Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Legacy Python Bootstrap Scripts Create Domain-Takeover Risk in Multiple PyPI Packages
Published: 2025-11-28
Cybersecurity researchers discovered vulnerable code in legacy Python packages on PyPI that could enable supply chain compromises through domain takeover attacks via bootstrap scripts fetching from the now-defunct python-distribute.org domain. The affected packages include tornado, pypiserver, slapos.core, roman, and others, as identified by ReversingLabs.
2. North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware
Published: 2025-11-28
North Korean actors behind the Contagious Interview campaign have released 197 malicious npm packages, downloaded over 31,000 times, to deliver a new OtterCookie variant combining BeaverTail features for evading detection and establishing C2 channels. The packages, such as bcryptjs-node and cross-sessions, enable remote shell access, data theft, and surveillance.
3. MS Teams Guest Access Can Remove Defender Protection When Users Join External Tenants
Published: 2025-11-28
A cross-tenant vulnerability in Microsoft Teams allows guest users to bypass Defender for Office 365 protections, as security is managed by the hosting tenant rather than the home organization. This issue is exacerbated by a new feature enabling email-based chats with external users, set for global availability by January 2026.
4. Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan
Published: 2025-11-27
The Bloody Wolf threat actor has targeted finance, government, and IT sectors in Kyrgyzstan and Uzbekistan since June 2025 using social engineering with fake Ministry of Justice PDFs to deliver NetSupport RAT via malicious JAR files. Group-IB notes the campaign’s low-profile approach combining accessible tooling for effective persistence.
5. Microsoft to Block Unauthorized Scripts in Entra ID Logins with 2026 CSP Update
Published: 2025-11-27
Microsoft plans to enhance Entra ID security by updating its Content Security Policy in 2026 to block unauthorized script injections, allowing only scripts from trusted Microsoft domains during browser-based sign-ins at login.microsoftonline.com. The change targets authentication experiences and excludes Entra ID External ID.
6. ThreatsDay Bulletin: AI Malware, Voice Bot Flaws, Crypto Laundering, IoT Attacks — and 20 More Stories
Published: 2025-11-27
This week’s bulletin covers threats like Mirai-based ShadowV2 botnet targeting IoT devices during an AWS outage, alongside AI-powered malware, voice bot vulnerabilities, and crypto laundering operations. Governments and security teams are responding by shutting down fake networks and tightening defenses against evolving scams.
7. Gainsight Expands Impacted Customer List Following Salesforce Security Alert
Published: 2025-11-27
Gainsight revealed that suspicious activity in its Salesforce-connected applications, initially affecting 3 customers, has expanded to a larger undisclosed number, with only a handful confirmed to have data impacted. The incident, claimed by ShinyHunters, led to revoked tokens and precautionary suspensions by Zendesk, Gong.io, and HubSpot.
8. Shai-Hulud v2 Spreads From npm to Maven, as Campaign Exposes Thousands of Secrets
Published: 2025-11-26
The Shai-Hulud v2 supply chain attack has expanded to Maven Central with a compromised package org.mvnpm:posthog-node:4.18.1 embedding the same payload as affected npm packages, compromising over 830 packages and exposing secrets. Socket Research notes this involves automated rebuilding of npm artifacts into Maven format.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using reliable security tools to monitor and protect your systems. Stay safe online!