Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan
Published: 2025-11-27
The threat actor Bloody Wolf has expanded its cyber attacks from Kyrgyzstan to Uzbekistan since June 2025, targeting finance, government, and IT sectors by impersonating the Kyrgyzstan Ministry of Justice with malicious Java Archive files to deploy NetSupport RAT. Group-IB researchers noted that this social engineering tactic allows the group to maintain a low operational profile while effectively distributing malware.
2. Microsoft to Block Unauthorized Scripts in Entra ID Logins with 2026 CSP Update
Published: 2025-11-27
Microsoft plans to enhance Entra ID security by updating its Content Security Policy in 2026 to block unauthorized script injections during sign-ins at login.microsoftonline[.]com, allowing only scripts from trusted Microsoft domains. This change aims to protect against code injection attacks while limiting the policy to browser-based sign-in experiences and excluding Microsoft Entra External ID.
3. ThreatsDay Bulletin: AI Malware, Voice Bot Flaws, Crypto Laundering, IoT Attacks — and 20 More Stories
Published: 2025-11-27
This week’s bulletin covers a range of cyber threats, including a Mirai-based ShadowV2 botnet targeting IoT devices during an AWS outage in October 2025, alongside AI-powered malware, voice bot vulnerabilities, and crypto laundering schemes. It also discusses government and security responses, such as shutting down fake networks and tightening digital defenses against evolving scams.
4. Gainsight Expands Impacted Customer List Following Salesforce Security Alert
Published: 2025-11-27
Gainsight has revealed that suspicious activity in its applications, initially affecting three customers as per Salesforce, has expanded to a larger group by November 21, 2025, with only a handful confirmed to have data impacted. The incident, claimed by the ShinyHunters group, led to revoked access tokens and precautionary measures by affected platforms like Zendesk and HubSpot.
5. Shai-Hulud v2 Spreads From npm to Maven, as Campaign Exposes Thousands of Secrets
Published: 2025-11-26
The Shai-Hulud v2 supply chain attack has expanded from npm to Maven, compromising over 830 packages and exposing secrets through a compromised Maven Central package, org.mvnpm:posthog-node:4.18.1, which embeds malicious components. Socket Research noted that this involves automated rebuilding of npm packages as Maven artifacts, with PostHog project releases affected in both ecosystems.
6. Qilin Ransomware Turns South Korean MSP Breach Into 28-Victim ‘Korean Leaks’ Data Heist
Published: 2025-11-26
Qilin ransomware, potentially linked to North Korean actors, exploited a South Korean MSP breach to deploy ransomware, affecting 28 victims and marking a significant supply chain attack on the financial sector in September 2025. Bitdefender reported Qilin’s rapid growth, claiming over 180 victims in October 2025, making it responsible for 29% of ransomware attacks per NCC Group data.
7. Chrome Extension Caught Injecting Hidden Solana Transfer Fees Into Raydium Swaps
Published: 2025-11-26
The Chrome extension Crypto Copilot, with 12 installs, injects stealth Solana transfers during Raydium swaps, siphoning at least 0.0013 SOL or 0.05% of the trade to an attacker-controlled wallet via obfuscated code. Socket researcher Kush Pandya reported that the extension, published in May 2024, manipulates transactions without user awareness, remaining available on the Chrome Web Store.
8. RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware
Published: 2025-11-26
RomCom, attributed to Russia’s Unit 29155 (GRU), used SocGholish to deliver Mythic Agent malware to a U.S. civil engineering firm with Ukraine ties, marking the first such payload distribution by this JavaScript loader. Arctic Wolf Labs noted SocGholish’s role as an initial access broker for groups like Evil Corp and LockBit, enabling diverse payload deployments.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using advanced security tools to monitor and protect your digital assets. Stay safe online!