Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature
Published: 2025-11-10
Google’s Mandiant Threat Defense discovered n-day exploitation of a patched security flaw in Gladinet’s Triofox file-sharing platform, tracked as CVE-2025-12480 (CVSS score: 9.1), allowing attackers to bypass authentication and upload arbitrary payloads. The threat cluster UNC6485 weaponized the flaw starting August 24, 2025, despite patches released in version 16.7.10368.56560, marking the third active exploitation of Triofox flaws this year.
2. Konni Hackers Turn Google’s Find Hub into a Remote Data-Wiping Weapon
Published: 2025-11-10
North Korea-affiliated Konni threat actors targeted Android and Windows devices for data theft and remote control, impersonating counselors and activists with malware disguised as stress-relief programs. They exploited Google’s Find Hub to remotely reset devices and delete data, marking the first weaponization of legitimate management functions, with activity detected in early September 2025.
3. Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Published: 2025-11-10
A phishing campaign targeted the hospitality industry using compromised emails impersonating Booking.com to redirect victims to ClickFix pages and deploy PureRAT malware for credential theft. The attacks, active since April 2025, aim to access booking platforms like Booking.com or Expedia for fraud or sale on cybercrime forums.
4. GlassWorm Malware Discovered in Three VS Code Extensions with Thousands of Installs
Published: 2025-11-10
Three VS Code extensions, including ai-driven-dev.ai-driven-dev with 3,402 downloads, are linked to the GlassWorm campaign that harvests credentials from Open VSX, GitHub, and cryptocurrency wallets. The malware uses invisible Unicode characters to hide code and abuses credentials for further compromises.
5. Microsoft Uncovers ‘Whisper Leak’ Attack That Identifies AI Chat Topics in Encrypted Traffic
Published: 2025-11-08
Microsoft’s Whisper Leak attack allows adversaries to infer AI chat topics from encrypted traffic by observing network patterns. The side-channel vulnerability risks privacy in user and enterprise communications, exploitable by entities like ISPs or local network observers.
6. Samsung Mobile Flaw Exploited as Zero-Day to Deploy LANDFALL Android Spyware
Published: 2025-11-07
A patched flaw CVE-2025-21042 in Samsung Galaxy devices was exploited as a zero-day to deploy LANDFALL spyware in targeted attacks in the Middle East, including Iraq and Iran. The out-of-bounds write vulnerability in libimagecodec.quram.so allowed arbitrary code execution, addressed by Samsung in April 2025.
7. From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools
Published: 2025-11-07
China-linked hackers targeted a U.S. non-profit involved in policy influence, using exploits like CVE-2022-26134 and CVE-2021-44228 to gain network access in April 2025. The attack aimed for long-term persistence, though initial exploitation efforts showed no success.
8. Hidden Logic Bombs in Malware-Laced NuGet Packages Set to Detonate Years After Installation
Published: 2025-11-07
Nine malicious NuGet packages from “shanhai666,” downloaded 9,488 times, include time-delayed payloads set to activate in 2027 and 2028, targeting databases and industrial PLCs with sabotage mechanisms. The packages, like Sharp7Extend, cause process termination and write failures post-installation.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider implementing robust security measures like regular patching and threat monitoring to protect your digital assets. Stay safe online!