Do Son Code for "search ads" was found in a ChatGPT Android build. OpenAI officially denied current testing, but high operational costs keep advertising speculation alive.
A previously undetectable Linux backdoor called GhostPenguin was exposed by AI-driven threat hunting. The C++ malware uses RC5-encrypted UDP for stealthy, multi-threaded C2 operations.
The Shanya Crypter (VX Crypt) is a new PaaS used by Akira/Medusa to bypass EDR. It deploys a kernel driver attack to kill security products and uses PEB manipulation for stealth.
A college student is selling access to 5,200+ gov/edu sites via the undetectable Beima PHP Webshell. The custom backdoor allows full RCE and fuels a growing cybercrime freelancing marketplace.
A malicious Go package typosquat (bpoorman/uuid) operated for four years, using a hidden Valid function to silently encrypt and exfiltrate sensitive data to dpaste.com.
Chinese APT Silver Fox is using a Cyrillic false flag in an SEO poisoning campaign impersonating Microsoft Teams. The attack installs ValleyRAT for espionage and financial fraud.
Evolved ClayRat spyware uses Accessibility Services to install a keylogger and lockscreen bypass. It leverages self-defense (blocking uninstallation) and screen recording for comprehensive surveillance.
A unique Android banking trojan, FvncBot, targets mBank (Poland) customers. It uses HVNC and H.264 to stream screens and performs web-inject attacks via FCM/WebSocket C2.
The JS#SMUGGLER campaign uses "Junk Code" JavaScript and fileless PowerShell executed via mshta.exe to bypass EDR. This multi-stage attack silently installs the NetSupport RAT.
A new C-compiled RAT, CastleRAT, uses Steam Community pages to hide its C2. The malware deploys advanced features like UAC Bypass, screen capture, and clipboard hijacking for espionage.
Despite takedown, LockBit 5.0 resurges as a cross-platform threat. The new variant blinds Windows Event Tracing (ETW), uses Invisible Mode for stealth encryption, and overwrites free disk space.
Responding to user complaints, Windows 11 Build 26220 adds a setting to disable AI actions in the File Explorer context menu, reducing significant UI clutter.
In response to the U.S. Department of Justice’s antitrust lawsuit against Google, federal judge Amit Mehta has...
cybernewswire
Cary, North Carolina, USA, 8th December 2025, CyberNewsWire
Windows 11's missing Agenda View returns, but its WebView 2 implementation causes high CPU usage. Microsoft accepts the trade-off for easier Copilot/Teams integration.
The latest Pixel Drop fix enables Google Pixel phones to function as external USB webcams for the Nintendo Switch 2, allowing high-quality video calls without extra accessories.
Meta struck paid, multi-year licensing deals with CNN, Le Monde, and others to feed licensed news to Meta AI, improving RAG and requiring the chatbot to link sources.
The EU fined X €120M for violating the DSA, citing the "deceptive design" of its Blue Check system and restricting data access. X has 60 days to respond.
Meta acknowledged its broken support system and launched AI chat and an enhanced Support Hub. New AI recovery tools have boosted hacked-account success rates by 30%.
The BlueShrimp exploit targets a Bluetooth UAF flaw (CVE-2025-48593, CVSS 8.0) that can crash the service on Android Automotive and Wear OS. Phones are safe, but PoC is public. Patch immediately.
A High-severity flaw (CVE-2025-13654) in the Duc disk usage tool risks DoS and information leaks. An integer underflow in buffer.c allows out-of-bounds memory read. Update to v1.4.6 immediately.
A dangerous new Android malware called SeedSnatcher targets crypto users with overlay phishing on MetaMask/Trust Wallet. It uses BIP 39 validation to steal seed phrases and supports remote command execution for total device control.