Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

Turn Insights Into Action with Free Threat Intel

This Edition’s Articles

In these late October 2025 cyber threat reports, global research teams uncovered an active mix of espionage, phishing, and data-theft operations. Highlights this period include North Korea’s EtherHiding and Contagious Interview campaigns, new exploits such as the Oracle EBS zero-day, COLDRIVER and Lazarus-linked attacks, and mobile threats like Pixnapping targeting Android users. Together, these findings reveal how rapidly evolving malware, cloud intrusions, and supply-chain compromises continue to test defenders’ visibility and response.

Want more articles? Check out the previous edition of Security Signals here. 

Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

Turn Insights Into Action with Free Threat Intel

This Edition’s Articles

Want more articles? Check out the previous edition of Security Signals here. 

Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

Turn Insights Into Action with Free Threat Intel

This Edition’s Articles

Want more articles? Check out the previous edition of Security Signals here. Want to dive deeper into DDoS Attacks, Check out the Malware Patrol Blog Post: Spoofed DDoS Attacks and BCP 38.

Welcome to your biweekly digest of curated cybersecurity intelligence.

Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.

For more articles, check out our #onpatrol4malware blog.

Turn Insights Into Action with Free Threat Intel

This Edition’s Articles

Want more articles? Check out the previous edition of Security Signals here.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

New Flodrix Botnet Variant Exploits Langflow AI Server RCE Bug to Launch DDoS Attacks

Source: The Hacker News

Cybersecurity researchers have identified a campaign exploiting a critical security flaw in Langflow to distribute the Flodrix botnet malware. This involves CVE-2025-3248, a missing authentication flaw in Langflow, allowing attackers to execute downloader scripts on compromised servers to install Flodrix. Read more.

Clone, Compile, Compromise: Water Curse’s Open-Source Malware Trap on GitHub

Source: TREND MICRO

Water Curse is a newly discovered threat actor using weaponized GitHub repositories to spread multistage malware. The malware enables data exfiltration, including credentials and browser data, and poses a significant supply chain risk, particularly affecting cybersecurity professionals, game developers, and DevOps teams reliant on open-source tools. Read more.

Tycoon 2FA: An Evolving Phishing Kit Powering PhaaS Threats

Source: SOCRadar

Cybercriminals are using Tycoon 2FA in recent phishing campaigns to create deceptive login pages that mimic trusted services like Microsoft 365. This Phishing-as-a-Service kit allows attackers to bypass Multi-Factor Authentication by stealing session cookies, granting unauthorized access to accounts despite existing security measures. Read more.

PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud Environments

Source: The Hacker News

Cybersecurity researchers have identified several npm packages laced with malware, capable of executing remote code and downloading additional malicious payloads. Although these packages, including eslint-config-airbnb-compat, ts-runtime-compat-check, solders, and @mediawave/lib, have been removed from the registry, they were downloaded hundreds of times before their removal. Read more.

Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper

Source: TREND MICRO

Anubis is a rising Ransomware-as-a-Service (RaaS) operation that uniquely combines file encryption with an optional “wipe mode” feature, allowing for permanent file deletion if the ransom is not paid. It operates a versatile affiliate program with negotiable revenue shares, enabling further monetization through data extortion and access sales. Read more.

Microsoft confirms auth issues affecting Microsoft 365 users

Source: BLEEPING COMPUTER

Microsoft is currently investigating an issue with M365 authentication features. It’s affecting users’ experiences, specifically causing errors during self-service password resets and when managing authentication methods. Administrators are also facing difficulties adding MFA sign-in methods. Read more.

Understanding Katz Stealer Malware and Its Credential Theft Capabilities

Source: PICUS

Katz Stealer is a newly discovered information-stealing MaaS, featuring aggressive credential theft, system fingerprinting, and stealthy persistence methods. This analysis explores its infection chain, obfuscation techniques, credential theft mechanisms, C2 behavior, and persistence strategies, providing key IOCs and insights for effective detection and defense. Read more.

Password-spraying attacks target 80,000 Microsoft Entra ID accounts

Source: BLEEPING COMPUTER

Hackers have used the TeamFiltration pentesting framework to target over 80,000 Microsoft Entra ID accounts globally, with the campaign reaching its peak on January 8 by attacking 16,500 accounts in just one day. Researchers from Proofpoint have attributed this activity, which began last December and has compromised numerous accounts, to a threat actor known as UNK_SneakyStrike. Read more.

Google suffers cloud outage, causing disruptions for OpenAI, Shopify and other services

Source: CNBC

Google’s cloud faced widespread outages on Thursday, affecting many major internet services, with disruptions starting at 10:51 a.m. PT. By Thursday evening, Kurian confirmed on X that all services were fully operational again. Read more.

GhostVendors Exposed: Silent Push Uncovers Massive Network of 4000+ Fraudulent Domains Masquerading as Major Brands

Source: SILENT PUSH

Threat analysts at Silent Push have uncovered the “GhostVendors” scam, involving online ads that impersonate major brands and spoof real products across thousands of fraudulent websites. This operation, spanning over 4,000 domains, poses a significant threat to social networks, well-known brands, advertising firms, and consumers globally. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

New Linux Vulnerabilities Expose Password Hashes via Core Dumps

Source: Infosecurity Magazine

Two local information-disclosure vulnerabilities have been identified in popular Linux crash-reporting tools, allowing attackers to access sensitive system data. The vulnerabilities impact Apport on Ubuntu and systemd-coredump on Red Hat Enterprise Linux (RHEL) and Fedora. Read more.

Crocodilus Mobile Malware: Evolving Fast, Going Global

Source: Threat Fabric

In March 2025, researchers discovered Crocodilus, a new device-takeover Android banking Trojan entering the threat landscape. The first observed samples were mostly related to test campaigns, with sporadic instances of live campaigns. Ongoing monitoring of the threat landscape revealed a growing number of campaigns and continuous development of the Trojan. Read more.

A mysterious leaker is exposing ransomware hackers to the world

Source: TechRadar

A mysterious leaker has been spotted unveiling the identities of some of the world’s most wanted cybercriminals, including the masterminds behind Conti and Trickbot ransomware, infamous groups responsible for some of the biggest extortions in modern history. Read more.

Pro-Ukraine hacker group Black Owl poses ‘major threat’ to Russia, Kaspersky says

Source: The Record

BO Team, also known as Black Owl, has been active since early 2024 and appears to operate independently, with its own arsenal of tools and tactics, researchers at Russian cybersecurity firm Kaspersky said. Read more.

Cybercriminals camouflaging threats as AI tool installers

Source: Cisco Talos

Talos has recently uncovered multiple threats masquerading as AI solutions being circulated in the wild, including the CyberLock and Lucky_Gh0$t ransomware families, along with a newly discovered destructive malware, dubbed “Numero.” The legitimate versions of these AI tools are particularly popular within the B2B sales domain and the technology and marketing sectors. Read more.

Monkey-Patched PyPI Packages Use Transitive Dependencies to Steal Solana Private Keys

Source: Socket

Once imported, the malware monkey-patches Solana key-generation methods by modifying functions at runtime without altering the original source code. Each time a keypair is generated, the malware captures the private key. It then encrypts the key using a hardcoded RSA?2048 public key and encodes the result in Base64. Read more.

Your AI Notetaker Might Be a Liability: Insights from Stealer Logs

Source: SOCRadar

Using AI note-taking tools can be incredibly helpful but they also come with some serious legal and ethical responsibilities. Organizations need to think about how these tools collect, store, and use data, and how the output might influence decisions or impact privacy. If you’re choosing a transcription service, make sure it follows data privacy laws and uses secure, well-managed systems. Read more.

Tracking AyySSHush: a Newly Discovered ASUS Router Botnet Campaign

Source: Censys

A new, stealthy ASUS router botnet, dubbed AyySSHush, abuses trusted firmware features through a multi-stage attack sequence to backdoor routers and persist across firmware updates, evading traditional detection methods. Read more.

Police takes down AVCheck site used by cybercriminals to scan malware

Source: BLEEPING COMPUTER

An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in the wild. The service’s official domain at avcheck.net now displays a seizure banner with the crests of the U.S. Department of Justice, the FBI, the U.S. Secret Service, and the Dutch police (Politie). Read more.

Russian-linked hackers target UK Defense Ministry while posing as journalists

Source: KYIV Independent

Russian-linked hackers targeted U.K. Defense Ministry staff in an espionage operation while posing as journalists, Sky News reported on May 29, citing the British government. The cyber attack was detected and thwarted, the government said. Read more.

Welcome to our biweekly cybersecurity roundup. In these blog posts, we feature curated articles and insights from experts, providing you with valuable information on the latest cybersecurity threats, technologies, and best practices to keep yourself and your organization safe. Whether you’re a cybersecurity professional or a concerned individual, our biweekly blog post is designed to keep you informed and empowered.

For more articles, check out our #onpatrol4malware blog.

SEC SIM-swapper who Googled ‘signs that the FBI is after you’ put behind bars

Source: The Register

An Alabama man who SIM-swapped his way into the SEC’s official X account, enabling a fake ETF announcement that briefly pumped Bitcoin, has been sentenced to 14 months in prison and three years of supervised release. Prior to his conviction and sentencing on Friday, Eric Council Jr., 26, of Huntsville, Alabama, proved once again that cybercriminals are very bad at internet search hygiene. Read more.

Hackers Exploit AutoIT Scripts to Deploy Malware Targeting Windows Systems

Source: GBHackers

Often compared to .NET for its persistence in malicious campaigns, AutoIT’s simplicity and ability to interact with Windows components make it a favored tool among cybercriminals. This weekend, a particularly intricate malware delivery mechanism was identified, featuring a double-layered AutoIT script designed to deploy a potentially devastating payload. Read more.

Malware of the Day – C2 over ICMP (ICMP-GOSH)

Source: ACTIVE COUNTER MEASURES

The potential for ICMP to be used as a C2 channel is often overlooked precisely because it is such a foundational troubleshooting protocol, integral to the normal functioning of network communication. Many people view it as “background chatter”, not considering its potential to be intentionally leveraged to carry data for this exact reason. Read more.

Backdoor implant discovered on PyPI posing as debugging utility

Source: REVERSING LABS

On Tuesday, the RL threat research team detected a newly uploaded malicious package that poses as a Python debugging utility. When installed, the package implants a backdoor on the developer’s system, enabling malicious actors to execute malicious code and exfiltrate sensitive data. Read more.

Ransomware gangs increasingly use Skitnet post-exploitation malware

Source: BLEEPING COMPUTER

Ransomware gang members increasingly use a new malware called Skitnet (“Bossnet”) to perform stealthy post-exploitation activities on breached networks. The malware has been offered for sale on underground forums like RAMP since April 2024, but according to Prodaft researchers, it started gaining significant traction among ransomware gangs since early 2025. Read more.

Researchers Expose New Intel CPU Flaws Enabling Memory Leaks and Spectre v2 Attacks

Source: The Hacker News

The vulnerability, referred to as Branch Privilege Injection (BPI), “can be exploited to misuse the prediction calculations of the CPU (central processing unit) in order to gain unauthorized access to information from other processor users,” ETH Zurich said. Read more.

Android users bombarded with unskippable ads

Source: Malwarebytes Labs

Researchers have discovered a very versatile ad fraud network—known as Kaleidoscope—that bombards users with unskippable ads. Kaleidoscope targets Android users through seemingly legitimate apps in the Google Play Store, as well as malicious lookalikes distributed through third-party app stores. Read more.

Operation RoundPress

Source: welivesecurity

In Operation RoundPress, the compromise vector is a spearphishing email leveraging an XSS vulnerability to inject malicious JavaScript code into the victim’s webmail page. In 2023, Operation RoundPress only targeted Roundcube, but in 2024 it expanded to other webmail software including Horde, MDaemon, and Zimbra. Read more.

GovDelivery, an email alert system used by governments, abused to send scam messages

Source: TechCrunch

An email notification system used by U.S. federal and state government departments to alert residents to important information has been used to send scam emails, TechCrunch has learned. Read more.

APT GROUP123

Source: CYFIRMA

Group123 is a North Korean state-sponsored APT group active since at least 2012. It is also tracked under other names such as APT37, Reaper, and ScarCruft by various cybersecurity firms. The group is known for its cyber espionage campaigns primarily targeting South Korea, however since 2017 it has expanded its operations to Japan, Vietnam, the Middle East, and other regions. Read more.