News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 13 so far |
Thu 13 Nov 2025· 78 articles
-
Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data
A Russian-speaking threat actor behind a mass phishing campaign has registered more than 4,300 domain names since the start of the year, aimed at hotel guests and travel bookings. According to Netcraft, there are 4,344 domains tied to the attack, with 685…
The Hacker News -
Inside the Great Firewall Part 3: Geopolitical and Societal Ramifications
The Great Firewall is presented as geopolitical infrastructure far beyond a technical barrier, serving China’s state-led governance model by intertwining digital control with national sovereignty and policy. According to the article, it locks in domestic…
dti.domaintools.com -
Chrome extension “Safery” steals Ethereum wallet seed phrases
The malicious Chrome extension “Safery: Ethereum Wallet” was discovered by Socket’s Threat Research Team, posing as a legitimate crypto wallet but designed to steal seed phrases. It was uploaded to the Chrome Web Store on 29 September 2025, with the last…
Security Affairs -
[Dark Reading Virtual Event] Cybersecurity Outlook 2026
Dark Reading is hosting a full-day virtual event titled Cybersecurity Outlook 2026 on 3 December 2025, focusing on the latest threats from cybercriminals and nation-states alongside evolving technologies that may mitigate them. According to the event blurb,…
Dark Reading -
Orgs Move to SSO, Passkeys to Solve Bad Password Habits
In 2025, organisations are increasingly pushing passwordless authentication after recognising that weak passwords persist and that forcing complex ones is largely impractical. According to Portnox, 92% of CISOs surveyed indicated they are implementing…
Dark Reading -
TAG Bulletin: Q3 2025
According to Threat Analysis Group, the Q3 2025 bulletin documents coordinated influence operation campaigns terminated on their platforms during July, August and September. In July, a series of removals included 5 YouTube channels linked to Russia, then 382…
blog.google -
ChatGPT Vulnerability Exposed Underlying Cloud Infrastructure
A SecurityWeek report details a recently patched ChatGPT vulnerability that could have exposed the AI chatbot’s underlying cloud infrastructure through an SSRF flaw in custom GPTs. The researcher, Jacob Krut, a bug bounty hunter and security engineer at Open…
SecurityWeek -
A new round of Europol’s Operation Endgame dismantled Rhadamanthys, Venom RAT, and Elysium botnet
A new round of Europol’s Operation Endgame dismantled Rhadamanthys, Venom RAT, and the Elysium botnet, with the coordinated action running from 10 to 13 November 2025. According to Europol’s press release, the operation disrupted malware infrastructure…
Security Affairs -
1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium
SecurityWeek reports that a major international law enforcement operation dubbed Operation Endgame 3.0 disrupted or takedown more than 1,000 servers worldwide and seized 20 domains in a bid to tackle Rhadamanthys, VenomRAT and the Elysium botnet. An…
SecurityWeek -
CISA Updates Guidance on Patching Cisco Devices Targeted in China-Linked Attacks
CISA has issued updated guidance on patching Cisco Secure Firewall ASA and Firepower devices exploited in the China-linked ArcaneDoor espionage campaign, noting that the two bugs, CVE-2025-20333 and CVE-2025-20362, were discovered in May after being…
SecurityWeek -
Google Sues to Disrupt Chinese SMS Phishing Triad
Google has filed suit in the Southern District of New York on 12 November 2025 to unmask and disrupt 25 “John Doe” defendants linked to Lighthouse, a sophisticated China-based phishing kit used to impersonate brands and convert phished card data into mobile…
Krebs on Security -
1 million victims, 17,500 fake sites: Google takes on toll-fee scammers
Google’s lawsuit targets a China-based Phishing-as-a-Service platform known as “Lighthouse,” which enables smishing campaigns that lure US targets with texts about small toll fees. The texts lead to websites that impersonate toll authorities or other trusted…
Malwarebytes -
The State of Ransomware – Q3 2025
The Q3 2025 ransomware landscape saw fragmentation reach new extremes, with more than 85 active data leak sites listed across the quarter and 1,592 new victims published, up from 1,607 in Q2 2025 and well above the 1,270 victims in Q3 2024. Check Point…
Check Point -
Phishing Emails Alert: How Spam Filters Can Steal Your Email Logins in an Instant
Cybercriminals are exploiting trust in internal security systems by spoofing email delivery notifications to resemble legitimate spam-filter alerts, aimed at stealing login credentials that could access email accounts, cloud storage and other sensitive…
gbhackers.com -
Malicious npm Package with 206K Downloads Targeting GitHub Repositories to Steal Tokens
A malicious npm package named “@acitons/artifact” amassed over 206,000 downloads before being removed, in a campaign aimed at GitHub repositories to steal authentication tokens. The package impersonated the legitimate “@actions/artifact” package by swapping…
gbhackers.com -
Webinar Today: The Future of Industrial Network Security
According to SecurityWeek News, webinar speakers from Cisco will outline steps industrial organisations can take to safeguard operations, achieve compliance, and enable sustainable growth, as part of The Future of Industrial Network Security. The event…
SecurityWeek -
Coyote, Maverick Banking Trojans Run Rampant in Brazil
Several security researchers have tied multiple banking Trojans, including Coyote and Maverick, to campaigns targeting Brazilian citizens this year, with CyberProof noting several waves of activity focused on WhatsApp users. According to Sophos Counter…
Dark Reading -
Time Travel Triage: An Introduction to Time Travel Debugging using a .NET Process Hollowing Case Study
Written by: Josh Stroschein, Jae Young Kim The prevalence of obfuscation and multi-stage layering in today’s malware often forces analysts into tedious and manual debugging sessions. For instance, the primary challenge of analyzing pervasive commodity…
Google Cloud -
SmartApeSG Uses ClickFix to Deploy NetSupport RAT
The article discusses the SmartApeSG campaign, also known as ZPHP and HANEYMANEY, which has evolved its tactics to deploy the NetSupport RAT (Remote Access Trojan) using ClickFix-style attack vectors. Initially identified in June 2024, the campaign now…
gbhackers.com -
Threat Actors Use JSON Storage for Hosting and Delivering Malware via Trojanized Code
A sophisticated campaign dubbed Contagious Interview is attributed to North Korean-aligned threat actors, who are weaponising legitimate JSON storage services to deliver malware to software developers worldwide. The operation has been active since at least…
gbhackers.com -
Hackers Infiltrate npm Registry with 43,000 Spam Packages, Linger for Nearly Two Years
Security researchers have uncovered a massive spam campaign aimed at the npm ecosystem, dubbed the IndonesianFoods worm, which comprises over 43,000 malicious packages published across at least 11 user accounts and remained active for nearly two years. The…
gbhackers.com -
Tens of Thousands of Malicious NPM Packages Distribute Self-Replicating Worm
Security researchers warn that tens of thousands of malicious NPM packages have been published containing a self-replicating worm. According to SourceCodeRed, the activity is likely orchestrated by an Indonesian threat actor, and they identified over 43,900…
SecurityWeek -
OpenAI Sora 2 Vulnerability Allows Exposure of Hidden System Prompts from Audio Data
Security researchers have demonstrated a cross‑modal vulnerability in OpenAI’s Sora 2 video generation model, showing that hidden system prompts can be exposed from audio data. The researchers found that by chaining cross‑modal prompts and careful framing,…
gbhackers.com -
Fake Chrome Extension “Safery” Steals Ethereum Wallet Seed Phrases Using Sui Blockchain
A malicious Chrome extension named “Safery: Ethereum Wallet” has been identified as a front for stealing users’ seed phrases by encoding them into fake Sui addresses and sending micro-transactions to attacker‑controlled wallets. The extension was uploaded to…
The Hacker News -
NHS Investigating Oracle EBS Hack Claims as Hackers Name Over 40 Alleged Victims
According to NHS England, the United Kingdom’s national health service is listed as a victim of the Oracle E-Business Suite data theft and extortion campaign and is cooperating with the National Cyber Security Centre to investigate. The campaign, which began…
SecurityWeek -
Are you paying more than other people? NY cracks down on surveillance pricing
New York is tightening rules on what has been called surveillance pricing, with the state beginning to enforce the Algorithmic Pricing Disclosure Act this week. The law requires businesses to disclose when they set prices using customer data and to display…
Malwarebytes -
Critical WatchGuard Firebox Vulnerability Exploited in Attacks
According to CISA, a recent critical vulnerability in WatchGuard Firebox firewalls has been exploited in the wild. Tracked as CVE-2025-9242 (CVSS 9.3), the out-of-bounds write flaw in the Fireware OS enables unauthenticated remote code execution and affects…
SecurityWeek -
CISA Warns of Active Exploitation of Windows Kernel 0-Day Enabling Privilege Escalation
CISA warns of active exploitation of a zero-day vulnerability in Microsoft Windows tracked as CVE-2025-62215, which affects the Windows Kernel and could allow a local attacker to escalate to SYSTEM-level privileges. According to CISA, the flaw is a race…
gbhackers.com -
BreachLock and Vanta Bridge the Gap Between Continuous Security Testing and Compliance with New Integration
BreachLock and Vanta have announced a new integration that links continuous security testing with automated compliance workflows. According to CyberNewswire, the partnership connects the BreachLock Unified Platform to a Vanta environment, enabling mutual…
gbhackers.com -
District of Massachusetts Allows Higher-Ed Student Data Breach Claims to Survive
According to The National Law Review, on 5 September 2025 Judge Angel Kelley of the U.S. District Court for the District of Massachusetts issued a mixed ruling on a motion to dismiss in Shea v. American International College, shaping the standing and…
DataBreaches -
End of the game for cybercrime infrastructure: 1025 servers taken down
According to Europol, between 10 and 14 November 2025 the latest phase of Operation Endgame was coordinated from The Hague, targeting Rhadamanthys infostealer, VenomRAT and the Elysium botnet, with actions that dismantled a major cybercrime infrastructure…
DataBreaches -
When Attacks Come Faster Than Patches: Why 2026 Will be the Year of Machine-Speed Security
13 November 2025 marks The Hacker News’ warning that 2026 may be the year of machine-speed security, as attackers increasingly run automated, AI-assisted processes that outpace human-led patching. The article cites industry reports suggesting roughly 50 to…
The Hacker News -
U.S. CISA adds WatchGuard Firebox, Microsoft Windows, and Gladinet Triofox flaws to its Known Exploited Vulnerabilities catalog
According to U.S. Cybersecurity and Infrastructure Security Agency (CISA), WatchGuard Firebox, Microsoft Windows, and Gladinet Triofox flaws have been added to the Known Exploited Vulnerabilities catalog. The entries include CVE-2025-9242 for WatchGuard…
Security Affairs -
Synnovis Confirms Patient Information Stolen in Disruptive Ransomware Attack
Synnovis has confirmed that patient personal information was stolen in a ransomware attack that disrupted operations at several London hospitals. The attack occurred on 3 June 2024 and affected all IT systems, forcing hospitals to cancel operations. On 20…
SecurityWeek -
Operation Endgame Dismantles Rhadamanthys, Venom RAT, and Elysium Botnet in Global Crackdown
Operation Endgame has dismantled Rhadamanthys Stealer, Venom RAT, and the Elysium botnet in a global crackdown led by Europol and Eurojust. The activity runs from 10 to 13 November 2025, as part of the ongoing Operation Endgame to take down criminal…
The Hacker News -
Operation Endgame: Authorities Takedown 1,025 Servers Linked to Rhadamanthys, VenomRAT, and Elysium
Between 10 and 14 November 2025, law enforcement agencies carried out a coordinated operation from Europol’s headquarters in The Hague that dismantled three major cybercrime threats: Rhadamanthys infostealer, VenomRAT, and the Elysium botnet. According to…
gbhackers.com -
How Private AI Compute Is Redefining the Future of Secure Intelligent Computing
Google’s Private AI Compute is a cloud-based AI processing architecture designed to offer Gemini-level reasoning, speed, and intelligence without compromising user privacy. It operates as a fortified, hardware-secured environment that isolates user data…
SOCRadar -
We opened a fake invoice and fell down a retro XWorm-shaped wormhole
According to Malwarebytes, a forwarded “invoice” email with a .vbs attachment would have silently installed a remote-access Trojan known as Backdoor[.]XWorm, enabling attackers to steal data, record keystrokes, spy on the user and even install ransomware.…
Malwarebytes -
ThreatsDay Bulletin: Cisco 0-Days, AI Bug Bounties, Crypto Heists, State-Linked Leaks and 20 More Stories
ThreatsDay Bulletin reviews a busy week of security developments, from government actions to new vulnerabilities and threat activity. According to CISA, the agency issued an Emergency Directive (25-03) flagging Cisco ASA and Firepower devices that were…
The Hacker News -
Kibana Vulnerabilities Expose Systems to SSRF and XSS Attacks
Elastic has released a security advisory about an origin validation error in Kibana that could expose systems to SSRF attacks, tracked as CVE-2025-37734. The vulnerability affects Kibana 8.12.0–8.19.6, 9.1.0–9.1.6, and 9.2.0, and is tied to the Observability…
gbhackers.com
