Tag: Cyber Threats

Dec 16, 2025Ravie LakshmananNetwork Security / Vulnerability

Threat actors have begun to exploit two newly disclosed security flaws in Fortinet FortiGate devices, less than a week after public disclosure.

Cybersecurity company Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on FortiGate appliances on December 12, 2025. The attacks exploit two critical authentication bypasses (CVE-2025-59718 and CVE-2025-59719, CVSS scores: 9.8). Patches for the flaws were released by Fortinet last week for FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager.

“These vulnerabilities allow unauthenticated bypass of SSO login authentication via crafted SAML messages, if the FortiCloud SSO feature is enabled on affected devices,” Arctic Wolf Labs said in a new bulletin.

It’s worth noting that while FortiCloud SSO is disabled by default, it is automatically enabled during FortiCare registration unless administrators explicitly turn it off using the “Allow administrative login using FortiCloud SSO” setting in the registration page.

In the malicious activity observed by Arctic Wolf, IP addresses associated with a limited set of hosting providers, such as The Constant Company llc, Bl Networks, and Kaopu Cloud Hk Limited, were used to carry out malicious SSO logins against the “admin” account.

Following the logins, the attackers have been found to export device configurations via the GUI to the same IP addresses.

In light of ongoing exploitation activity, organizations are advised to apply the patches as soon as possible. As mitigations, it’s essential to disable FortiCloud SSO until the instances are updated to the latest version and limit access to management interfaces of firewalls and VPNs to trusted internal users.

“Although credentials are typically hashed in network appliance configurations, threat actors are known to crack hashes offline, especially if credentials are weak and susceptible to dictionary attacks,” Arctic Wolf said.

Fortinet customers who find indicators of compromise (IoCs) consistent with the campaign are recommended to assume compromise and reset hashed firewall credentials stored in the exfiltrated configurations.

Dec 16, 2025Ravie LakshmananCloud Security / Vulnerability

Amazon’s threat intelligence team has disclosed details of a “years-long” Russian state-sponsored campaign that targeted Western critical infrastructure between 2021 and 2025.

Targets of the campaign included energy sector organizations across Western nations, critical infrastructure providers in North America and Europe, and entities with cloud-hosted network infrastructure. The activity has been attributed with high confidence to Russia’s Main Intelligence Directorate (GRU), citing infrastructure overlaps with APT44, which is also known as FROZENBARENTS, Sandworm, Seashell Blizzard, and Voodoo Bear.

The activity is notable for using as initial access vectors misconfigured customer network edge devices with exposed management interfaces, as N-day and zero-day vulnerability exploitation activity declined over the time period – indicative of a shift in attacks aimed at critical infrastructure, the tech giant said.

“This tactical adaptation enables the same operational outcomes, credential harvesting, and lateral movement into victim organizations’ online services and infrastructure, while reducing the actor’s exposure and resource expenditure,” CJ Moses, Chief Information Security Officer (CISO) of Amazon Integrated Security, said.

The attacks have been found to leverage the following vulnerabilities and tactics over the course of five years –

• 2021-2022 – Exploitation of WatchGuard Firebox and XTM flaw (CVE-2022-26318) and targeting of misconfigured edge network devices
• 2022-2023 – Exploitation of Atlassian Confluence flaws (CVE-2021-26084 and CVE-2023-22518) and continued targeting of misconfigured edge network devices
• 2024 – Exploitation of Veeam flaw (CVE-2023-27532) and continued targeting of misconfigured edge network devices
• 2025 – Sustained targeting of misconfigured edge network devices

The intrusion activity, per Amazon, singled out enterprise routers and routing infrastructure, VPN concentrators and remote access gateways, network management appliances, collaboration and wiki platforms, and cloud-based project management systems.

These efforts are likely designed to facilitate credential harvesting at scale, given the threat actor’s ability to position themselves strategically on the network edge to intercept sensitive information in transit. Telemetry data has also uncovered what has been described as coordinated attempts aimed at misconfigured customer network edge devices hosted on Amazon Web Services (AWS) infrastructure.

“Network connection analysis shows actor-controlled IP addresses establishing persistent connections to compromised EC2 instances operating customers’ network appliance software,” Moses said. “Analysis revealed persistent connections consistent with interactive access and data retrieval across multiple affected instances.”

In addition, Amazon said it observed credential replay attacks against victim organizations’ online services as part of attempts to obtain a deeper foothold into targeted networks. Although these attempts are assessed to be unsuccessful, they lend weight to the aforementioned hypothesis that the adversary is grabbing credentials from compromised customer network infrastructure for follow-on attacks.

The entire attack plays out as follows –

• Compromise the customer network edge device hosted on AWS
• Leverage native packet capture capability
• Gather credentials from intercepted traffic
• Replay credentials against the victim organizations’ online services and infrastructure
• Establish persistent access for lateral movement

The credential replay operations have targeted energy, technology/cloud services, and telecom service providers across North America, Western and Eastern Europe, and the Middle East.

“The targeting demonstrates sustained focus on the energy sector supply chain, including both direct operators and third-party service providers with access to critical infrastructure networks,” Moses noted.

Interestingly, the intrusion set also shares infrastructure overlaps (91.99.25[.]54) with another cluster tracked by Bitdefender under the name Curly COMrades, which is believed to be operating with interests that are aligned with Russia since late 2023. This has raised the possibility that the two clusters may represent complementary operations within a broader campaign undertaken by GRU.

“This potential operational division, where one cluster focuses on network access and initial compromise while another handles host-based persistence and evasion, aligns with GRU operational patterns of specialized subclusters supporting broader campaign objectives,” Moses said.

Amazon said it identified and notified affected customers, as well as disrupted active threat actor operations targeting its cloud services. Organizations are recommended to audit all network edge devices for unexpected packet capture utilities, implement strong authentication, monitor for authentication attempts from unexpected geographic locations, and keep tabs on credential replay attacks.

Dec 16, 2025Ravie LakshmananCybersecurity / Cryptocurrency

Cybersecurity researchers have discovered a new malicious NuGet package that typosquats and impersonates the popular .NET tracing library and its author to sneak in a cryptocurrency wallet stealer.

The malicious package, named “Tracer.Fody.NLog,” remained on the repository for nearly six years. It was published by a user named “csnemess” on February 26, 2020. It masquerades as “Tracer.Fody,” which is maintained by “csnemes.” The package continues to remain available as of writing, and has been downloaded at least 2,000 times, out of which 19 took place over the last six weeks for version 3.2.4.

“It presents itself as a standard .NET tracing integration but in reality functions as a cryptocurrency wallet stealer,” Socket security researcher Kirill Boychenko said. “Inside the malicious package, the embedded Tracer.Fody.dll scans the default Stratis wallet directory, reads *.wallet.json files, extracts wallet data, and exfiltrates it together with the wallet password to threat actor-controlled infrastructure in Russia at 176.113.82[.]163.”

The software supply chain security company said the threat leveraged a number of tactics that allowed it to elude casual review, including mimicking the legitimate maintainer by using a name that differs by a single letter (“csnemes” vs. “csnemess”), using Cyrillic lookalike characters in the source code, and hiding the malicious routine within a generic helper function (“Guard.NotNull”) that’s used during regular program execution.

Once a project references the malicious package, it activates its behavior by scanning the default Stratis wallet directory on Windows (“%APPDATA%\StratisNode\stratis\StratisMain”), reads *.wallet.json files and in-memory passwords, and exfiltrates them to the Russian-hosted IP address.

“All exceptions are silently caught, so even if the exfiltration fails, the host application continues to run without any visible error while successful calls quietly leak wallet data to the threat actor’s infrastructure,” Boychenko said.

Socket said the same IP address was previously put to use in December 2023 in connection with another NuGet impersonation attack in which the threat actor published a package named “Cleary.AsyncExtensions” under the alias “stevencleary” and incorporated functionality to siphon wallet seed phrases. The package was so-called to disguise itself as the AsyncEx NuGet library.

The findings once illustrate how malicious typosquats mirroring legitimate tools can stealthily operate without attracting any attention across the open-source repository ecosystems.

“Defenders should expect to see similar activity and follow-on implants that extend this pattern,” Socket said. “Likely targets include other logging and tracing integrations, argument validation libraries, and utility packages that are common in .NET projects.”

Dec 16, 2025Ravie LakshmananMalware / Threat Detection

An ongoing campaign has been observed targeting Amazon Web Services (AWS) customers using compromised Identity and Access Management (IAM) credentials to enable cryptocurrency mining.

The activity, first detected by Amazon’s GuardDuty managed threat detection service and its automated security monitoring systems on November 2, 2025, employs never-before-seen persistence techniques to hamper incident response and continue unimpeded, according to a new report shared by the tech giant ahead of publication.

“Operating from an external hosting provider, the threat actor quickly enumerated resources and permissions before deploying crypto mining resources across ECS and EC2,” Amazon said. “Within 10 minutes of the threat actor gaining initial access, crypto miners were operational.”

The multi-stage attack chain essentially begins with the unknown adversary leveraging compromised IAM user credentials with admin-like privileges to initiate a discovery phase designed to probe the environment for EC2 service quotas and test their permissions by invoking the RunInstances API with the “DryRun” flag set.

This enabling of the “DryRun” flag is crucial and intentional as it enables the attackers to validate their IAM permissions without actually launching instances, thereby avoiding racking up costs and minimizing their forensic trail. The end goal of the step is to determine if the target infrastructure is suitable for deploying the miner program.

The infection proceeds to the next stage when the threat actor calls CreateServiceLinkedRole and CreateRole to create IAM roles for autoscaling groups and AWS Lambda, respectively. Once the roles are created, the “AWSLambdaBasicExecutionRole” policy is attached to the Lambda role.

The DockerHub image, which has since been taken down, is configured to run a shell script as soon as it’s deployed to launch cryptocurrency mining using the RandomVIREL mining algorithm. Additionally, the threat actor has been observed creating autoscaling groups that are set to scale from 20 to 999 instances in an effort to exploit EC2 service quotas and maximize resource consumption.

The EC2 activity has targeted both high-performance GPU and machine learning instances and compute, memory, and general-purpose instances.

What makes this campaign stand apart is its use of the ModifyInstanceAttribute action with the “disableApiTermination” parameter set to “True,” which prevents an instance from being terminated using the Amazon EC2 console, command line interface, or API. This, in turn, has the effect of requiring victims to re-enable API termination before deleting the impacted resources.

“Instance termination protection can impair incident response capabilities and disrupt automated remediation controls,” Amazon said. “This technique demonstrates an understanding of common security response procedures and intent to maximize the duration of mining operations.”

This is not the first time the security risk associated with ModifyInstanceAttribute has come to light. In April 2024, security researcher Harsha Koushik demonstrated a proof-of-concept (PoC) that detailed how the action can be abused to take over instances, exfiltrate instance role credentials, and even seize control of the entire AWS account.

Furthermore, the attacks entail the creation of a Lambda function that can be invoked by any principal and an IAM user “user-x1x2x3x4” to which the AWS managed policy “AmazonSESFullAccess” is attached, granting the adversary complete access over the Amazon Simple Email Service (SES) to likely carry out phishing attacks.

To secure against the threat, Amazon is urging AWS customers to follow the steps below –

• Enforce strong identity and access management controls
• Implement temporary credentials instead of long-term access keys
• Use multi-factor authentication (MFA) for all users
• Apply the principle of least privilege (PoLP) to IAM principals to restrict access
• Add container security controls to scan for suspicious images
• Monitor unusual CPU allocation requests in ECS task definitions
• Use AWS CloudTrail to log events across AWS services
• Ensure AWS GuardDuty is enabled to facilitate automated response workflows

“The threat actor’s scripted use of multiple compute services, in combination with emerging persistence techniques, represents a significant advancement in crypto mining attack methodologies.”

Dec 16, 2025Ravie LakshmananDark Web / Online Safety

Google has announced that it’s discontinuing its dark web report tool in February 2026, less than two years after it was launched as a way for users to monitor if their personal information is found on the dark web.

To that end, scans for new dark web breaches will be stopped on January 15, 2026, and the feature will cease to exist effective February 16, 2026.

“While the report offered general information, feedback showed that it didn’t provide helpful next steps,” Google said in a support document. “We’re making this change to instead focus on tools that give you more clear, actionable steps to protect your information online.”

The tech giant said it will delete all data related to dark web report once the feature is retired in February, but noted that users have an option to delete their monitoring profile ahead of time by following the steps below –

• Go to the Dark Web report
• Under “Results with your info,” click Edit monitoring profile
• At the bottom, click “Delete monitoring profile” -> Delete

The dark web report was unveiled by Google in March 2023 to combat online identity fraud stemming from information stolen through data breaches and made available on the dark web. The report was designed to scan the darknet for personal data, such as name, address, email, phone number, and Social Security number, and notify users when it’s found.

In July 2024, Google expanded the offering beyond Google One subscribers to include all account holders.

Google is also urging users to strengthen their account privacy and security by creating a passkey for phishing-resistant multi-factor authentication (MFA) and removing their personal information from Google Search results via Results about you.

The security vulnerability known as React2Shell is being exploited by threat actors to deliver malware families like KSwapDoor and ZnDoor, according to findings from Palo Alto Networks Unit 42 and NTT Security.

“KSwapDoor is a professionally engineered remote access tool designed with stealth in mind,” Justin Moore, senior manager of threat intel research at Palo Alto Networks Unit 42, said in a statement.

“It builds an internal mesh network, allowing compromised servers to talk to each other and evade security blocks. It uses military-grade encryption to hide its communications and, most alarmingly, features a ‘sleeper’ mode that lets attackers bypass firewalls by waking the malware up with a secret, invisible signal.”

The cybersecurity company noted that it was previously mistakenly classified as BPFDoor, adding that the Linux backdoor offers interactive shell, command execution, file operations and lateral movement scanning capabilities. It also impersonates a legitimate Linux kernel swap daemon to evade detection.

In a related development, NTT Security said organizations in Japan are being targeted by cyber attacks exploiting React2Shell to deploy ZnDoor, a malware that’s been assessed to be detected in the wild since December 2023. The attack chains involve running a bash command to fetch the payload from a remote server (45.76.155[.]14) using wget and executing it.

A remote access trojan, it contacts the same threat actor-controlled infrastructure to receive commands and execute them on the host. Some of the supported commands are listed below –

• shell, to execute a command
• interactive_shell, to launch an interactive shell
• explorer, to get a list of directories
• explorer_cat, to read and display a file
• explorer_delete, to delete a file
• explorer_upload, to download a file from the server
• explorer_download, to send files to the server
• system, to gather system information
• change_timefile, to change the timestamp of a file
• socket_quick_startstreams, to start a SOCKS5 proxy
• start_in_port_forward, to start port forwarding
• stop_in_port, to stop port forwarding

The disclosure comes as the vulnerability, tracked as CVE-2025-55182 (CVSS score: 10.0), has been exploited by multiple threat actors, Google identifying at least five China-nexus groups that have weaponized to deliver an array of payloads –

• UNC6600 to deliver a tunneling utility named MINOCAT
• UNC6586 to deliver a downloader named SNOWLIGHT
• UNC6588 to deliver a backdoor named COMPOOD
• UNC6603 to deliver an updated version of a Go backdoor named HISONIC that uses Cloudflare Pages and GitLab to retrieve encrypted configuration and blend in with legitimate network activity
• UNC6595 to deliver a Linux version of ANGRYREBEL (aka Noodle RAT)

Microsoft, in its own advisory for CVE-2025-55182, said threat actors have taken advantage of the flaw to run arbitrary commands for post-exploitation, including setting up reverse shells to known Cobalt Strike servers, and then dropping remote monitoring and management (RMM) tools such as MeshAgent, modifying the authorized_keys file, and enabling root login.

Some of the payloads delivered in these attacks include VShell, EtherRAT, SNOWLIGHT, ShadowPad, and XMRig. The attacks are also characterized by the use of Cloudflare Tunnel endpoints (“*.trycloudflare.com”) to evade security defenses, as well as conducting reconnaissance of the compromised environments to facilitate lateral movement and credential theft.

The credential harvesting activity, the Windows maker said, targeted Azure Instance Metadata Service (IMDS) endpoints for Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and Tencent Cloud with the end goal of acquiring identity tokens to burrow deeper into cloud infrastructures.

“Attackers also deployed secret discovery tools such as TruffleHog and Gitleaks, along with custom scripts to extract several different secrets,” the Microsoft Defender Security Research Team said. “Attempts to harvest AI and cloud-native credentials, such as OpenAI API keys, Databricks tokens, and Kubernetes service‑account credentials, were also observed. Azure Command-Line Interface (CLI) (az) and Azure Developer CLI (azd) were also used to obtain tokens.”

In another campaign detailed by Beelzebub, threat actors have been observed exploiting flaws in Next.js, including CVE-2025-29927 and CVE-2025-66478 (the same React2Shell bug before it was rejected as a duplicate), to enable systematic extraction of credentials and sensitive data –

• .env, .env.local, .env.production, .env.development
• System environment variables (printenv, env)
• SSH keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519, /root/.ssh/*)
• Cloud credentials (~/.aws/credentials, ~/.docker/config.json
• Git credentials (~/.git-credentials, ~/.gitconfig)
• Command history (last 100 commands from ~/.bash_history)
• System files (/etc/shadow, /etc/passwd)

The malware also proceeds to create persistence on the host to survive system reboots, install a SOCKS5 proxy, establish a reverse shell to “67.217.57[.]240:888,” and install a React scanner to probe the internet for further propagation.

The activity, codenamed Operation PCPcat, is estimated to have already breached 59,128 servers. “The campaign shows characteristics of large-scale intelligence operations and data exfiltration on an industrial scale,” the Italian company said.

The Shadowserver Foundation is currently tracking over 111,000 IP addresses vulnerable to React2Shell attacks, with over 77,800 instances in the U.S., followed by Germany (7,500), France (4,000), and India (2,300). Data from GreyNoise shows that there are 547 malicious IP addresses from the U.S., India, the U.K., Singapore, and the Netherlands partaking in the exploitation efforts over the past 24 hours.

Dec 06, 2025Ravie LakshmananAI Security / Vulnerability

Over 30 security vulnerabilities have been disclosed in various artificial intelligence (AI)-powered Integrated Development Environments (IDEs) that combine prompt injection primitives with legitimate features to achieve data exfiltration and remote code execution.

The security shortcomings have been collectively named IDEsaster by security researcher Ari Marzouk (MaccariTA), who discovered them over the last six months. They affect popular IDEs and extensions such as Cursor, Windsurf, Kiro.dev, GitHub Copilot, Zed.dev, Roo Code, Junie, and Cline, among others. Of these, 24 have been assigned CVE identifiers.

“I think the fact that multiple universal attack chains affected each and every AI IDE tested is the most surprising finding of this research,” Marzouk told The Hacker News.

“All AI IDEs (and coding assistants that integrate with them) effectively ignore the base software (IDE) in their threat model. They treat their features as inherently safe because they’ve been there for years. However, once you add AI agents that can act autonomously, the same features can be weaponized into data exfiltration and RCE primitives.”

At its core, these issues chain three different vectors that are common to AI-driven IDEs –

• Bypass a large language model’s (LLM) guardrails to hijack the context and perform the attacker’s bidding (aka prompt injection)
• Perform certain actions without requiring any user interaction via an AI agent’s auto-approved tool calls
• Trigger an IDE’s legitimate features that allow an attacker to break out of the security boundary to leak sensitive data or execute arbitrary commands

The highlighted issues are different from prior attack chains that have leveraged prompt injections in conjunction with vulnerable tools (or abusing legitimate tools to perform read or write actions) to modify an AI agent’s configuration to achieve code execution or other unintended behavior.

What makes IDEsaster notable is that it takes prompt injection primitives and an agent’s tools, using them to activate legitimate features of the IDE to result in information leakage or command execution.

Context hijacking can be pulled off in myriad ways, including through user-added context references that can take the form of pasted URLs or text with hidden characters that are not visible to the human eye, but can be parsed by the LLM. Alternatively, the context can be polluted by using a Model Context Protocol (MCP) server through tool poisoning or rug pulls, or when a legitimate MCP server parses attacker-controlled input from an external source.

• CVE-2025-49150 (Cursor), CVE-2025-53097 (Roo Code), CVE-2025-58335 (JetBrains Junie), GitHub Copilot (no CVE), Kiro.dev (no CVE), and Claude Code (addressed with a security warning) – Using a prompt injection to read a sensitive file using either a legitimate (“read_file”) or vulnerable tool (“search_files” or “search_project”) and writing a JSON file via a legitimate tool (“write_file” or “edit_file)) with a remote JSON schema hosted on an attacker-controlled domain, causing the data to be leaked when the IDE makes a GET request
• CVE-2025-53773 (GitHub Copilot), CVE-2025-54130 (Cursor), CVE-2025-53536 (Roo Code), CVE-2025-55012 (Zed.dev), and Claude Code (addressed with a security warning) – Using a prompt injection to edit IDE settings files (“.vscode/settings.json” or “.idea/workspace.xml”) to achieve code execution by setting “php.validate.executablePath” or “PATH_TO_GIT” to the path of an executable file containing malicious code
• CVE-2025-64660 (GitHub Copilot), CVE-2025-61590 (Cursor), and CVE-2025-58372 (Roo Code) – Using a prompt injection to edit workspace configuration files (*.code-workspace) and override multi-root workspace settings to achieve code execution

It’s worth noting that the last two examples hinge on an AI agent being configured to auto-approve file writes, which subsequently allows an attacker with the ability to influence prompts to cause malicious workspace settings to be written. But given that this behavior is auto-approved by default for in-workspace files, it leads to arbitrary code execution without any user interaction or the need to reopen the workspace.

With prompt injections and jailbreaks acting as the first step for the attack chain, Marzouk offers the following recommendations –

• Only use AI IDEs (and AI agents) with trusted projects and files. Malicious rule files, instructions hidden inside source code or other files (README), and even file names can become prompt injection vectors.
• Only connect to trusted MCP servers and continuously monitor these servers for changes (even a trusted server can be breached). Review and understand the data flow of MCP tools (e.g., a legitimate MCP tool might pull information from attacker controlled source, such as a GitHub PR)
• Manually review sources you add (such as via URLs) for hidden instructions (comments in HTML / css-hidden text / invisible unicode characters, etc.)

Developers of AI agents and AI IDEs are advised to apply the principle of least privilege to LLM tools, minimize prompt injection vectors, harden the system prompt, use sandboxing to run commands, perform security testing for path traversal, information leakage, and command injection.

The disclosure coincides with the discovery of several vulnerabilities in AI coding tools that could have a wide range of impacts –

• A command injection flaw in OpenAI Codex CLI (CVE-2025-61260) that takes advantage of the fact that the program implicitly trusts commands configured via MCP server entries and executes them at startup without seeking a user’s permission. This could lead to arbitrary command execution when a malicious actor can tamper with the repository’s “.env” and “./.codex/config.toml” files.
• An indirect prompt injection in Google Antigravity using a poisoned web source that can be used to manipulate Gemini into harvesting credentials and sensitive code from a user’s IDE and exfiltrating the information using a browser subagent to browse to a malicious site.
• Multiple vulnerabilities in Google Antigravity that could result in data exfiltration and remote command execution via indirect prompt injections, as well as leverage a malicious trusted workspace to embed a persistent backdoor to execute arbitrary code every time the application is launched in the future.
• A new class of vulnerability named PromptPwnd that targets AI agents connected to vulnerable GitHub Actions (or GitLab CI/CD pipelines) with prompt injections to trick them into executing built-in privileged tools that lead to information leak or code execution.

As agentic AI offerings are becoming increasingly popular in enterprise environments, these findings demonstrate how AI tools expand the attack surface of development machines, often by leveraging an LLM’s inability to distinguish between instructions provided by a user to complete a task and content that it may ingest from an external source, which, in turn, can contain an embedded malicious prompt.

“Any repository using AI for issue triage, PR labeling, code suggestions, or automated replies is at risk of prompt injection, command injection, secret exfiltration, repository compromise and upstream supply chain compromise,” Aikido researcher Rein Daelman said.

Marzouk also said the discoveries emphasized the importance of “Secure for AI,” which is a new paradigm that has been coined by the researcher to tackle security challenges introduced by AI features, thereby ensuring that products are not only secure by default and secure by design, but are also conceived keeping in mind how AI components can be abused over time.

“This is another example of why the ‘Secure for AI’ principle is needed,” Marzouk said. “Connecting AI agents to existing applications (in my case IDE, in their case GitHub Actions) creates new emerging risks.”

In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale.

A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them run clean for years to build trust and gain millions of installs, then suddenly flipping them into malware via silent updates. In total, about 4.3 million users installed these once-legitimate add-ons, which suddenly went rogue with spyware and backdoor capabilities.

This tactic was essentially a browser extension supply-chain attack.

The ShadyPanda operators even earned featured and verified badges in the official Chrome Web Store and Microsoft Edge Add-ons site for some extensions, reinforcing user confidence. Because extension updates happen automatically in the background, the attackers were able to push out malicious code without users noticing a thing.

Once activated in mid-2024, the compromised extensions became a fully fledged remote code execution (RCE) framework inside the browser. They could download and run arbitrary JavaScript with full access to the browser’s data and capabilities. This gave the attackers a range of spyware powers, from monitoring every URL and keystroke, to injecting malicious scripts into web pages, to exfiltrating browsing data and credentials.

One of the worst capabilities was session cookie and token theft, stealing the authentication tokens that websites use to keep users logged in. The extensions could even impersonate entire SaaS accounts (like Microsoft 365 or Google Workspace) by hijacking those session tokens.

Why Browser Extensions Are a SaaS Security Nightmare

For SaaS security teams, ShadyPanda’s campaign shows us a lot. It proved that a malicious browser extension can effectively become an intruder with keys to your company’s SaaS kingdom. If an extension grabs a user’s session cookie or token, it can unlock that user’s accounts in Slack, Salesforce, or any other web service they’re logged into.

In this case, millions of stolen session tokens could have led to unauthorized access to enterprise emails, files, chat messages, and more, all without triggering the usual security alarms. Traditional identity defenses like MFA were bypassed, because the browser session was already authenticated and the extension was piggybacking on it.

The risk extends beyond just the individual user. Many organizations allow employees to install browser extensions freely, without the scrutiny applied to other software. Browser extensions often slip through without oversight, yet they can access cookies, local storage, cloud auth sessions, active web content, and file downloads.

This blurs the line between endpoint security and cloud security. A malicious extension can be run on the user’s device (an endpoint issue), but it directly compromises cloud accounts and data (an identity/SaaS issue). ShadyPanda vividly shows the need to bridge endpoint and SaaS identity defense: security teams should think about treating the browser as an extension of the SaaS attack surface.

Steps to Reduce Browser Extension Risk

So based on all of this, what can organizations do to reduce the risk of another ShadyPanda situation? Below is a practical guide with steps to tighten your defenses against malicious browser extensions.

With the right platform, you can gain unified visibility into extensions across your environment and detect suspicious activity in real time. Reco can help bridge the gap between endpoint and cloud by correlating browser-side risks with SaaS account behavior, giving security teams a cohesive defense. By taking these proactive steps and leveraging tools like Reco to automate and scale your SaaS security, you can stay one step ahead of the next ShadyPanda.

Request a Demo: Get Started With Reco.

Note: This article is expertly written and contributed by Gal Nakash, Co-founder & CPO of Reco. Gal is a former Lieutenant Colonel in the Israeli Prime Minister’s Office. He is a tech enthusiast with a background as a security researcher and hacker. Gal has led teams in multiple cybersecurity areas, with expertise in the human element.

Dec 15, 2025Ravie LakshmananHacking News / Cybersecurity

If you use a smartphone, browse the web, or unzip files on your computer, you are in the crosshairs this week. Hackers are currently exploiting critical flaws in the daily software we all rely on—and in some cases, they started attacking before a fix was even ready.

Below, we list the urgent updates you need to install right now to stop these active threats.

⚡ Threat of the Week

Apple and Google Release Fixes for Actively Exploited Flaws — Apple released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari web browser to address two zero-days that the company said have been exploited in highly targeted attacks. CVE-2025-14174 has been described as a memory corruption issue, while the second, CVE-2025-43529, is a use-after-free bug. They can both be exploited using maliciously crafted web content to execute arbitrary code. CVE-2025-14174 was also addressed by Google in its Chrome browser since it resides in its open-source Almost Native Graphics Layer Engine (ANGLE) library. There are currently no details on how these flaws were exploited, but evidence points to it likely having been weaponized by commercial spyware vendors.

• SOAPwn Exploits HTTP Client Proxies in .NET for RCE — Cybersecurity researchers uncovered an unexpected behavior of HTTP client proxies in .NET applications, potentially allowing attackers to achieve remote code execution. The vulnerability has been codenamed SOAPwn. At its core, the problem has to do with how .NET applications might be vulnerable to arbitrary file writes because .NET’s HTTP client proxies also accept non-HTTP URLs such as files, a behavior that Microsoft says developers are responsible for guarding against — but not likely to expect. This, in turn, can open remote code execution (RCE) attack paths through web shells and malicious PowerShell scripts in many .NET applications, including commercial products. By being able to pass an arbitrary URL to a SOAP API endpoint in an affected .NET application, an attacker can trigger a leak of NTLM challenge. The issue can also be exploited through Web Services Description Language (WSDL) imports, which can then be used to generate client SOAP proxies that can be controlled by the attacker. “The .NET Framework allows its HTTP client proxies to be tricked into interacting with the filesystem. With the right conditions, they will happily write SOAP requests into local paths instead of sending them over HTTP,” watchTowr said. “In the best case, this results in NTLM relaying or challenge capture. In the worst case, it becomes remote code execution through webshell uploads or PowerShell script drops.”
• Attackers Exploit New Flaw in CentreStack and Triofox — A new vulnerability in Gladinet’s CentreStack and Triofox products is being actively exploited by unknown threat actors to achieve code execution. The vulnerability, which does not have a CVE identifier, can be abused to access the web.config file, which can then be used to execute arbitrary code. At the core of the issue is a design failure in how they generate the cryptographic keys used to encrypt the access tokens the products use to control who can retrieve what files. As a result, the cryptographic keys never change and can be used to access files containing valuable data. Huntress said, as of December 10, 2025, nine organizations have been affected by the newly disclosed flaw.
• WinRAR Flaw Exploited by Multiple Threat Actors — A high-severity flaw in WinRAR (CVE-2025-6218, CVSS score: 7.8) has come under active exploitation, fueled by three different threat actors tracked as GOFFEE (aka Paper Werewolf), Bitter (aka APT-C-08 or Manlinghua), and Gamaredon. CVE-2025-6218 is a path traversal vulnerability that allows an attacker to execute code in the context of the current user. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary fixes by December 30, 2025.
• Exploitation of React2Shell Surges — The recently disclosed maximum-severity security flaw in React (CVE-2025-55182, CVSS score: 10.0) has come under widespread exploitation, with threat actors targeting unpatched systems to deliver various kinds of malware. Public disclosure of the flaw triggered a “rapid wave of opportunistic exploitation,” according to Wiz. Google said it observed a China-nexus espionage cluster UNC6600 exploiting React2Shell to deliver MINOCAT, a tunneling utility based on Fast Reverse Proxy (FRP). Other exploitation efforts included the deployment of the SNOWLIGHT downloader by UNC6586 (China-nexus), the COMPOOD backdoor (linked to suspected China-nexus espionage activity since 2022) by UNC6588, an updated version of the Go-based HISONIC backdoor by UNC6603 (China-nexus), and ANGRYREBEL.LINUX (aka Noodle RAT) by UNC6595 (China-nexus). “These observed campaigns highlight the risk posed to organizations using unpatched versions of React and Next.js,” Google said.
• Hamas-Affiliated Group Goes After the Middle East — WIRTE (aka Ashen Lepus), a cyber threat group associated with Hamas, has been conducting espionage on government bodies and diplomatic entities across the Middle East since 2018. In recent years, the threat actor has broadened its targeting scope to include Oman and Morocco, while simultaneously evolving its capabilities. The modus operandi follows tried-and-tested cyber espionage tactics, using spear-phishing emails to deliver malicious attachments that deliver a modular malware suite dubbed AshTag. The components of the framework are embedded in a command-and-control (C2) web page within HTML tags in Base64-encoded format, from where they are parsed and decrypted to download the actual payloads. “Ashen Lepus remained persistently active throughout the Israel-Hamas conflict, distinguishing it from other affiliated groups whose activities decreased over the same period,” Palo Alto Networks Unit 42 said. “Ashen Lepus continued with its campaign even after the October 2025 Gaza ceasefire, deploying newly developed malware variants and engaging in hands-on activity within victim environments.” It’s being assessed that the group may be operating from outside Gaza, citing continued activity throughout the conflict.

‎️‍🔥 Trending CVEs

Hackers act fast. They can use new bugs within hours. One missed update can cause a big breach. Here are this week’s most serious security flaws. Check them, fix what matters first, and stay protected.

This week’s list includes — CVE-2025-43529, CVE-2025-14174 (Apple), CVE-2025-14174 (Google Chrome), CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 (React), CVE-2025-8110 (Gogs), CVE-2025-62221 (Microsoft Windows), CVE-2025-59718, CVE-2025-59719 (Fortinet), CVE-2025-10573 (Ivanti Endpoint Manager), CVE-2025-42880, CVE-2025-55754, CVE-2025-42928 (SAP), CVE-2025-9612, CVE-2025-9613, CVE-2025-9614 (PCI Express Integrity and Data Encryption protocol), CVE-2025-27019, CVE-2025-27020 (Infinera MTC-9), CVE-2025-65883 (Genexis Platinum P4410 router), CVE-2025-64126, CVE-2025-64127, CVE-2025-64128 (Zenitel TCIV-3+), CVE-2025-66570 (cpp-httplib), CVE-2025-63216 (Itel DAB Gateway), CVE-2025-63224 (Itel DAB Encoder) CVE-2025-13390 (WP Directory Kit plugin), CVE-2025-65108 (md-to-pdf), CVE-2025-58083 (General Industrial Controls Lynx+ Gateway), CVE-2025-66489 (Cal.com), CVE-2025-12195, CVE-2025-12196, CVE-2025-11838, CVE-2025-12026 (WatchGuard), CVE-2025-64113 (Emby Server), CVE-2025-66567 (ruby-saml), CVE-2025-24857 (Universal Boot Loader), CVE-2025-13607 (D-Link DCS-F5614-L1, Sparsh Securitech, Securus CCTV), CVE-2025-13184 (TOTOLINK AX1800), CVE-2025-65106 (LangChain), CVE-2025-67635 (Jenkins), CVE-2025-12716, CVE-2025-8405, CVE-2025-12029, CVE-2025-12562 (GitLab CE/EE), and CVE-2025-64775 (Apache Struts 2).

📰 Around the Cyber World

• U.K. Fines LastPass for 2022 Breach — The U.K. Information Commissioner’s Office (ICO) fined LastPass’s British subsidiary £1.2 million ($1.6 million) for a data breach in 2022 that enabled attackers to access personal information belonging to its customers, including their encrypted password vaults. The hackers compromised a company-issued MacBook Pro of a software developer based in Europe to access the corporate development environment and related technical documentation, and exfiltrate a little over a dozen repositories. It’s unclear how the MacBook was infected. Subsequently, the threat actors gained access to one of the DevOps engineers’ PCs by exploiting CVE-2020-5741, a vulnerability in Plex Media Server, installed a keylogger used to steal the engineer’s master password, and breached the cloud storage environment. The ICO said LastPass failed to implement sufficiently robust technical and security measures. “LastPass customers had a right to expect the personal information they entrusted to the company would be kept safe and secure,” John Edwards, U.K. Information Commissioner, said. “However, the company fell short of this expectation, resulting in the proportionate fine being announced today.”
• APT-C-60 Targets Japan with SpyGlace — The threat actor known as APT-C-60 has been linked to continued cyber attacks targeting Japan to deliver SpyGlace using spear-phishing emails impersonating job seekers. The attacks were observed between June and August 2025, per JPCERT/CC. “In the previous attacks, victims were directed to download a VHDX file from Google Drive,” the agency said. “However, in the latest attacks, the malicious VHDX file was directly attached to the email. When the recipient clicks the LNK file contained within the VHDX, a malicious script is executed via Git, which is a legitimate file.” The attacks leverage GitHub to download the main malware components, marking a shift from Bitbucket.
• ConsentFix, a New Twist on ClickFix — Cybersecurity researchers have discovered a new variation of the ClickFix attack. Called ConsentFix, the new technique relies on tricking users into copy-pasting text that contains their OAuth material into an attacker-controlled web page. Push Security said it spotted the technique in attacks targeting Microsoft business accounts. In these attacks, targets are funneled through Google Search to compromised but reputable websites injected with a fake Cloudflare Turnstile challenge that instructs them to sign in to their accounts and paste the URL. Once the targets log in, they are redirected to a localhost URL containing the OAuth authorization code for their Microsoft account. The phishing process ends when the victims paste the URL back into the original page, granting the threat actors unauthorized access. The attack “sees the victim tricked into logging into Azure CLI, by generating an OAuth authorization code — visible in a localhost URL — and then pasting that URL, including the code, into the phishing page,” the security company said. “The attack happens entirely inside the browser context, removing one of the key detection opportunities for ClickFix attacks because it doesn’t touch the endpoint.” The technique is a variation of an attack used by Russian state-sponsored hackers earlier this year that deceived victims into sending their OAuth authorization code via Signal or WhatsApp to the hackers.
• 2025 CWE Top 25 Most Dangerous Software Weaknesses — The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the MITRE Corporation, released the 2025 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses, identifying the most critical vulnerabilities that adversaries exploit to compromise systems, steal data, or disrupt services. It was compiled from 39,080 CVEs published this year. Topping the list is cross-site scripting, followed by SQL Injection, Cross-Site Request Forgery (CSRF), missing authorization, and out-of-bounds write.
• Salt Typhoon Spies Reportedly Attended Cisco Training Scheme — Two of Salt Typhoon’s members, Yu Yang and Qiu Daibing, have been identified as participants of the 2012 Cisco Networking Academy Cup. Both Yu and Qiu are co-owners of Beijing Huanyu Tianqiong, one of the Chinese companies that the U.S. government and its allies allege as being fronts for Salt Typhoon activity. Yu is also tied to another Salt Typhoon-connected company, Sichuan Zhixin Ruijie. SentinelOne found that Yu and Qiu represented Southwest Petroleum University in Cisco’s academy cup in China. Yu’s team was placed second in the Sichuan region, while Qiu’s team took the first prize and later claimed the third spot nationally, despite the university being considered as a poorly-regarded academic institution. “The episode suggests that offensive capabilities against foreign IT products likely emerge when companies begin supplying local training and that there is a potential risk of such education initiatives inadvertently boosting foreign offensive research,” security researcher Dakota Cary said. The episode stresses the need for demonstrating technical competencies when hiring technical professionals and that offensive teams may benefit from putting their own employees through similar training initiatives like Huawei’s ICT academy.
• Freedom Chat Flaws Detailed — A pair of security flaws has been disclosed in Freedom Chat that could have allowed a bad actor to guess registered users’ phone numbers (similar to the recent WhatsApp flaw) and expose user-set PINs to others on the app. The issues, discovered by Eric Daigle, have since been addressed by the privacy-focused messaging app as of December 7, 2025. In an update pushed out to Apple and Google’s app stores, the company said: “A critical reset: A recent backend update inadvertently exposed user PINs in a system response. No messages were ever at risk, and because Freedom Chat does not support linked devices, your conversations were never accessible; however, we’ve reset all user PINs to ensure your account stays secure. Your privacy remains our top priority.”
• Unofficial Patch for New Windows RasMan 0-Day Released — Free unofficial patches have been made available for a new Windows zero-day vulnerability that allows unprivileged attackers to crash the Remote Access Connection Manager (RasMan) service. ACROS Security’s 0patch service said it discovered a new denial-of-service (DoS) flaw while looking into CVE-2025-59230, a Windows RasMan privilege escalation vulnerability exploited in attacks that was patched in October. The new flaw has not been assigned a CVE identifier, and there is no evidence of it having been abused in the wild. It affects all Windows versions, including Windows 7 through Windows 11 and Windows Server 2008 R2 through Server 2025.
• Ukrainian National Charged for Cyber Attacks on Critical Infra — U.S. prosecutors have charged a Ukrainian national for her role in cyberattacks targeting critical infrastructure worldwide, including U.S. water systems, election systems, and nuclear facilities, on behalf of Russian state-backed hacktivist groups. Victoria Eduardovna Dubranova (aka Vika, Tory, and SovaSonya), 33, was allegedly part of two pro-Kremlin hacktivist groups named NoName057(16) and CyberArmyofRussia_Reborn (CARR), the latter of which was founded, funded, and directed by Russia’s military intelligence service GRU. NoName057(16), a hacktivist group active since March 2022, has over 1,500 DDoS attacks against organizations in Ukraine and NATO countries. If found guilty, Dubranova faces up to 32 years in prison. She was extradited to the U.S. earlier this year. The U.S. Justice Department said the groups tampered with U.S. public water systems and caused an ammonia leak at a U.S. meat processing factory. Dubranova pleaded not guilty in a U.S. court last week. The U.S. government is also offering rewards for additional information on other members of the two groups. Prosecutors said administrators of the two collectives, dissatisfied with the level of support and funding from the GRU, went on to form Z-Pentest in September 2024 to conduct hack-and-leak operations and defacement attacks. “Pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems,” U.S. and other allies said in a joint advisory. “Pro-Russia hacktivist groups – Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector 16, and affiliated groups – are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage.” These groups are known for their opportunistic attacks, typically leveraging unsophisticated tradecraft like known security flaws, reconnaissance tools, and common password-guessing techniques to access networks and conduct SCADA intrusions. While their ability to consistently cause significant impact is limited, they also tend to work together to amplify each other’s posts to reach a broader audience on platforms like Telegram and X. X’s Safety team said it cooperated with U.S. authorities to suspend NoName057(16)’s account (“@NoName05716”) for facilitating criminal conduct.
• APT36 Targets Indian Government Entities with Linux Malware — A new phishing campaign orchestrated by APT36 (aka Transparent Tribe) has been observed delivering tailored malware specifically crafted to compromise Linux-based BOSS operating environments prevalent in Indian government networks. “The intrusion begins with spear-phishing emails designed to lure recipients into opening weaponized Linux shortcut files,” CYFIRMA said. “Once executed, these files silently download and run malicious components in the background while presenting benign content to the user, thereby facilitating stealthy initial access and follow-on exploitation.” The attack culminates with the deployment of a Python-based Remote Administration Tool (RAT) that can collect system information, contact an external server, and run commands, granting the attackers remote control over infected hosts. “The group’s current activity reflects a broader trend in state-aligned espionage operations: the adoption of adaptive, context-aware delivery mechanisms designed to blend seamlessly into the target’s technology landscape,” the company said.
• Vietnamese IT and HR Firms Targeted by Operation Hanoi Thief — A threat cluster referred to as Operation Hanoi Thief has targeted Vietnamese IT departments and HR recruiters using fake resumes distributed as ZIP files in phishing emails to deliver malware called LOTUSHARVEST. The ZIP file contains a Windows shortcut (LNK) file that, when opened, executes a “pseudo-polyglot” payload present in the archive that serves as the lure and as well as the container for a batch script that displays a decoy PDF and uses DLL side-loading to load the LOTUSHARVEST DLL. The malware runs various anti-analysis checks and proceeds to harvest data from web browsers such as Google Chrome and Microsoft Edge. The activity has been attributed with medium confidence to a threat cluster of Chinese origin.
• Microsoft Adds New PowerShell Security Feature — With PowerShell 5.1, Microsoft has added a new feature to warn users when they’re about to execute web content. The warning will alert users when executing the Invoke-WebRequest command without additional special parameters. “This prompt warns that scripts in the page could run during parsing and advises using the safer -UseBasicParsing parameter to avoid any script execution,” Microsoft said. “Users must choose to continue or cancel the operation. This change helps protect against malicious web content by requiring user consent before potentially risky actions.” The company also said it’s rolling out a new Baseline Security Mode in Office, SharePoint, Exchange, Teams, and Entra that can automatically configure apps with minimum security requirements. The centralized experience began rolling out in phases last month and will be completed by March next year. “It provides admins with a dashboard to assess and improve security posture using impact reports and risk-based recommendations, with no immediate user impact,” Microsoft said. “Admins can view the tenant’s current security posture compared to Microsoft’s recommended minimum security bar.”
• U.S. to Require Foreign Travelers to Share 5-Year Social Media History — The U.S. government will soon require all foreign travelers to provide five years’ worth of social media history prior to their entry. This includes details about social media accounts, email addresses, and phone numbers used over the past five years. The new requirement will be applied to foreigners from all countries, including those who are eligible to visit the U.S. for 90 days without a visa. “We want to make sure we’re not letting the wrong people enter our country,” U.S. President Donald Trump said.
• New AitM Phishing Campaign Targets Microsoft 365 and Okta Users — An active adversary-in-the-middle (AitM) phishing campaign is targeting organizations that use Microsoft 365 and Okta for their single sign-on (SSO), with the main goal of hijacking the legitimate SSO flow and bypassing multi-factor authentication (MFA) methods that are not phishing-resistant. “When a victim uses Okta as their identity provider (IdP), the phishing page hijacks the SSO authentication flow to bring the victim to a second-stage phishing page, which acts as a proxy to the organization’s legitimate Okta tenant and captures the victim’s credentials and session tokens,” Datadog said.
  
• Phishing Campaign Uses Fake Calendly Invites to Spoof Major Brands — A large-scale phishing campaign has Calendly-themed phishing lures entered around a fake job opportunity to steal Google Workspace and Facebook business account credentials. These emails purport to originate from brands like Louis Vuitton, Unilever, Lego, and Disney, among others. “Only after the victim has responded to an initial email was the phishing link delivered under the guise of a Calendly link to book time for a call,” Push Security said. “Clicking the link takes the victim to an authentic-looking page impersonating a Calendly landing page. From there, users are prompted to complete a CAPTCHA check and continue to sign in with their Google account, which causes their credentials to be stolen using an AitM phishing page. A similar variant has also been observed tricking victims into entering their Facebook account credentials on bogus pages, while another targets both Google and Facebook credentials using Browser-in-the-Browser (BitB) techniques that display fake pop-up windows featuring legitimate URLs to steal account credentials. The fact that the campaign is focused on compromising accounts responsible for managing digital ads on behalf of businesses shows that the threat actors are looking to launch malvertising campaigns for other kinds of attacks, including ClickFix. This is not the first time job-related lures have been used to steal account information. In October 2025, phishing emails impersonating Google Careers were used to phish credentials. In tandem, Push Security said it also observed a malvertising campaign in which users who searched for “Google Ads” on Google Search were served a malicious sponsored ad that’s designed to capture their credentials.
• Calendar Subscriptions for Phishing and Malware Delivery — Threat actors have been found leveraging digital calendar subscription infrastructure to deliver malicious content. “The security risk arises from third-party calendar subscriptions hosted on expired or hijacked domains, which can be exploited for large-scale social engineering,” Bitsight said. “Once a subscription is established, they can deliver calendar files that may contain harmful content, such as URLs or attachments, turning a helpful tool into an unexpected attack vector.” The attack takes advantage of the fact that these third-party servers can add events directly to users’ schedules. The cybersecurity company said it discovered more than 390 abandoned domains related to iCalendar synchronization (sync) requests for subscribed calendars, potentially putting about four million iOS and macOS devices at risk. All the identified domains have been sinkholed.
• The Gentlemen Ransomware Uses BYOVD Technique in Attacks — A nascent ransomware group called The Gentlemen has employed tactics common to advanced e-crime groups, such as Group Policy Objects (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD), as part of double extortion attacks aimed at manufacturing, construction, healthcare, and insurance sectors across 17 countries. “Since its emergence, Gentlemen has been evaluated as one of the most active emerging ransomware groups in 2025, having attacked multiple regions and industries in a relatively short period,” AhnLab said. The group emerged around July 2025, with PRODAFT noting in mid-October that Phantom Mantis (ArmCorp), led by LARVA-368 (hastalamuerte), tested Qilin (Pestilent Mantis), Embargo (Primeval Mantis), LockBit (Tenacious Mantis), Medusa (Venomous Mantis), and BlackLock (Incredible Mantis), before building their own ransomware-as-a-service (RaaS): The Gentlemen.

🎥 Cybersecurity Webinars

• Defining the New Layers of Cloud Defense with Zero Trust and AI: This webinar shows how Zero Trust and AI help stop modern, fileless attacks. Zscaler experts explain new tactics like “living off the land” and fileless reassembly, and how proactive visibility and secure developer environments keep organizations ahead of emerging threats.
• Speed vs. Security: How to Patch Faster Without Opening New Doors to Attackers: This session explores how to balance speed and security when using community patching tools like Chocolatey and Winget. Gene Moody, Field CTO at Action1, examines real risks in open repositories—outdated packages, weak signatures, and unverified code—and shows how to set clear guardrails that keep patching fast but safe. Attendees will learn when to trust community sources, how to detect version drift, and how to run controlled rollouts without slowing operations.

🔧 Cybersecurity Tools

• Strix: A small open-source tool that helps developers build command-line interfaces (CLIs) more easily. It focuses on keeping setup simple and commands clear, so you can create tools that behave the same way every time. Instead of dealing with complex frameworks, you can use Strix to define commands, handle arguments, and manage output in a few straightforward steps.
• Heisenberg: It is a simple, open-source tool that looks at the software your projects depend on and checks how healthy and safe those parts are. It reads information about packages from public sources and “software bills of materials” (SBOMs) to find security problems or bad signals in your dependency chain and can produce reports for one package or many at once. The idea is to help teams spot risky or vulnerable components early, especially as they change, so you can understand supply chain risks without a complex setup.

Disclaimer: These tools are for learning and research only. They haven’t been fully tested for security. If used the wrong way, they could cause harm. Check the code first, test only in safe places, and follow all rules and laws.

Conclusion

We listed a lot of fixes today, but reading about them doesn’t secure your device—installing them does. The attackers are moving fast, so don’t leave these updates for ‘later.’ Take five minutes right now to check your systems, restart if you need to, and head into the weekend knowing you are one step ahead of the bad guys.

Dec 15, 2025Ravie LakshmananVulnerability / Software Security

Multiple security vulnerabilities have been disclosed in the open-source private branch exchange (PBX) platform FreePBX, including a critical flaw that could result in an authentication bypass under certain configurations.

The shortcomings, discovered by Horizon3.ai and reported to the project maintainers on September 15, 2025, are listed below –

• CVE-2025-61675 (CVSS score: 8.6) – Numerous authenticated SQL injection vulnerabilities impacting four unique endpoints (basestation, model, firmware, and custom extension) and 11 affected parameters that enable read and write access to the underlying SQL database
• CVE-2025-61678 (CVSS score: 8.6) – An authenticated arbitrary file upload vulnerability that allows an attacker to exploit the firmware upload endpoint to upload a PHP web shell after obtaining a valid PHPSESSID and run arbitrary commands to leak the contents of sensitive files (e.g., “/etc/passwd”)
• CVE-2025-66039 (CVSS score: 9.3) – An authentication bypass vulnerability that occurs when the “Authorization Type” (aka AUTHTYPE) is set to “webserver,” allowing an attacker to log in to the Administrator Control Panel via a forged Authorization header

It’s worth mentioning here that the authentication bypass is not vulnerable in the default configuration of FreePBX, given that the “Authorization Type” option is only displayed when the three following values in the Advanced Settings Details are set to “Yes”:

• Display Friendly Name
• Display Readonly Settings, and
• Override Readonly Settings

However, once the prerequisite is met, an attacker could send crafted HTTP requests to sidestep authentication and insert a malicious user into the “ampusers” database table, effectively accomplishing something similar to CVE-2025-57819, another flaw in FreePBX that was disclosed as having been actively exploited in the wild in September 2025.

“These vulnerabilities are easily exploitable and enable authenticated/unauthenticated remote attackers to achieve remote code execution on vulnerable FreePBX instances,” Horizon3.ai security researcher Noah King said in a report published last week.

The issues have been addressed in the following versions –

• CVE-2025-61675 and CVE-2025-61678 – 16.0.92 and 17.0.6 (Fixed on October 14, 2025)
• CVE-2025-66039 – 16.0.44 and 17.0.23 (Fixed on December 9, 2025)

In addition, the option to choose an authentication provider has now been removed from Advanced Settings and requires users to set it manually through the command-line using fwconsole. As temporary mitigations, FreePBX has recommended that users set “Authorization Type” to “usermanager,” set “Override Readonly Settings” to “No,” apply the new configuration, and reboot the system to disconnect any rogue sessions.

“If you did find that web server AUTHTYPE was enabled inadvertently, then you should fully analyze your system for signs of any potential compromise,” it said.

Users are also displayed a warning on the dashboard, stating “webserver” may offer reduced security compared to “usermanager.” For optimal protection, it’s advised to avoid using this authentication type.

“It’s important to note that the underlying vulnerable code is still present and relies on authentication layers in front to provide security and access to the FreePBX instance,” King said. “It still requires passing an Authorization header with a basic Base64-encoded username:password.”

“Depending on the endpoint, we noticed a valid username was required. In other cases, such as the file upload shared above, a valid username is not required, and you can achieve remote code execution with a few steps, as outlined. It is best practice not to use the authentication type webserver as it appears to be legacy code.”