Do Son AhnLab exposed Rhadamanthys Infostealer hiding in games built with the Ren'Py engine. It uses a fake 1M-second loading screen to distract victims while injecting malware via a malicious Python script.
QNAP warns its NetBak PC Agent users to patch a critical ASP.NET Core flaw (CVSS 9.8) that allows attackers to hijack credentials via HTTP request smuggling.
Microsoft Teams is rolling out a new opt-in feature in December to automatically detect if employees are in the office by monitoring their Wi-Fi connection.
Elon Musk's xAI launched Grokipedia, an AI-generated encyclopedia powered by Grok that aims to challenge Wikipedia's bias with transparent sourcing
X is retiring the Twitter.com domain, requiring users with passkeys or security keys to re-enroll by Nov 10 to avoid being locked out of their accounts.
Amazon is reportedly planning to cut 30,000 corporate jobs across logistics, payments, and AWS as part of a major post-pandemic cost reduction effort.
Starting Nov 3, all new Firefox extensions must explicitly declare whether they collect user data. By mid-2026, this disclosure will be mandatory for all add-ons.
The Python Software Foundation (PSF) declined a $1.5M federal grant for security, citing US government stipulations that banned promoting DEI programs.
Google denies claims of a mass Gmail breach, clarifying that a new HIBP dump of 183M credentials stems from third-party infostealer malware, not a platform hack.
Cisco Talos reports Qilin RaaS is one of 2025’s biggest threats (40+ victims/month), abusing Cyberduck and Backblaze for data exfiltration and exploiting WDigest to steal admin passwords.
Kaspersky found a Chrome zero-day (CVE-2025-2783) and sandbox bypass being exploited by Operation ForumTroll to deploy Memento Labs (Hacking Team) commercial Dante spyware against Russian targets.
A High-severity OpenVPN flaw (CVE-2025-10680) in beta versions allows script injection on Unix-like clients (Linux, macOS). Malicious DNS/DHCP arguments can execute arbitrary commands on the client side.
Doctor Web exposed Android.Backdoor.Baohuo.1.origin, a malware hiding in a Telegram X clone. It uses a Redis database for C2, infects 58K+ devices, and steals crypto wallet info from the clipboard.
Lab52 exposed Lazarus Group using DreamLoader malware via fake job lures. The modular tool chain abuses DLL sideloading and the Microsoft Graph API for stealthy C2 communications.
Trellix exposed SideWinder APT's campaign against South Asian diplomacy. It uses PDF/ClickOnce lures with a signed MagTek binary to deploy StealerBot for deep intelligence collection.
Apache patched three flaws in Tomcat 9/10/11: CVE-2025-55752 risks RCE by bypassing security constraints. CVE-2025-55754 allows ANSI escape sequence injection in Windows logs.
Arctic Wolf exposed Caminho, a Brazilian Loader-as-a-Service that hides .NET payloads in images via LSB steganography. It operates filelessly and is deployed via phishing and legitimate Archive.org.
GhostGrab is a hybrid Android malware that steals banking credentials and OTPs via phishing WebView overlays while secretly running a Monero miner in the background to monetize the victim's device.
Netskope found the RedTiger Python tool repurposed as an infostealer targeting gamers. It uses Discord injection to steal tokens/payment data and GoFile for anonymous data exfiltration, spamming files/processes for evasion.
iOS 26.1 introduces a new PhotoKit feature that allows third-party apps like Google Photos to upload media seamlessly in the background, even when the phone is locked.
Microsoft’s latest Bing Wallpaper update covertly launches Bing Search when users click the desktop, appearing to artificially inflate the search engine’s traffic.
cybernewswire
London, United Kingdom, 27th October 2025, CyberNewsWire