Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Malicious VSX Extension “SleepyDuck” Uses Ethereum to Keep Its Command Server Alive
Published: 2025-11-03
Cybersecurity researchers have flagged a new malicious extension in the Open VSX registry that harbors a remote access trojan called SleepyDuck, which was updated on November 1, 2025, to include malicious capabilities after gaining downloads. The malware includes sandbox evasion techniques and utilizes an Ethereum contract to update its command and control address if the original is taken down.
2. Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks
Published: 2025-11-03
Bad actors are targeting trucking and logistics companies by infecting them with remote monitoring and management software to steal cargo freight, collaborating with organized crime groups since at least June 2025. The campaigns focus on food and beverage products, with stolen cargo likely sold online or shipped overseas.
3. Researchers Uncover BankBot-YNRK and DeliveryRAT Android Trojans Stealing Financial Data
Published: 2025-11-03
Cybersecurity researchers analyzed Android trojans BankBot-YNRK and DeliveryRAT that harvest sensitive data, with BankBot-YNRK using evasion techniques to check for virtual environments and specific devices like Google Pixel or Samsung models. The malware targets devices, including those from Oppo running ColorOS, to steal financial information.
4. New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea
Published: 2025-11-03
The North Korea-linked Kimsuky group distributed the undocumented HttpTroy backdoor via a spear-phishing email with a ZIP file masquerading as a VPN invoice, targeting a single victim in South Korea. The attack chain involves a dropper, MemLoad loader, and the backdoor for file transfer, screenshots, and command execution.
5. New TruffleNet BEC Campaign Leverages AWS SES Using Stolen Credentials to Compromise 800+ Hosts
Published: 2025-11-03
Identity compromise has become one of the most significant threats facing cloud infrastructure, particularly when attackers gain access to legitimate credentials. These valid access keys are being used in the TruffleNet BEC campaign to leverage AWS SES and compromise over 800 hosts.
6. Hackers Can Manipulate Claude AI APIs with Indirect Prompts to Steal User Data
Published: 2025-11-03
Hackers can exploit Anthropic’s Claude AI to steal sensitive user data by leveraging the model’s newly added network capabilities in its Code Interpreter tool through indirect prompt attacks.
7. Microsoft Patch for WSUS Vulnerability has Broken Hotpatching on Windows Server 2025
Published: 2025-11-03
In a recent setback for Windows administrators, Microsoft’s October 2025 security update addressing a critical vulnerability in Windows Server Update Services (WSUS) has inadvertently broken hotpatching on Windows Server 2025.
8. Beware of New Phishing Attack that Abuses Cloudflare and ZenDesk Pages to Steal Logins
Published: 2025-11-03
A sophisticated phishing campaign has emerged, exploiting the trust placed in legitimate cloud hosting services, with threat actors leveraging Cloudflare Pages and ZenDesk platforms to steal login credentials.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider advanced threat intelligence platforms alongside employee training programs to strengthen your organization’s resilience. Stay safe online!