News

Mon 24 Nov 2025· 55 articles

1. 02:14

   Tim Cook Stepping Down Next Year? Rumors Firmly Dismissed by Mark Gurman

   Tim Cook Stepping Down Next Year? Rumors Firmly Dismissed by Mark Gurman, 24 November 2025, reports that Apple CEO Tim Cook could step down as early as next year have been firmly dismissed. According to The Financial Times, succession planning had…

   SecurityOnline
   
2. 02:09

   DOJ vs. Google: Ad-Tech Antitrust Battle Enters Final Stage with Quick Ruling Expected

   The DOJ and Google are in the final stage of their ad-tech antitrust battle, with closing arguments delivered this week and a ruling expected quickly. Judge Leonie Brinkema of the U.S. District Court signalled an intention to issue a ruling soon, potentially…

   SecurityOnline
   
3. 01:52

   Code Injection Flaws Threaten NVIDIA’s Isaac-GROOT Robotics Platform

   NVIDIA has issued a security update to address two high-severity vulnerabilities in its Isaac-GROOT robotics software, an open foundation model for humanoid robot reasoning and skills. The flaws, tracked as CVE-2025-33183 and CVE-2025-33184, originate in a…

   SecurityOnline
   
4. 00:42

   TamperedChef Malvertising Uses US Shell Companies to Sign Trojanized Apps with Valid Certificates, Deploying Stealth Backdoor

   Acronis’ Threat Research Unit (TRU) has uncovered a global malvertising and SEO-poisoning campaign, dubbed TamperedChef, that distributes fully functional but trojanized applications signed with certificates purchased through U.S.-based shell companies. Once…

   SecurityOnline
   
5. 00:40

   vLLM Flaw (CVE-2025-62164) Risks Remote Code Execution via Malicious Prompt Embeddings

   SecurityOnline[.]info reports a high-severity vulnerability in vLLM, tracked as CVE-2025-62164, which could allow remote code execution via malicious prompt embeddings. The flaw affects vLLM versions 0.10.2 and later and is rated CVSS 8.8, potentially…

   SecurityOnline
   
6. 00:36

   China’s APT24 Launches Stealth BADAUDIO Malware, Hitting 1,000+ Domains via Taiwanese Supply Chain Hack

   According to Google’s Threat Intelligence Group, a long-running and adaptive cyber-espionage campaign attributed to APT24 has centred on the BADAUDIO malware, a heavily obfuscated first-stage downloader designed to establish persistent access in targeted…

   SecurityOnlineAPT24
   
7. 00:33

   Sophisticated WhatsApp Worm Uses Fake “View Once” Lure to Hijack Sessions and Deploy Astaroth Banking Trojan

   Sophos analysts are tracking a persistent, fast-evolving malware campaign targeting WhatsApp users in Brazil, which uses fake “View Once” messages, malicious archive attachments, hijacked WhatsApp Web sessions, and the Astaroth (Guildma) banking trojan.…

   SecurityOnline
   
8. 00:29

   CERT/CC Warns of Unpatched Root-Level Command Injection Flaws in Tenda 4G03 Pro and N300 Routers (CVE-2025-13207, CVE-2024-24481)

   CERT/CC has issued a warning about multiple unpatched command injection flaws in Tenda’s 4G03 Pro and N300 series routers, which allow attackers to execute arbitrary commands as root and left users exposed to full device compromise with no vendor-supplied…

   SecurityOnline
   
9. 00:26

   Next-Gen Threat: Xillen Stealer v4 Targets 100+ Browsers/70+ Wallets with Polymorphic Evasion and DevOps Theft

   Darktrace notes that Xillen Stealer v4/v5 significantly broadens its targets, claiming to steal from 100+ browsers and 70+ cryptocurrency wallets, along with passwords managers, developer environments, cloud credentials, containers and DevOps systems, and…

   SecurityOnline
   
10. 00:22

    Critical ABB Flaw (CVE-2025-10571, CVSS 9.6) Allows Unauthenticated RCE and Admin Takeover on Edgenius

    ABB has issued an urgent advisory for a critical authentication bypass in the ABB Ability Edgenius Management Portal, tracked as CVE-2025-10571 with a CVSS v3.1 Base Score of 9.6, affecting versions 3.2.0[.]0 and 3.2.1[.]1. The flaw allows an unauthenticated…

    SecurityOnline
    
11. 00:19

    Tsundere Botnet Uncovered: Node.js Malware Uses Ethereum Smart Contract for Unkillable C2 and Runs Cybercrime Marketplace

    Kaspersky’s Global Research & Analysis Team (GReAT) has identified a fast-growing botnet called Tsundere that blends Node[.]js implants, blockchain-based C2 retrieval, fake game installers, and a cybercrime marketplace. The group reportedly first appeared in…

    SecurityOnline
    
12. 00:15

    PyPI Typosquat Delivers Multi-Layer Python RAT, Bypassing Scanners with XOR Encryption

    A malicious Python package named spellcheckers has been uploaded to PyPI, impersonating the widely used pyspellchecker library, and has already been downloaded more than 950 times. HelixGuard describes a multi-layer encrypted backdoor hidden inside the…

    SecurityOnline
    
13. 00:11

    Critical Markdown to PDF Flaw (CVE-2025-65108, CVSS 10.0) Allows RCE via JS Injection in Markdown Front-Matter

    A critical vulnerability (CVE-2025-65108, CVSS 10.0) in the Markdown to PDF npm package allows remote code execution via JavaScript injection in Markdown front-matter. The flaw arises from how the md-to-pdf tool uses the gray-matter library to parse…

    SecurityOnline
    
14. 00:05

    Eternidade Stealer: New Python WhatsApp Worm Uses IMAP Email for Covert C2 and Brazilian Bank Overlays

    Trustwave SpiderLabs researchers have identified a new banking Trojan called Eternidade Stealer, distributed as a WhatsApp-worm written in Python that hijacks WhatsApp, steals contact lists, and delivers banking overlays. The campaign uses an IMAP-based C2…

    SecurityOnline
    
15. 00:01

    Extreme Stealth: Python Malware Hides Inside PNG-Disguised RAR, Injects Payload into cvtres.exe

    Researchers at K7 Labs have disclosed a highly obfuscated Python-based malware campaign that uses multi-layer encoding, masquerading as a PNG but actually containing a disguised RAR archive to deliver its payload, aiming to establish persistent C2…

    SecurityOnline