive than prior features. According to Windows Latest,…

    SecurityOnline