Security. In focus.

Major drug research company confirms cyberattack compromised employee and partner data | Cybersecurity Dive

Pharmaceutical research company Inotiv has confirmed a cyberattack in August exposed data belonging to approximately 9,500 individuals, including current and former employees and their family members. The company is still evaluating the full operational and financial impacts of the breach, which prompted it to take its systems offline temporarily.

Risky Bulletin: APTs go after the React2Shell vulnerability within hours - Risky Business Media

Two Chinese APTs, Earth Lamia and Jackpot Panda, are actively exploiting the React2Shell vulnerability (CVE-2025-55182) in React’s server components, with attacks beginning within hours of its disclosure. This critical vulnerability, rated 10/10, impacts the deserialization process and allows attackers to execute malicious commands without authentication, posing a significant risk due to React’s widespread use in web development.

Researchers track dozens of organizations affected by React2Shell compromises tied to China’s MSS | The Record from Recorded Future News

Researchers have identified over 30 organizations affected by the React2Shell vulnerability (CVE-2025-55182), which is being exploited by an initial access broker linked to China’s Ministry of State Security (MSS). The attacks involve stealing credentials and installing malware, with widespread scanning for the critical vulnerability observed globally.

X cuts off the European Commission’s ad account after being fined €120 million www.theverge.com/news/8397…

Friday, the EU slapped X with a €120 million fine (about $140 million) for violating the Digital Services Act (DSA). It was the first time that a company had been hit with a penalty for running afoul of the law. Elon Musk responded with his trademark tact and professionalism by posting “Bullshit” on X in response to the announcement from the European Commission. But that wasn’t the end, because just a day later Nikita Bier, X’s head of product, accused the Commission of abusing an exploit to boost the reach of the announcement and responded by shutting down its ad account.

Attempts to Bypass CDNs isc.sans.edu/diary/325…

Currently, in order to provide basic DDoS protection and filter aggressive bots, some form of Content Delivery Network (CDN) is usually the simplest and most cost-effective way to protect a web application. In a typical setup, DNS is used to point clients to the CDN, and the CDN will then forward the request to the actual web server. There are a number of companies offering services like this, and cloud providers will usually have solutions like this as well.

However, this setup comes with a significant weakness: If an attacker can identify the IP address of the actual web server, they are often able to bypass the CDN and reach the web server directly. There are a few ways to prevent this. An[other] option is to add custom headers. Some CDNs offer special custom headers with randomized values to identify requests that passed through the CDN. A less secure (lazier?) option is to look for any header that identifies the CDN. This last option should be avoided, as attackers can easily include this header.

In recent days, our honeypots detected an uptick of requests that included these CDN-related headers, indicating that attackers may attempt to bypass this protection.

Portugal updates cybercrime law to exempt security researchers www.bleepingcomputer.com/news/secu…

Portugal has modified its cybercrime law to establish a legal safe harbor for good-faith security research and to make hacking non-punishable under certain strict conditions.

First spotted by Daniel Cuthbert, a new provision in Article 8.o-A, titled “Acts not punishable due to public interest in cybersecurity,” provides a legal exemption for actions that previously were classified as illegal system access or illegal data interception.

Phishing, privileges and passwords: Why identity is critical to improving cybersecurity posture www.welivesecurity.com/en/busine…

What do M&S and Co-op Group have in common? Aside from being among the UK’s most recognizable high street retailers, they were both recently the victims of a major ransomware breach. They were also both targeted by vishing attacks that elicited corporate passwords, providing their extorters with a critical foothold in the network.

Why has identity become such a popular attack vector? Part of it stems from the way companies work today. There was a time when all corporate resources were safely located behind a network perimeter and security teams defended that perimeter with a “castle-and-moat” strategy. But today’s IT environment is way more distributed. A proliferation of cloud servers, on-premises desktops, home working laptops and mobile devices mean the certainties of old have evaporated.

Identity is effectively the new network perimeter, which makes credentials a highly sought-after commodity. According to Verizon, credential abuse was a factor in nearly a quarter (22%) of data breaches last year.

Death to one-time text codes: Passkeys are the new hotness in MFA www.theregister.com/2025/12/0…

Using someone’s legitimate account credentials is a much more effective avenue for crims than finding a security hole to exploit. Microsoft’s latest Digital Defense Report puts identity as the top attack vector.

Using MFA of any kind is the main way to stave off identity attacks, but what you really want is a method that can stand up to phishing.

“Phishing-resistant MFA is the gold standard for security,” according to Microsoft’s threat intel team. “No matter how much the cyber threat landscape changes, multifactor authentication still blocks over 99 percent of unauthorized access attempts, making it the single most important security measure an organization can implement.”

Passkeys are typically what security folks mean when they say “phishing-resistant MFA.” They replace passwords, and instead use cryptographic key pairs with the public key stored on the server and the private key – such as the user’s face, fingerprints, or PIN – stored on the user’s device.

Security and Privacy are not the same thing. Let’s decode the latest Forbes headline.

You might have seen the viral article claiming “Apple Warns All iPhone Users Do Not Use This Google App.” Before you panic-delete Chrome, let’s look at what is actually happening under the hood.

This is a classic case of conflating Security (protection from hackers) with Privacy (protection from data collection).

The Reality: • Is Chrome dangerous? No. It is secure, patched, and safe from malware. • Is Chrome private? Generally, no. Google’s business model relies on ad revenue. The “warning” refers to digital fingerprinting—a technique used to track users across the web for advertising.

Apple’s “warning” isn’t a security bulletin about a vulnerability; it is a competitive marketing move highlighting Safari’s Intelligent Tracking Prevention (ITP).

My take: If you want to limit your digital footprint, Safari is the superior choice on iOS. But don’t let alarmist headlines convince you that using Chrome opens the door to hackers. It opens the door to advertisers—and that is a choice, not an exploit.

www.forbes.com/sites/zak…

Interesting technical discovery coming out of the Grok community this week. Users have noticed that video outputs are being tagged with a suspicious Base64 signature injected directly into the standard Windows “Comments” property.

While the initial reaction is “what is this strange code,” as a developer, the implication is clear: this likely isn’t just a watermark. It’s a persistent, serialized binary blob—potentially linking the file back to the creator’s specific User ID, prompt hash, and timestamp.

We talk a lot about C2PA and standardized content credentials, but stuffing raw Base64 data into user-visible metadata fields is a “quick and dirty” way to ensure accountability.

The takeaway: If you are generating AI assets for sensitive projects or POCs, remember that the file carries a digital paper trail. Always sanitize your metadata before distribution.

www.reddit.com/r/grok/co…

Critical XXE Bug CVE-2025-66516 (CVSS 10.0) Hits Apache Tika, Requires Urgent Patch

A critical XXE bug (CVE-2025-66516) with a CVSS score of 10.0 has been discovered in Apache Tika, affecting multiple modules including tika-core, tika-pdf-module, and tika-parsers. This vulnerability allows attackers to perform XML External Entity injection via a crafted XFA file within a PDF, potentially leading to file system access and remote code execution, and requires urgent patching.

FBI warns of virtual kidnapping scams using altered social media photos

The FBI is warning about a rise in virtual kidnapping scams where criminals use altered social media photos as fake proof of life to demand ransom. These scams involve no actual abduction, but rather manipulated images and public information to create a false sense of urgency and pressure victims into paying before verifying their loved ones' safety.

Chinese Nation-State Groups Tied to ‘React2Shell’ Targeting

A critical vulnerability (CVE-2025-55182) in the React web application framework, allowing full remote code execution, is being actively exploited by Chinese state-nexus threat groups. The flaw, which affects all versions of React since November 2024, can be exploited remotely without authentication. Organizations using React or affected downstream frameworks are urged to remediate the vulnerability urgently.

Zero-Click Agentic Browser Attack Can Delete Entire Google Drive Using Crafted Emails

A zero-click agentic browser attack can delete entire Google Drive contents by exploiting how AI assistants interpret natural language instructions in crafted emails. Another attack, HashJack, uses URL fragments to trick AI browsers into executing hidden malicious prompts.

Spy vs. Spy: How GenAI Is Powering Defenders and Attackers Source: blog.talosintelligence.com/spy-vs-sp… Generative AI is reshaping how individuals and enterprises work, with widespread adoption driven by efficiency gains and automation. In cybersecurity, most attention has focused on how adversaries might exploit GenAI, while the benefits for defenders have been less explored. Talos notes that although GenAI is influencing the threat landscape, its precise impact remains difficult to quantify. Much of the value attackers derive from GenAI is not directly observable in finished malware, particularly as “vibe coding” — rapid, informal code generation — becomes more common. The pace of evolution is exponential. As models become smaller and hardware requirements decline, the industry is likely seeing only an early preview of GenAI’s full potential for both offensive and defensive security operations.

Sanctioned but Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue cloud.google.com/blog/topi…

Despite extensive scrutiny and public reporting, commercial surveillance vendors continue to operate unimpeded. A prominent name continues to surface in the world of mercenary spyware, Intellexa. Known for its “Predator” spyware, the company was sanctioned by the US Government. New Google Threat Intelligence Group (GTIG) analysis shows that Intellexa is evading restrictions and thriving.

Intellexa has adapted, evaded restrictions, and continues selling digital weapons to the highest bidders. Alongside research published by our colleagues from Recorded Future and Amnesty, this blog post will shed light on Intellexa’s recent activities, unveil the real-world impact of their surveillance tools, and detail the actions we are taking against this industry.

Intellexa is responsible for a substantial number of the zero-day vulnerabilities identified over the years by Google’s Threat Analysis Group (TAG), now part of GTIG. As an example, out of approximately 70 zero-day vulnerabilities discovered and documented by TAG since 2021, Intellexa accounts for 15 unique zero-days, including Remote Code Execution (RCE), Sandbox Escape (SBX), and Local Privilege Escalation (LPE) vulnerabilities. All of these zero-days have been patched by the respective vendors. In addition to developing exploitation of zero-days, we increasingly see evidence that Intellexa is purchasing steps of exploit chains from external entities.

ValleyRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading Source: www.trendmicro.com/en_us/res… Trend Micro has identified a new ValleyRAT campaign that demonstrates a layered and increasingly sophisticated approach. The operators combine social-engineering lures aimed at job seekers, deeply nested directory structures for obfuscation and DLL side-loading through Foxit PDF Reader to execute the payload. Telemetry shows a significant rise in ValleyRAT detections, indicating strong operational success. While ValleyRAT traditionally targeted Chinese-speaking users, current activity suggests the operators are broadening their reach. English-language filenames found in malicious archives point to an expansion toward job seekers globally. The lure is effective because job seekers often respond quickly to messages that appear to come from employers. Emotional pressure, urgency and the desire for new opportunities reduce scrutiny, increasing the likelihood that victims will download and open malicious attachments.

Silver Fox’s Russian Ruse: ValleyRAT Used in Fake Microsoft Teams Attack Source: reliaquest.com/blog/thre… ReliaQuest assesses with high confidence that a current search engine optimisation poisoning campaign impersonating Microsoft Teams is operated by the Chinese advanced persistent threat group Silver Fox (also known as Void Arachne), despite deliberate indicators meant to suggest Russian involvement. The campaign has been active since November 2025 and targets Chinese-speaking users, including those working for Western organisations inside China. Attackers are distributing a modified ValleyRAT loader containing Cyrillic artefacts, likely added to obscure attribution. Infrastructure overlaps with past Silver Fox activity reinforce the connection. The campaign poses elevated risk to any organisation employing Chinese-speaking staff. Attackers use a spoofed Chinese top-level domain to increase credibility and reach the intended demographic. Silver Fox carries out both state-sponsored espionage and financially motivated cybercrime, pursuing intelligence collection, fraud and theft. Targets face risks including data breaches, financial loss and long-term system compromise. ValleyRAT, a remote access trojan historically linked to Chinese APT groups, enables remote control, data exfiltration, arbitrary command execution and persistent access. The report outlines the campaign details and recommended defensive actions for security teams.

French NGO Reporters Without Borders Targeted by Calisto in Recent Campaign Source: blog.sekoia.io/ngo-repor… In May and June 2025, two organisations — including the French NGO Reporters Without Borders (RSF) — reported suspected spear-phishing attempts linked to the intrusion set Calisto (also known as ColdRiver or Star Blizzard). Calisto is a Russia-nexus espionage group active since at least 2017 and attributed by the United States, the United Kingdom, New Zealand and Australia to the FSB, specifically Center 18 (TsIB), Military Unit 64829. Sekoia.io supports this attribution, noting that Calisto’s historic activity aligns closely with Russian strategic interests. The group focuses on cyber-espionage against Western countries, with particular emphasis on Eastern Europe and nations supporting Ukraine. Operations involve credential theft and code execution, including recent use of the ClickFix technique. Targets have included NATO entities, a Ukraine-based defence contractor, NGOs, think tanks, former intelligence officials, Russian-affairs experts and Russian citizens living abroad. Calisto’s spear-phishing playbook typically involves impersonating trusted contacts and sending emails with either a missing attachment or a benign but non-functional PDF. This tactic is intended to elicit a reply from the victim requesting a resend, thereby increasing the perceived legitimacy of the exchange.

Critical RSC Bugs in React and Next.js Enable Unauthenticated Remote Code Execution Source: thehackernews.com/2025/12/c… A maximum-severity flaw has been disclosed in React Server Components (RSC) that can allow remote code execution. The vulnerability, CVE-2025-55182 — codenamed React2shell — carries a CVSS score of 10.0. According to the React team, it enables unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. The React team warns that applications may be vulnerable even if they do not implement Server Function endpoints, as long as they support React Server Components. Cloud security firm Wiz reports that the issue stems from logical deserialization errors. RSC payloads are processed in an unsafe manner, allowing an attacker to send a specially crafted HTTP request to any Server Function endpoint. When the payload is deserialized, React may execute arbitrary JavaScript code on the server without authentication.

ASUS confirms vendor breach as Everest gang leaks data, claims ArcSoft and Qualcomm

ASUS has confirmed a vendor breach, with the Everest ransomware gang claiming to have leaked data from ASUS, ArcSoft, and Qualcomm. This incident follows other recent data breaches impacting Marquis and the University of Pennsylvania and University of Phoenix, as well as a massive DDoS attack mitigated by Cloudflare.

Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China

The threat actor Silver Fox is using a fake Microsoft Teams installer as part of an SEO poisoning campaign to spread ValleyRAT malware in China, employing tactics to mislead attribution. This malware allows for remote control, data exfiltration, and persistence, with recent attacks also utilizing trojanized Telegram installers and vulnerable driver techniques.

How scammers use fake insurance texts to steal your identity | Malwarebytes

Scammers use fake insurance texts to steal your identity by requesting personal information like age and gender, often timed around open enrollment periods. To stay safe, do not respond to unsolicited messages, verify the sender’s legitimacy, and use the STOP framework (Slow down, Test them, Opt out, Prove it) to protect yourself.

CISA warns of Chinese “BrickStorm” malware attacks on VMware servers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about Chinese hackers using BrickStorm malware to target VMware vSphere servers, creating rogue virtual machines for credential theft and data exfiltration. The malware employs advanced encryption and tunneling techniques, with detection and mitigation guidance provided by CISA, NSA, and the Cyber Security Centre.

Virginia brothers charged with hacking, deleting federal databases holding FOIA info | The Record from Recorded Future News

Brothers Muneeb and Sohaib Akhter have been arrested for allegedly hacking and deleting federal databases containing FOIA information and sensitive investigative files after being fired from their contractor roles. Both brothers have a history of cybercrimes, including previous convictions for hacking charges in the 2010s.