seen from Brunei
seen from Malaysia
seen from United States
seen from Brazil
seen from Russia
seen from China
seen from Malaysia
seen from Netherlands
seen from United States
seen from Malaysia
seen from United States
seen from United States
seen from Kazakhstan
seen from Malaysia
seen from United States
seen from United States
seen from United Kingdom
seen from Malaysia
seen from China
seen from Malaysia
Massiv Banking Trojan Hides Inside Fake IPTV Apps
The Massiv Android banking trojan disguises itself as IPTV apps, using overlays, keylogging, SMS interception, and Accessibility services to perform full device takeovers.
Source: ThreatFabric
Read more: CyberSecBrief
Zero-Days, Supply Chain Worms, and AI-Assisted Breaches Escalate Global Risk
Actively exploited zero-days in Dell RecoverPoint and Google Chrome triggered urgent remediation orders, as a self-propagating npm worm and token compromise hit developer toolchains, and AI-assisted credential abuse led to mass FortiGate breaches worldwide.
Source: CyberSecBrief – Weekly Briefing
NGate Malware Turns Android Phones into NFC Card Cloning Tools
A stealthy Android malware campaign is hijacking NFC payment data and PINs through a trojanised HandyPay app, enabling fraudulent ATM withdrawals and contactless theft.
Source: ESET Research
Read more: CyberSecBrief
Daily Cybersecurity Briefing – 12 November 2025
Microsoft released its November Patch Tuesday updates, addressing sixty-three vulnerabilities, including one actively exploited Windows kernel zero-day. The patches covered multiple products, including Windows 10, Windows 11, and server editions, with several critical flaws identified.
SAP published its November security advisories, including fixes for a maximum severity flaw, CVE-2025-42890, involving hard-coded credentials in SQL Anywhere Monitor. The issue allowed unauthorised remote code execution without authentication.
Synology issued patches for critical remote code execution vulnerabilities in its BeeStation devices, disclosed at the Pwn2Own Ireland competition. The company advised immediate updates to prevent exploitation.
Threat actors exploited a serious vulnerability in Gladinet’s Triofox file-sharing platform, using its antivirus feature to gain system-level privileges and deploy remote access tools. Google Cloud researchers confirmed the flaw had been exploited after a patch was released.
CISA added CVE-2025-21042, a Samsung mobile zero-day used to distribute LANDFALL spyware, to its Known Exploited Vulnerabilities catalogue. US federal agencies must apply patches by early December under binding operational directives.
Cybersecurity researchers linked the KONNI advanced persistent threat (APT) group, associated with North Korea, to new Android attacks exploiting Google’s Find Hub feature for remote device wiping. The same campaign targeted South Korean users.
GlobalLogic, a subsidiary of Hitachi, disclosed that data belonging to over 10,000 current and former employees was stolen following a breach of Oracle’s E-Business Suite. The incident forms part of the wider Clop ransomware campaign affecting multiple industries.
The OWASP Top 10 for 2025 reaffirmed broken access control as the most common web application security issue. Security misconfiguration and supply chain vulnerabilities remained high priorities for remediation across software ecosystems.
Patches addressed multiple critical vulnerabilities across widely used platforms including Linux Kernel, Apache HTTP Server, and Google Chrome. Active exploitation was confirmed for CVE-2025-21042 and Gladinet Triofox, while a public PoC emerged for Open WebUI CVE-2025-64495 impacting self-hosted AI systems.
Highlights of the day:
Malicious npm package impersonates GitHub library: fake “@acitons/artifact” mimicked GitHub’s “@actions/artifact” to steal build tokens from GitHub-owned repositories; obfuscated scripts and expiry checks used to evade detection.
GlobalLogic breach exposes 10,000+ employees’ data: Clop-linked attackers exploited Oracle E-Business Suite flaws, stealing personal and financial details from staff in a wider campaign targeting major organisations.
Firefox strengthens anti-fingerprinting defences: version 145 introduces new protections that halve user identifiability by fingerprinters, expanding privacy measures in Private Browsing and ETP Strict modes.
Gootloader returns with font-based evasion: malware uses custom WOFF2 fonts to conceal filenames, delivering encrypted payloads via WordPress sites and compromising domain controllers within a day.
Microsoft fixes zero-day and 63 vulnerabilities: November Patch Tuesday addresses an exploited Windows Kernel flaw (CVE-2025-62215) granting SYSTEM privileges, plus multiple Critical remote code execution bugs.
Source: CyberSecBrief
G DATA: Android-malware in 2016 flink toegenomen
G DATA: Android-malware in 2016 flink toegenomen
Malware voor Android is in 2016 enorm toegenomen, zo stellen de marktonderzoekers van G DATA in een recent onderzoek. Belangrijkste oorzaak is dat cybercriminelen steeds meer op internet aanvallen uitvoeren op dit specifieke mobiele besturingssysteem. (more…)
View On WordPress
