News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Mon 3 Nov 2025· 59 articles
-
Android Malware Mutes Alerts, Drains Crypto Wallets
Security researchers have identified Android/BankBot-YNRK as a highly capable new mobile banking Trojan targeting Indonesia, masquerading as genuine apps inside legitimate-looking versions of Identitas Kependudukan Digital. According to Cyfirma, the malware…
Dark Reading -
Jabber Zeus developer ‘MrICQ’ extradited to US from Italy
Ukrainian national Yuriy Igorevich Rybtsov, also known as MrICQ, has been extradited from Italy to the United States to face cybercrime charges tied to Jabber Zeus. After being arrested in Italy, he lost his extradition appeal and was sent to a Nebraska…
Security Affairs -
Hackers Weaponize Remote Tools to Hijack Cargo Freight
Researchers from Proofpoint have disclosed a campaign in which threat actors weaponise remote monitoring and management tools to hijack cargo freight, with attackers compromising load-board accounts, publishing fake listings and sending phishing links to…
Dark Reading -
Malicious VSX Extension "SleepyDuck" Uses Ethereum to Keep Its Command Server Alive
Cybersecurity researchers flagged a new malicious VSX extension in the Open VSX registry, named juan-bianco[.]solidity-vlang (version 0.0.7), which was updated to 0.0.8 on 1 November 2025 to add malicious capabilities after reaching 14,000 downloads,…
The Hacker News -
SesameOp: Novel backdoor uses OpenAI Assistants API for command and control
Microsoft Incident Response – Detection and Response Team (DART) researchers uncovered SesameOp, a backdoor that uses the OpenAI Assistants API as a covert command-and-control channel rather than traditional infrastructure. According to Microsoft’s analysis,…
Microsoft -
Ukrainian Extradited to US Faces Charges in Jabber Zeus Cybercrime Case
A Ukrainian national believed to be a developer for the Jabber Zeus cybercrime group has been reportedly extradited from Italy to the US. Yuriy Igorevich Rybtsov, 41, of Donetsk, is allegedly the Jabber Zeus developer MrICQ, who was mentioned in a 2012…
SecurityWeek -
Attack of the clones: Fake ChatGPT apps are everywhere
Malwarebytes’ analysis of the mobile AI gold rush shows a surge of fake ChatGPT-ish apps flooding app stores in 2025, with some clones offering only lightweight wrappers and others masquerading as genuine AI tools to harvest user data. The piece notes three…
Malwarebytes -
How Software Development Teams Can Securely and Ethically Deploy AI Tools
To securely and ethically deploy AI tools, software development teams must balance innovation with accountability by establishing strong governance, upskilling developers, and enforcing rigorous code reviews, the piece notes. It cites that more than four out…
SecurityWeek -
Would you sext ChatGPT? (Lock and Code S06E22)
In the Lock and Code S06E22 episode, Malwarebytes notes that on 14 October, OpenAI CEO Sam Altman said restrictions on ChatGPT would be removed, potentially allowing erotica in the future. The piece also recalls a 26 August OpenAI blog about new protections…
Malwarebytes -
CISO Burnout – Epidemic, Endemic, or Simply Inevitable?
CISO burnout is increasing, and the piece asks whether we are simply more aware of the condition or if demands on CISOs have made burnout the inevitable result. It notes that in 2019 burnout was defined by the World Health Organization as an occupational…
SecurityWeek -
Chrome 142 Released: Two high-severity V8 flaws fixed, $100K in rewards paid
Google released Chrome 142, fixing 20 flaws and awarding $100,000 in bug bounties for two high‑severity V8 issues. The two high‑severity vulnerabilities are tracked as CVE-2025-12428 and CVE-2025-12429; CVE-2025-12428 is a type Confusion in V8 reported by…
Security Affairs -
Who is Zico Kolter? A Professor Leads OpenAI Safety Panel With Power to Halt Unsafe AI Releases
According to Associated Press, Zico Kolter, a professor who directs Carnegie Mellon University’s machine learning department, leads a four‑person OpenAI safety panel with the authority to halt the release of new AI systems if they are deemed unsafe. The…
SecurityWeek -
Android Apps misusing NFC and HCE to steal payment data on the rise
Zimperium zLabs researchers have found more than 760 Android apps that misuse NFC and HCE to steal payment data, signalling a rapid rise in NFC relay fraud since April 2024. These malicious apps target banks, payment services and government portals…
Security Affairs -
Hackers Actively Scanning TCP Ports 8530/8531 for WSUS CVE-2025-59287
Security researchers at the SANS Internet Storm Center have detected a significant spike in suspicious network traffic targeting Windows Server Update Services (WSUS) infrastructure worldwide. The reconnaissance activity focuses specifically on TCP ports…
gbhackers.com -
Let's Get Physical: A New Convergence for Electrical Grid Security
US energy regulators and analysts are urging grid operators to unify cybersecurity with physical security, stressing that IT, OT and physical safeguards must converge to defend critical infrastructure. The piece notes rising cyber and physical threats to the…
Dark Reading -
Malwarebytes aces PCMag Readers’ Choice Awards and AVLab Cybersecurity Foundation tests
Malwarebytes has topped three categories in PCMag’s 2025 Readers’ Choice Awards, recognised for exceptional protection and user satisfaction. The company also earned AVLab Cybersecurity Foundation’s badge in September’s “Advanced In-The-Wild Malware Test” by…
Malwarebytes -
Beating XLoader at Speed: Generative AI as a Force Multiplier for Reverse Engineering
Check Point Research sets out how Generative AI can act as a force multiplier for reverse engineering XLoader, a malware family known for multi-layer protections and runtime decryption. The report, dated 3 November 2025, contrasts two AI-assisted workflows:…
Check Point -
Claude AI APIs Can Be Abused for Data Exfiltration
SecurityWeek reports that attackers can use indirect prompt injections to trick Claude into exfiltrating data the model’s users have access to, a claim explained by security researcher Johann Rehberger of Embrace The Red. The attack abuses Claude’s Files…
SecurityWeek -
Canadian woman stuck since 2021 in Mauritius after passport withheld
A Canadian woman has reportedly been stuck in Mauritius since 2021 after her passport was withheld, with the Mauritian authorities citing a five-year-old “computer misuse” charge based on a complaint by her former husband. According to The Globe and Mail,…
DataBreaches -
Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks
According to Proofpoint, bad actors have been targeting trucking and logistics firms to deploy remote monitoring and management (RMM) software for financial gain, with the threat cluster active at least since June 2025 and said to be collaborating with…
The Hacker News -
‘People have had to move house’: Inside the British Library, two years on from devastating cyber attack
Two years after the October 2023 ransomware attack by Rhysida, the British Library remains disrupted, with dozens of services still unavailable and staff reporting a higher workload and ongoing abuse from frustrated users. The incident led to the leakage of…
DataBreaches -
Fresh insights from old data: corroborating reports of Turkmenistan IP unblocking and firewall testing
Fresh insights from old data show Cloudflare Radar detecting a surge of HTTP requests from Turkmenistan in mid-June 2024, aligning with reports of Turkmenistan unblocking over 3 billion previously blocked IP addresses. According to turkmen[.]news, one reason…
Cloudflare -
⚡ Weekly Recap: Lazarus Hits Web3, Intel/AMD TEEs Cracked, Dark Web Leak Tool & More
The weekly recap highlights a TEE[.]Fail side-channel attack that can extract secrets from Intel and AMD DDR5 secure enclaves, bypassing protections in Intel SGX/TDX and AMD SEV-SNP, and notes the attack requires physical access and root-level privileges. It…
The Hacker News -
Cybersecurity M&A Roundup: 45 Deals Announced in October 2025
The Cybersecurity M&A Roundup for October 2025 notes forty-five deals were announced, with a mix of large private equity activity and smaller, high-value tech or talent acquisitions. Highlights include Dataminr’s agreement to acquire ThreatConnect for $290…
SecurityWeek -
Open VSX Registry Responds to Leaked Tokens and Malicious Extension Incident
Open VSX Registry, run by the Open VSX team and the Eclipse Foundation, addressed a significant security incident involving leaked authentication tokens and malicious extensions on their code marketplace, and said the situation is now contained. The tokens…
gbhackers.com -
Critical UniFi OS Flaw Enables Remote Code Execution
Security researchers have uncovered a severe unauthenticated Remote Code Execution vulnerability in Ubiquiti’s UniFi OS, tracked as CVE-2025-52665, which could let attackers gain complete control of UniFi devices without credentials. The flaw originated from…
gbhackers.com -
AI Developed Code: 5 Critical Security Checkpoints for Human Oversight
A Dark Reading analysis argues that five security checkpoints are essential for managing AI-developed code, with human developers playing a regular, hands-on role in the process. Checkpoint 1 calls for code review by security-proficient developers as the…
Dark Reading -
The Evolution of SOC Operations: How Continuous Exposure Management Transforms Security Operations
SOC operations are described as being overwhelmed, with analysts wading through thousands of daily alerts and spending much of their time chasing false positives and manually triaging detections. The piece argues that traditional tools often lack…
The Hacker News -
Researchers Uncover BankBot-YNRK and DeliveryRAT Android Trojans Stealing Financial Data
Cybersecurity researchers have detailed two Android trojans, BankBot-YNRK and DeliveryRAT, capable of harvesting sensitive data from infected devices, according to CYFIRMA. BankBot-YNRK analyses three samples and includes checks for virtualisation, device…
The Hacker News -
New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea
On 3 November 2025, The Hacker News reported that the North Korea-linked threat actor Kimsuky has distributed a backdoor codenamed HttpTroy as part of a spear-phishing campaign targeting a single victim in South Korea. According to Gen Digital, the phishing…
The Hacker News -
Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks
According to Palo Alto Networks, a suspected Chinese state-sponsored threat actor has deployed an AirWatch API-abusing malware family in supply chain attacks, with two variants of a malware dubbed Airstalk seen—one written in PowerShell and the other in…
SecurityWeek -
New BOF Tool Bypasses Microsoft Teams Cookie Encryption to Steal User Chats
Cybersecurity researchers at Tier Zero Security have released a specialised Beacon Object File (BOF) tool that exploits a weakness in Microsoft Teams cookie encryption to steal user chat messages and other sensitive communications. The flaw arises because…
gbhackers.com -
Google Pays $100,000 in Rewards for Two Chrome Vulnerabilities
Google has released Chrome 142 to the stable channel with patches for 20 vulnerabilities, four of which are high-severity in the browser’s V8 JavaScript and WebAssembly engine. Google paid $100,000 in bug bounty rewards for two of these high-severity V8…
SecurityWeek -
A week in security (October 27 – November 2)
A week in security (October 27 – November 2) is a Malwarebytes Labs round-up of recent cybersecurity news and analysis, published on 3 November 2025.
Malwarebytes -
Conti Ransomware Operator Extradited to the United States
A Ukrainian national, Oleksii Oleksiyovych Lytvynenko, 43, has been extradited from Ireland to face charges in the United States after being held by Irish authorities since July 2023. According to The FBI, Lytvynenko conspired with others to deploy Conti…
gbhackers.com -
Conduent January 2025 breach impacts 10M+ people
Conduent disclosed that a January 2025 cyberattack exposed personal data for more than 10 million people, with a government filing later confirming 10,515,849 affected individuals according to the Oregon Department of Justice. The breach involved stolen…
Security Affairs -
Windows 11 24H2/25H2 Flaw Keeps Task Manager Running After You Close It
Microsoft has acknowledged a persistent bug affecting Windows 11 versions 24H2 and 25H2 that prevents Task Manager from properly terminating when users close the application. The issue causes multiple instances of the system monitoring tool to accumulate in…
gbhackers.com -
EDR-Redir V2 Evades Detection on Windows 11 by Faking Program Files
Security researcher TwoSevenOneT has released EDR-Redir V2, an upgraded evasion tool that exploits Windows bind link technology to bypass endpoint detection and response solutions on Windows 11. The new version uses a novel approach by redirecting through…
gbhackers.com -
OpenAI Introduces Aardvark, an AI Security Agent Powered by GPT-5
OpenAI has announced the launch of Aardvark, an autonomous AI security agent powered by GPT-5 that aims to revolutionise how organisations discover and fix software vulnerabilities, with private beta currently available. The system operates as an autonomous…
gbhackers.com -
Proton Warns of 300 Million Stolen Login Details Circulating on Dark Web
Proton has issued a warning that 300 million stolen login credentials are actively circulating on the dark web. Through its Data Breach Observatory initiative, Proton is directly monitoring underground cybercriminal forums to identify and report data leaks…
gbhackers.com
