TECHZONE™

Sneaky 2FA Phishing Kit Adds BitB Pop-ups Designed to Mimic the Browser Address Bar https://thehackernews.com/2025/11/sneaky-2fa-phishing-kit-adds-bitb-pop.html The malware authors associated with a Phishing-as-a-Service (PhaaS) kit known as Sneaky 2FA have incorporated Browser-in-the-Browser (BitB) functionality into their arsenal, underscoring the continued evolution of such offerings and further making it easier for less-skilled threat actors to mount attacks at scale. Push Security, in a report shared with The Hacker News, said it observed the use

Seven npm Packages Use Adspect Cloaking to Trick Victims Into Crypto Scam Pages https://thehackernews.com/2025/11/seven-npm-packages-use-adspect-cloaking.html Cybersecurity researchers have discovered a set of seven npm packages published by a single threat actor that leverages a cloaking service called Adspect to differentiate between real victims and security researchers to ultimately redirect them to sketchy crypto-themed sites. The malicious npm packages, published by a threat actor named "dino_reborn" between September and November 2025, are

Microsoft Mitigates Record 15.72 Tbps DDoS Attack Driven by AISURU Botnet https://thehackernews.com/2025/11/microsoft-mitigates-record-572-tbps.html Microsoft on Monday disclosed that it automatically detected and neutralized a distributed denial-of-service (DDoS) attack targeting a single endpoint in Australia that measured 15.72 terabits per second (Tbps) and nearly 3.64 billion packets per second (pps). The tech giant said it was the largest DDoS attack ever observed in the cloud, and that it originated from a TurboMirai-class Internet of

What if your romantic AI chatbot can’t keep a secret? https://www.welivesecurity.com/en/privacy/romantic-ai-chatbot-keep-secret/ Does your chatbot know too much? Think twice before you tell your AI companion everything.

Google Issues Security Fix for Actively Exploited Chrome V8 Zero-Day Vulnerability https://thehackernews.com/2025/11/google-issues-security-fix-for-actively.html Google on Monday released security updates for its Chrome browser to address two security flaws, including one that has come under active exploitation in the wild. The vulnerability in question is CVE-2025-13223 (CVSS score: 8.8), a type confusion vulnerability in the V8 JavaScript and WebAssembly engine that could be exploited to achieve arbitrary code execution or program crashes. "Type

New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT https://thehackernews.com/2025/11/new-evalusion-clickfix-campaign.html Cybersecurity researchers have discovered malware campaigns using the now-prevalent ClickFix social engineering tactic to deploy Amatera Stealer and NetSupport RAT. The activity, observed this month, is being tracked by eSentire under the moniker EVALUSION. First spotted in June 2025, Amatera is assessed to be an evolution of ACR (short for "AcridRain") Stealer, which was available under the

⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More https://thehackernews.com/2025/11/weekly-recap-fortinet-exploited-chinas.html This week showed just how fast things can go wrong when no one’s watching. Some attacks were silent and sneaky. Others used tools we trust every day — like AI, VPNs, or app stores — to cause damage without setting off alarms. It’s not just about hacking anymore. Criminals are building systems to make money, spy, or spread malware like it’s a business. And in some cases, they’re using the same

5 Reasons Why Attackers Are Phishing Over LinkedIn https://thehackernews.com/2025/11/5-reasons-why-attackers-are-phishing.html Phishing attacks are no longer confined to the email inbox, with 1 in 3 phishing attacks now taking place over non-email channels like social media, search engines, and messaging apps. LinkedIn in particular has become a hotbed for phishing attacks, and for good reason. Attackers are running sophisticated spear-phishing attacks against company executives, with recent campaigns seen targeting

Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT https://thehackernews.com/2025/11/dragon-breath-uses-roningloader-to.html The threat actor known as Dragon Breath has been observed making use of a multi-stage loader codenamed RONINGLOADER to deliver a modified variant of a remote access trojan called Gh0st RAT. The campaign, which is primarily aimed at Chinese-speaking users, employs trojanized NSIS installers masquerading as legitimate like Google Chrome and Microsoft Teams, according to Elastic Security Labs. "The

Rust Adoption Drives Android Memory Safety Bugs Below 20% for First Time https://thehackernews.com/2025/11/rust-adoption-drives-android-memory.html Google has disclosed that the company's continued adoption of the Rust programming language in Android has resulted in the number of memory safety vulnerabilities falling below 20% of total vulnerabilities for the first time. "We adopted Rust for its security and are seeing a 1000x reduction in memory safety vulnerability density compared to Android’s C and C++ code. But the biggest surprise was

RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet https://thehackernews.com/2025/11/rondodox-exploits-unpatched-xwiki.html The botnet malware known as RondoDox has been observed targeting unpatched XWiki instances against a critical security flaw that could allow attackers to achieve arbitrary code execution. The vulnerability in question is CVE-2025-24893 (CVSS score: 9.8), an eval injection bug that could allow any guest user to perform arbitrary remote code execution through a request to the "/bin/get/Main/

Five Plead Guilty in U.S. for Helping North Korean IT Workers Infiltrate 136 Companies https://thehackernews.com/2025/11/five-us-citizens-plead-guilty-to.html The U.S. Department of Justice (DoJ) on Friday announced that five individuals have pleaded guilty to assisting North Korea's illicit revenue generation schemes by enabling information technology (IT) worker fraud in violation of international sanctions. The five individuals are listed below - Audricus Phagnasay, 24 Jason Salazar, 30 Alexander Paul Travis, 34 Oleksandr Didenko, 28, and Erick

How password managers can be hacked – and how to stay safe https://www.welivesecurity.com/en/cybersecurity/password-managers-under-attack-what-you-should-know/ Look no further to learn how cybercriminals could try to crack your vault and how you can keep your logins safe

North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels https://thehackernews.com/2025/11/north-korean-hackers-turn-json-services.html The North Korean threat actors behind the Contagious Interview campaign have once again tweaked their tactics by using JSON storage services to stage malicious payloads. "The threat actors have recently resorted to utilizing JSON storage services like JSON Keeper, JSONsilo, and npoint.io to host and deliver malware from trojanized code projects, with the lure," NVISO researchers Bart Parys, Stef

Iranian Hackers Launch ‘SpearSpecter’ Spy Operation on Defense & Government Targets https://thehackernews.com/2025/11/iranian-hackers-launch-spearspecter-spy.html The Iranian state-sponsored threat actor known as APT42 has been observed targeting individuals and organizations that are of interest to the Islamic Revolutionary Guard Corps (IRGC) as part of a new espionage-focused campaign. The activity, detected in early September 2025 and assessed to be ongoing, has been codenamed SpearSpecter by the Israel National Digital Agency (INDA). "The

Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks https://thehackernews.com/2025/11/researchers-find-serious-ai-bugs.html Cybersecurity researchers have uncovered critical remote code execution vulnerabilities impacting major artificial intelligence (AI) inference engines, including those from Meta, Nvidia, Microsoft, and open-source PyTorch projects such as vLLM and SGLang. "These vulnerabilities all traced back to the same root cause: the overlooked unsafe use of ZeroMQ (ZMQ) and Python's pickle deserialization,"

Now-Patched Fortinet FortiWeb Flaw Exploited in Attacks to Create Admin Accounts https://thehackernews.com/2025/11/fortinet-fortiweb-flaw-actively.html Cybersecurity researchers are sounding the alert about an authentication bypass vulnerability in Fortinet Fortiweb WAF that could allow an attacker to take over admin accounts and completely compromise a device. "The watchTowr team is seeing active, indiscriminate in-the-wild exploitation of what appears to be a silently patched vulnerability in Fortinet's FortiWeb product," Benjamin Harris,

Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns https://thehackernews.com/2025/11/ransomwares-fragmentation-reaches.html Key Takeaways: 85 active ransomware and extortion groups observed in Q3 2025, reflecting the most decentralized ransomware ecosystem to date. 1,590 victims disclosed across 85 leak sites, showing high, sustained activity despite law-enforcement pressure. 14 new ransomware brands launched this quarter, proving how quickly affiliates reconstitute after takedowns. LockBit’s reappearance with

Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign https://thehackernews.com/2025/11/chinese-hackers-use-anthropics-ai-to.html State-sponsored threat actors from China used artificial intelligence (AI) technology developed by Anthropic to orchestrate automated cyber attacks as part of a "highly sophisticated espionage campaign" in mid-September 2025. "The attackers used AI's 'agentic' capabilities to an unprecedented degree – using AI not just as an advisor, but to execute the cyber attacks themselves," the AI upstart

Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data https://thehackernews.com/2025/11/russian-hackers-create-4300-fake-travel.html A Russian-speaking threat behind an ongoing, mass phishing campaign has registered more than 4,300 domain names since the start of the year. The activity, per Netcraft security researcher Andrew Brandt, is designed to target customers of the hospitality industry, specifically hotel guests who may have travel reservations with spam emails. The campaign is said to have begun in earnest around