News

Tue 23 Dec 2025· 51 articles

1. 00:50

   Critical Unauthenticated MongoDB Flaw Leaks Sensitive Data via zlib Compression

   A critical unauthenticated vulnerability in MongoDB, tracked as CVE-2025-14847, allows attackers to siphon sensitive data from the server’s memory without logging in, according to the advisory. With a CVSSv4 score of 8.7, the flaw is rated High Severity and…

   SecurityOnline
   
2. 00:46

   The 3-Million Email Siege: Inside Scripted Sparrow’s Global Industrialized BEC Machine

   A new report by Fortra Intelligence and Research Experts (FIRE) has unmasked Scripted Sparrow, a massively automated, globally distributed Business Email Compromise (BEC) collective that targets corporate finance departments. Researchers say the group “sends…

   SecurityOnlineScripted Sparrow
   
3. 00:43

   A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit

   Three of the ransomware world’s most notorious groups—Qilin, DragonForce, and the once-dominant LockBit—have reportedly formed a “cartel” in a September 2025 announcement, with DragonForce posting on a Russian underground forum. According to Yarix…

   SecurityOnlineDragonForce
   
4. 00:38

   Iranian “Prince of Persia” APT Resurfaces with Telegram-Controlled Stealth Malware

   According to SafeBreach Labs, the Iranian “Prince of Persia” APT—also known as Infy—has resurfaced after years of silence with a revamped toolkit and new command-and-control methods targeting Iran and Europe. The group’s latest effort centres on Telegram as…

   SecurityOnlineInfy
   
5. 00:32

   “Purchase Order” Deception: Sophisticated Loader Targets Manufacturing Giants in Italy, Finland, and Saudi Arabia

   A CRIL report describes a highly sophisticated cyber-espionage campaign that targets the manufacturing and government sectors across Europe and the Middle East, using a “Swiss Army Knife” style loader to deploy a range of remote access trojans. The campaign…

   SecurityOnline
   
6. 00:26

   Identity Theft in M-Files: High-Severity Flaw Lets Insiders Hijack User Accounts and Access Sensitive Data

   According to product.m-files[.]com/security-advisories/cve-2025-13008/, M-Files faces two vulnerabilities, the most severe of which could allow a malicious insider to silently steal colleagues’ digital identities and gain full access to sensitive data under…

   SecurityOnline
   
7. 00:21

   “React2Shell” Exploited: New EtherRAT Malware Hunts for Crypto via Node.js

   According to ASEC researchers, a new malware campaign is exploiting a recently disclosed vulnerability to install cryptocurrency-stealing software on servers, using a multi-stage EtherRAT that leverages the React2Shell flaw. The attack uses legitimate…

   SecurityOnline
   
8. 00:18

   AI-Generated Decoys & XLL Stealth: Inside the New “EchoGather” Cyber Espionage Campaign

   A cyber-espionage group known for hunting Russian organisations has upgraded its arsenal, deploying malicious Excel add-ins to slip past defenses and install a new backdoor. A new report from Intezer reveals that the Paper Werewolf group (also known as…

   SecurityOnline
   
9. 00:11

   Wonderland Unleashed: New Android “Dropper” Malware Hijacks Telegram to Drain Bank Accounts

   On 23 December 2025, a new Android “dropper” malware family dubbed Wonderland was highlighted by Group-IB as a significant evolution in how attackers target Android users in Uzbekistan. The researchers describe a shift from plain trojans to sophisticated…

   SecurityOnline
   
10. 00:06

    Zero-Day Alert: Linksys Auth Bypass Lets Hackers Hijack Routers Without Passwords

    According to CSIT, a zero-day vulnerability in the Linksys E9450-SG router, tracked as CVE-2025-52692, allows attackers on the local network to bypass authentication and enable the device’s Telnet server with no password required. The flaw stems from how the…

    SecurityOnline
    
11. 00:01

    The Payroll Trap: New Quishing Campaign Uses Fake CAPTCHAs to Hijack Employee Paychecks

    A sophisticated new phishing campaign is targeting employees’ paychecks by using QR codes to bypass corporate defences, according to a CYFIRMA analysis released on 23 December 2025. The operation, described as a highly targeted “quishing” campaign, uses fake…

    SecurityOnline