Do Son
A deceptive new cyberattack campaign is turning one of WhatsApp’s most convenient features into a weapon, allowing...
The Gentlemen ransomware group rapidly emerged, targeting 17 countries with double extortion. It uses BYOVD and GPO manipulation to bypass security and hit manufacturing, healthcare, and insurance sectors.
NexusRoute is a sophisticated Android RAT campaign impersonating Indian E-Challan/mParivahan via GitHub phishing. It steals UPI PINs and conducts surveillance using a native-backed and professionally maintained malware framework.
Following a data leak, emails from the French Ministry of the Interior's domain invited hackers to the 'new' BreachForums. The community warns it is likely a highly sophisticated honeypot.
Apple's iOS 26.3 beta now includes an official "Transfer to Android" option, allowing seamless migration of apps, photos, and eSIM, likely driven by EU regulatory pressure.
The Trump administration launches "Tech Force" to recruit 1,000 elite engineers for two-year terms, partnering with tech giants (Apple, NVIDIA) to upgrade federal AI infrastructure.
NVIDIA acquires Slurm maintainer SchedMD to control GPU scheduling, and launches Nemotron 3 (Mamba-Transformer hybrid) to build a comprehensive AI ecosystem moat.
Reuters: Meta executives tolerated $3B+ in scam/illegal ads from China due to revenue pressure, using "whitelisting" to protect top agencies and prioritizing profit over user safety.
cybernewswire
Frankfurt am Main, Germany, 16th December 2025, CyberNewsWire
Reports suggest Samsung will phase out all SATA SSDs to boost AI production, potentially raising prices. Samsung denies the claims, but ambiguity leaves the market uncertain.
A critical flaw (CVSS 9.1) in Red Hat OpenShift GitOps lets namespace admins gain root access to the cluster by manipulating ArgoCD CRs. This effectively breaks multi-tenancy. Patch immediately.
A critical ScreenConnect flaw (CVSS 9.1) allows authorized users to expose config data or force untrusted extension installs. On-premise users must upgrade to v25.8 immediately; cloud users are already patched.
Installing Windows 10 update KB5071546 causes MSMQ service failure in enterprise systems due to new, missing write permissions, forcing administrators to uninstall the patch.
EU Compliance: iOS 26.3 Adds Notification Forwarding to Third-Party Wearables, Bypassing Apple Watch
EU Compliance: iOS 26.3 Adds Notification Forwarding to Third-Party Wearables, Bypassing Apple Watch
Apple introduced EU-only Notification Forwarding in iOS 26.3, allowing iPhones to selectively relay notifications to third-party smartwatches to comply with the Digital Markets Act.
A critical FortiGate SSO flaw (CVSS 9.1) is under active exploitation, letting unauthenticated attackers bypass login via crafted SAML. The flaw is armed by default registration, risking config exfiltration. Patch immediately.
A malicious NuGet package (Tracer.Fody.NLog) stole crypto wallet data for 5 years using homoglyphs and typosquatting to evade detection. The .NET supply chain attack linked to a Russian C2 server.
A macOS LPE flaw resurfaces after 7 years, allowing unprivileged users to hijack third-party installers and gain root access. The exploit leverages the hidden .localized directory to confuse the installation path.
Frogblight, a new Android banking Trojan, is targeting Turkey via smishing with fake e-government apps. It uses WebView to steal credentials and is linked to the Coper MaaS family. It is being actively developed.
Operation MoneyMount-ISO targets Russian financial institutions with a Phantom Stealer info-stealer hidden in an ISO file. The malware steals crypto wallets, browser data, and uses a keylogger. It has a SelfDestruct function for evasion.
PyStoreRAT, a new fileless RAT, is spreading via fake GitHub repositories targeting developers. It executes as a JS implant via mshta.exe and includes explicit evasion logic against CrowdStrike.
BlackForce, a new PhaaS kit, is being sold for €300, using React/React Router to disguise its code. It utilizes stateful sessions and MitB to bypass MFA in real time. Update to V5 shows rapid evolution.
Salt Typhoon operators, former Cisco Academy students, breached 80+ telecos and CALEA systems to harvest calls from high-profile targets. The report highlights the risk of corporate tech training in geopolitics.