Security. In focus.

European authorities dismantle call center fraud ring in Ukraine

European authorities have dismantled a call center fraud ring operating in Ukraine, which scammed victims across Europe out of over 10 million euros. The operation involved arrests, seizures of assets, and the targeting of multiple call centers that employed individuals from various European countries, using schemes like impersonating bank employees and police officers.

Photo booth flaw exposes people’s private pictures online | Malwarebytes

A security researcher discovered a vulnerability in Hama Film’s photo booth system that reportedly exposed hundreds of customers' private photos and videos online. The flaw allowed anyone to download media without logging in, raising significant privacy concerns.

‘Featured’ Urban VPN caught stealing private AI chats | CSO Online

Security researchers discovered that Urban VPN Proxy, a popular free browser VPN extension, has been collecting and exporting full AI chat conversations from users’ browsers, even when VPN features are disabled. The extension, operated by Urban Cyber Security Inc. (affiliated with data broker BiScience), injects scripts to capture AI prompts and responses from platforms like ChatGPT and Claude, raising concerns about data exfiltration and enterprise security.

x.com/aiatmeta/…

Meta’s AI at Meta account announced SAM Audio, the latest open-source model in the Segment Anything family, capable of isolating and editing specific sounds from mixed audio using text prompts, visual cues from video, or time-based spans. This builds on prior SAM models for images, videos, and 3D by extending segmentation to audio, automating tasks like removing background noise or extracting instruments without manual editing.

Mozilla Names New CEO, Firefox To Evolve Into A “Modern AI Browser” - Phoronix

Mozilla Corporation has appointed Anthony Enzor-DeMeo as its new CEO. Under his leadership, Firefox is set to evolve into a modern AI browser and a broader ecosystem of trusted software, emphasizing user agency, privacy, and transparent monetization.

Why ServiceNow Is Eyeing a $7B Buy of Venture-Backed Armis

ServiceNow is reportedly in advanced talks to acquire Armis, a cyber exposure management vendor, for $7 billion. This acquisition would significantly boost ServiceNow’s cybersecurity business, which has been largely overlooked despite reaching a $1 billion annual contract value. While the deal could bring notoriety to ServiceNow’s security offerings, it also presents integration challenges and investor concerns due to the company’s lack of experience with such a large acquisition.

User Data Compromised in SoundCloud Hack  - SecurityWeek

SoundCloud experienced a cyberattack that compromised limited user data, including email addresses and public profile information. While sensitive data was not exposed, the company urged users to be cautious of phishing attempts.

Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass

Threat actors are exploiting two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) in Fortinet FortiGate devices. Organizations are advised to apply patches, disable FortiCloud SSO, and limit access to management interfaces.

Google is discontinuing its dark web report: why it matters | Malwarebytes

Google is discontinuing its dark web report in early 2026, citing a lack of actionable steps for users. While the report provided valuable information about data exposure, it did not offer a way to remove data from the dark web. Malwarebytes offers tools like Personal Data Remover and Digital Footprint scan to help users discover and remove their data from online sources.

700Credit data breach impacts 5.8 million vehicle dealership customers

700Credit data breach exposed personal data of 5.8 million vehicle dealership customers, including full names, addresses, dates of birth, and Social Security numbers, after a threat actor exploited an API vulnerability in an integration partner from May to October 2025. The company detected the issue on October 25, terminated the API, notified regulators and affected parties, and offers 12 months of free identity protection and credit monitoring via TransUnion.

Nation-State and Cybercrime Exploits Tied to React2Shell

The React2Shell vulnerability, tracked as CVE-2025-55182, is being widely exploited by nation-state actors from China, North Korea, and Iran, as well as by financially motivated cybercriminals. This flaw allows unauthenticated attackers to execute arbitrary code on vulnerable servers, with observed attacks ranging from cryptomining to sophisticated backdoors.

Makop ransomware: GuLoader and privilege escalation in attacks against Indian businesses

Makop ransomware, a variant of Phobos, is targeting Indian businesses by exploiting exposed RDP systems and employing tools like GuLoader for secondary payload delivery. The attacks involve network scanning, privilege escalation using various exploits, and defense evasion techniques, with a significant portion of incidents occurring in India.

Marquis data breach impacts over 74 US banks, credit unions

The financial software provider Marquis Software Solutions has disclosed a data breach impacting over 74 US banks and credit unions, affecting more than 400,000 customers. The breach, which occurred on August 14, 2025, due to a ransomware attack exploiting a SonicWall firewall, potentially exposed sensitive personal information including names, addresses, and Social Security numbers.

BreachForums Reemerges, Claims French Govt Hack and Data Theft - TechNadu

The BreachForums administration claims responsibility for a French government hack, allegedly compromising sensitive police records of over 16 million individuals. They have issued a one-week ultimatum to the French government for negotiations before potentially selling or leaking the exfiltrated data.

Askul says 740,000 sets of data breached in cyberattack – DataBreaches.Net

Japanese retailer Askul reported that a ransomware cyberattack in October led to the breach of approximately 740,000 data sets, affecting individual customers, corporate clients, and employees. The company confirmed that no credit card information was leaked and no ransom was paid.

Experts found an unsecured 16TB database containing 4.3B professional records

An unsecured 16TB database exposed approximately 4.3 billion professional records, including names, emails, and LinkedIn profiles, before being secured. This massive data leak poses a significant risk for AI-driven social-engineering attacks and phishing campaigns.

Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads thehackernews.com/2025/12/f…

Cybersecurity researchers are calling attention to a new campaign that’s leveraging GitHub-hosted Python repositories to distribute a previously undocumented JavaScript-based Remote Access Trojan (RAT) dubbed PyStoreRAT.

“These repositories, often themed as development utilities or OSINT tools, contain only a few lines of code responsible for silently downloading a remote HTA file and executing it via ‘mshta.exe,'” Morphisec researcher Yonatan Edri said in a report shared with The Hacker News.

PyStoreRAT has been described as a “modular, multi-stage” implant that can execute EXE, DLL, PowerShell, MSI, Python, JavaScript, and HTA modules. The malware also deploys an information stealer known as Rhadamanthys as a follow-on payload.

Attack chains involve distributing the malware through Python or JavaScript loader stubs embedded in GitHub repositories masquerading as OSINT tools, DeFi bots, GPT wrappers, and security-themed utilities that are designed to appeal to analysts and developers.

The earliest signs of the campaign go back to mid-June 2025, with a steady stream of “repositories” published since then. The tools are promoted via social media platforms like YouTube and X, as well as artificially inflate the repositories’ star and fork metrics – a technique reminiscent of the Stargazers Ghost Network.

CISA Adds Actively Exploited Sierra Wireless Router Flaw Enabling RCE Attacks thehackernews.com/2025/12/c…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a high-severity flaw impacting Sierra Wireless AirLink ALEOS routers to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.

CVE-2018-4063 (CVSS score: 8.8/9.9) refers to an unrestricted file upload vulnerability that could be exploited to achieve remote code execution by means of a malicious HTTP request.

“A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver,” the agency said. “An attacker can make an authenticated HTTP request to trigger this vulnerability.”

Apple fixes two zero-day flaws exploited in ‘sophisticated’ attacks www.bleepingcomputer.com/news/secu…

Apple has released emergency updates to patch two zero-day vulnerabilities that were exploited in an “extremely sophisticated attack” targeting specific individuals.

The zero-days are tracked as CVE-2025-43529 and CVE-2025-14174 and were both issued in response to the same reported exploitation.

“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26,” reads Apple’s security bulletin.

Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) cloud.google.com/blog/topi…

On Dec. 3, 2025, a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components, tracked as CVE-2025-55182 (aka “React2Shell”), was publicly disclosed. Shortly after disclosure, Google Threat Intelligence Group (GTIG) had begun observing widespread exploitation across many threat clusters, ranging from opportunistic cyber crime actors to suspected espionage groups.

GTIG has identified distinct campaigns leveraging this vulnerability to deploy a MINOCAT tunneler, SNOWLIGHT downloader, HISONIC backdoor, and COMPOOD backdoor, as well as XMRIG cryptocurrency miners, some of which overlaps with activity previously reported by Huntress. These observed campaigns highlight the risk posed to organizations using unpatched versions of React and Next.js. This post details the observed exploitation chains and post-compromise behaviors and provides intelligence to assist defenders in identifying and remediating this threat.

Abuse of ISO Mounting to Deliver Phantom Stealer Malware on Windows Platforms cyberpress.org/iso-mount…

Seqrite Labs researchers have identified an active phishing campaign originating from Russia that delivers the Phantom information-stealing malware through deceptive payment confirmation emails.

The operation, named Operation MoneyMount-ISO, is aimed primarily at finance, accounting, and treasury divisions across Russian-speaking organizations, with secondary targeting of procurement, HR/payroll, and legal departments.

New React RSC Vulnerabilities Enable DoS and Source Code Exposure thehackernews.com/2025/12/n…

The React team has released fixes for two new types of flaws in React Server Components (RSC) that, if successfully exploited, could result in denial-of-service (DoS) or source code exposure.

The team said the issues were found by the security community while attempting to exploit the patches released for CVE-2025-55182 (CVSS score: 10.0), a critical bug in RSC that has since been weaponized in the wild.

The three vulnerabilities are listed below -

CVE-2025-55184 (CVSS score: 7.5) - A pre-authentication denial of service vulnerability arising from unsafe deserialization of payloads from HTTP requests to Server Function endpoints, triggering an infinite loop that hangs the server process and may prevent future HTTP requests from being served CVE-2025-67779 (CVSS score: 7.5) - An incomplete fix for CVE-2025-55184 that has the same impact CVE-2025-55183 (CVSS score: 5.3) - An information leak vulnerability that may cause a specifically crafted HTTP request sent to a vulnerable Server Function to return the source code of any Server Function

However, successful exploitation of CVE-2025-55183 requires the existence of a Server Function that explicitly or implicitly exposes an argument that has been converted into a string format.

Fake ‘One Battle After Another’ torrent hides malware in subtitles www.bleepingcomputer.com/news/secu…

A fake torrent for Leonardo DiCaprio’s ‘One Battle After Another’ hides malicious PowerShell malware loaders inside subtitle files that ultimately infect devices with the Agent Tesla RAT malware.

The malicious torrent file was discovered by Bitdefender researchers while investigating a spike in detections related to the movie.

New Windows RasMan zero-day flaw gets free, unofficial patches www.bleepingcomputer.com/news/micr…

Free unofficial patches are available for a new Windows zero-day vulnerability that allows attackers to crash the Remote Access Connection Manager (RasMan) service.

RasMan is a critical Windows system service that starts automatically, runs in the background with SYSTEM-level privileges, and manages VPN, Point-to-Point Protocol over Ethernet (PPoE), and other remote network connections.

ACROS Security (which manages the 0patch micropatching platform) discovered a new denial-of-service (DoS) flaw while looking into CVE-2025-59230, a Windows RasMan privilege escalation vulnerability exploited in attacks that was patched in October.

The DoS zero-day has not been assigned a CVE ID and remains unpatched across all Windows versions, including Windows 7 through Windows 11 and Windows Server 2008 R2 through Server 2025.

As the researchers found, when combined with CVE-2025-59230 (or similar elevation-of-privileges flaws), it allows attackers to execute code by impersonating the RasMan service. However, that attack only works when RasMan is not running.

Technical Analysis of the BlackForce Phishing Kit www.zscaler.com/blogs/sec…

Zscaler ThreatLabz identified a new phishing kit named BlackForce, which was first observed in the beginning of August 2025 with at least five distinct versions. BlackForce is capable of stealing credentials and performing Man-in-the-Browser (MitB) attacks to steal one-time tokens and bypass multi-factor authentication (MFA). The phishing kit is actively marketed and sold on Telegram forums for €200–€300.

In this blog post, ThreatLabz examines the BlackForce phishing kit, including its evolution, evasion techniques, and architecture. The analysis examines versions 3, 4, and 5 of BlackForce, followed by a comparison highlighting the key differences and advancements across these versions.