News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Thu 20 Nov 2025· 60 articles
-
Researchers devised a new enumeration technique that exposed 3.5B WhatsApp profiles
A team of researchers from the University of Vienna disclosed a flaw in WhatsApp that could scrape 3.5 billion accounts, a vulnerability Meta has since patched to block the enumeration technique, according to Meta. The researchers showed that users discover…
Security Affairs -
Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island
Police in Phuket arrested a Russian hacking suspect wanted by the FBI after a tip that the “world-class hacker” was travelling to Thailand, Thai Cyber Crime Investigation Bureau officials said. The 35-year-old entered Thailand on 30 October at Phuket Airport…
SecurityWeek -
Budget Samsung phones shipped with unremovable spyware, say researchers
Budget Samsung phones are alleged to come with unremovable spyware, after a new post accused AppCloud of hidden data gathering on Galaxy A and M series devices. According to SMEX, the software collects biometric data and IP addresses and is deeply integrated…
Malwarebytes -
Chinese APT Infects Routers to Hijack Software Updates
PlushDaemon, a Chinese state-aligned APT, has for years targeted trusted software updates by infecting routers and other edge devices in the path of network traffic. It hijacks update requests, redirects them to PlushDaemon infrastructure, and serves victims…
Dark Reading -
Sturnus: New Android banking trojan targets WhatsApp, Telegram, and Signal
Sturnus is a new Android banking trojan that targets WhatsApp, Telegram and Signal, with its discovery noted in ThreatFabric’s report and dated 20 November 2025. ThreatFabric analysis indicates the malware is still under development or operating in a limited…
Security Affairs -
Xillen Stealer Updates to Version 5 to Evade AI Detection
Darktrace reports that Xillen Stealer has released versions 4 and 5, expanding its cross‑platform infostealer capabilities to target credentials, cryptocurrency wallets, system information and account data from a range of stores, browsers (over 100) and…
darktrace.com -
Same Old Security Problems: Cyber Training Still Fails Miserably
Same Old Security Problems: Cyber Training Still Fails Miserably argues that, despite years of awareness campaigns, password hygiene and phishing remain stubborn issues for organisations worldwide. The piece notes that a Dark Reading poll during…
Dark Reading -
Managing OT remote access with Zero Trust and AI detection
According to Darktrace, the piece argues that managing OT remote access requires a two-pronged approach: precise access controls combined with real-time AI-driven detection, not just visibility. It stresses that Zero Trust access controls—identity-based,…
darktrace.com -
Coordinated sanctions hit Russian bulletproof hosting providers enabling top ransomware Ops
US, Australia and the United Kingdom sanctioned two Russia-based bulletproof hosting providers accused of aiding groups such as LockBit, BlackSuit and Play. Media Land, a St. Petersburg–based BPH service provider, and its sister firm ML Cloud were designated…
Security Affairs -
Mozilla Says It’s Finally Done With Two-Faced Onerep
Mozilla has announced that its partnership with Onerep will officially end next month, with Mozilla saying it will soon discontinue Monitor Plus, which offered data broker site scans and automated personal data removal from Onerep. The wind-down period runs…
Krebs on Security -
ShadowRay 2.0 Exploits Unpatched Ray Flaw to Build Self-Spreading GPU Cryptomining Botnet
ShadowRay 2.0 is described as an evolution of a prior wave that targeted unpatched Ray installations to turn infected GPU clusters into a self-spreading cryptomining botnet. According to the report, the campaign exploits CVE-2023-48022, a critical missing…
The Hacker News -
‘Matrix Push’ C2 Tool Hijacks Browser Notifications for Phishing
Matrix Push is a new, user-friendly C2 tool described as a framework for turning browser notifications into a phishing vector. According to BlackFog, attackers can design notifications that look legitimate but point victims to malicious sites, and from the…
Dark Reading -
Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows
Cybersecurity researchers have warned of an actively expanding Windows botnet named Tsundere, which researchers say relies on game-themed lures to propagate and uses an Ethereum-based C2 to fetch JavaScript code. Active since mid-2025, the malware retrieves…
The Hacker News -
Threat actors have reportedly launched yet another campaign involving an application connected to Salesforce
Salesforce says there was unusual activity involving Gainsight-published applications connected to Salesforce, which could have allowed unauthorized access to customer data through the app’s connection. According to Salesforce, they revoked all active access…
DataBreaches -
What the Flock is happening with license plate readers?
ALPRs, or Automatic License Plate Readers, have moved from novelty to near-ubiquitous presence, with Flock Safety’s systems described as scanning every plate that passes and streaming footage to off-site servers for a growing cloud database. At the time of…
Malwarebytes -
New Sturnus Banking Trojan Targets WhatsApp, Telegram, Signal Messages
A new Android banking trojan named Sturnus is designed to target communications from secure messaging apps such as WhatsApp, Telegram and Signal, according to ThreatFabric. The malware is described as fully functional but still under development, with its…
SecurityWeek -
Doppel Raises $70 Million at $600 Million Valuation
Doppel has raised $70 million in a Series C funding round, bringing its total raised to $124 million and valuing the California-based company at more than $600 million, according to SecurityWeek. The round was led by Bessemer Venture Partners, with…
SecurityWeek -
WhatsApp 'Eternidade' Trojan Self-Propagates Through Brazil
A new Trojan called Eternidade is spreading through Brazil by worming its way across WhatsApp, with a focus on Brazilian Portuguese speakers. According to LevelBlue researchers, they found roughly 10,000 infected systems in the campaign, underscoring how…
Dark Reading -
Beyond the Watering Hole: APT24's Pivot to Multi-Vector Attacks
Written by: Harsh Parashar, Tierra Duncan, Dan Perez Google Threat Intelligence Group (GTIG) is tracking a long-running and adaptive cyber espionage campaign by APT24, a People's Republic of China (PRC)-nexus threat actor. Spanning three years, APT24 has…
Google Cloud -
Holiday scams 2025: These common shopping habits make you the easiest target
Holiday scams 2025 highlights how modern shopping habits — fast, mobile and data-for-deals — leave buyers vulnerable during deal-heavy periods such as Black Friday and Cyber Monday. The report notes that nearly 9 in 10 mobile consumers hand over emails or…
Malwarebytes -
Gmail can read your emails and attachments to train its AI, unless you opt out
Gmail can read your emails and attachments to train its AI, unless you opt out, a change quietly rolled out by Google that Malwarebytes highlights in its November 2025 coverage. According to Malwarebytes, Google has reportedly started auto-enrolling users to…
Malwarebytes -
Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’
A Chinese state-sponsored threat actor is alleged to have compromised tens of thousands of Asus routers to establish a persistent network in support of global espionage campaigns, according to SecurityWeek’s reporting. The infections are linked to an…
SecurityWeek -
Russian hackers target IVF clinics across UK used by thousands of couples
Russian hackers targeted IVF clinics across the UK that are used by thousands of couples, with the London Women’s Clinic confirming a breach carried out by the ransomware gang Qilin. The clinic, which offers IVF, egg freezing and other fertility treatments…
DataBreaches -
US and Allies Sanction Russian Bulletproof Hosting Service Providers
The US, Australia, and the UK announced sanctions against two Russian bulletproof hosting providers, Media Land and Hypercore Ltd., and their sister entities and leadership, according to SecurityWeek. The US Treasury’s Office of Foreign Assets Control (OFAC)…
SecurityWeek -
ThreatsDay Bulletin: 0-Days, LinkedIn Spies, Crypto Crimes, IoT Flaws and New Malware Waves
ThreatsDay Bulletin highlights a busy week in cyber threats, from espionage warnings to software flaws and crypto crimes. According to MI5, Chinese spies are actively using LinkedIn to recruit and cultivate lawmakers, reaching out at scale via headhunters or…
The Hacker News -
US, allies sanction Russian bulletproof hosting services for ransomware support
According to The Record, the U.S. Treasury and international partners sanctioned Media Land, a popular Russian bulletproof hosting service provider based in St. Petersburg, on Wednesday for its alleged support of ransomware gangs and other cybercriminal…
DataBreaches -
Researchers claim ‘largest leak ever’ after uncovering WhatsApp enumeration flaw
Researchers in Austria used a flaw in WhatsApp to gather the personal data of more than 3.5 billion users, in what they describe as the “largest data leak in history.” The feature allows users to look up others’ details by inputting phone numbers and can be…
DataBreaches -
Vulnerability Allowed Scraping of 3.5 Billion WhatsApp Accounts
Researchers from the University of Vienna disclosed a novel enumeration technique that could scrape 3.5 billion WhatsApp accounts, with WhatsApp owner Meta rolling out mitigations to prevent exploitation, according to Meta. They generated possible phone…
SecurityWeek -
Large medical lab in South Africa suffers multiple data breaches
Lancet Laboratories, a large medical laboratory in South Africa, has suffered multiple data breaches, according to DataBreaches[.]Net. The firm was fined R100,000 for failing to respond to the South African Information Regulator’s demands to address…
DataBreaches -
Inside the dark web job market
A Securelist report published on 20 November 2025 profiles the dark web job market for 2023–2025, drawing on 2,225 job-related posts collected from shadow forums between January 2023 and June 2025. The analysis shows the dark web continuing to function as a…
securelist.com -
CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat
CTM360 has identified a rapidly expanding global WhatsApp account-hijacking campaign, internally dubbed HackOnChat, that targets users worldwide through a network of deceptive authentication portals and impersonation pages. According to CTM360, the operation…
The Hacker News -
Grafana Patches Critical SCIM Flaw (CVE-2025-41115, CVSS 10) Allowing Privilege Escalation and User Impersonation
Grafana has issued emergency security updates for Grafana Enterprise to fix a critical SCIM vulnerability, tracked as CVE-2025-41115 with a maximum CVSS score of 10.0. The flaw arises from how SCIM user identities are processed, allowing a malicious or…
SecurityOnline -
New Sturnus Android Trojan Quietly Captures Encrypted Chats and Hijacks Devices
Cybersecurity researchers have disclosed details of a new Android banking trojan named Sturnus, which can steal credentials and take full control of the device to facilitate financial fraud. A key differentiator cited by ThreatFabric is Sturnus’s ability to…
The Hacker News -
Recent 7-Zip Vulnerability Exploited in Attacks
A SecurityWeek report published on 20 November 2025 details a high‑severity remote code execution vulnerability in 7-Zip, tracked as CVE-2025-11001 (CVSS 7.0) that requires user interaction to be exploited. The flaw affects how 7-Zip handles symbolic links…
SecurityWeek -
Cyber-enabled kinetic targeting: Iran-linked actor uses cyber operations to support physical attacks
Cyber-enabled kinetic targeting is the term used to describe how cyber operations are increasingly planned to support real-world military actions, a trend highlighted by Amazon threat intel teams. Iran-linked threat actors run campaigns that blend cyber…
Security Affairs -
Blockchain and Node.js abused by Tsundere: an emerging botnet
According to Securelist, the Tsundere botnet is a Node[.]js-based threat that uses the Ethereum blockchain to host its command-and-control details, including a wallet and a contract address. The researchers note two fixed on-chain references: Wallet…
securelist.com -
3.5 Billion WhatsApp Accounts Identified Through Enumeration
According to the University of Vienna and SBA Research, a recent study examined how WhatsApp users can be identified even though end-to-end encryption is in place. The researchers tested more than 63 billion potential phone numbers across 245 countries and…
SOCRadar -
NVIDIA Crushes AI Bubble Fears with Record $57B Revenue
According to Jensen Huang, founder and CEO of NVIDIA, Blackwell sales are off the charts and cloud GPUs are sold out, with compute demand accelerating across training and inference. NVIDIA has released its financial report for the third quarter of fiscal…
SecurityOnline -
OpenAI Launches FREE, FERPA-Compliant ChatGPT for K–12 Teachers Until 2027
OpenAI has announced ChatGPT for Teachers, a FERPA-compliant, AI-powered service designed for educators, with a first rollout in the United States offering free access through June 2027. According to OpenAI, the platform features heightened security,…
SecurityOnline -
$31.2 Billion Raised: Google Accelerator Reveals Massive Global Impact Report
Google has released the second edition of its Accelerator Impact Report, reviewing the outcomes of its global startup accelerator programmes since their launch in 2016. Over the past nine years, the programme has provided technical support and resources to…
SecurityOnline
