Tag: 2025-11-27

9 Attack Reports | 56 Vulnerabilities

Attack reports

Over 2,000 Holiday-Themed Fake Stores Detected Exploiting Black Friday and Festive Sales

Two clusters of holiday-themed fake online stores have been identified ahead of Black Friday and other festive sales. The first cluster includes over 750 interconnected sites using uniform holiday banners and misleading trust indicators, many impersonating Amazon. The second cluster spans a .shop e…
phishing
social engineering
typosquatting
financial data theft
2025-11-27
fake online stores
holiday shopping fraud
black friday scams
e-commerce impersonation
Published: November 27, 2025
Downloadable IOCs: 71

Analysis of the Lumma infostealer

The Lumma infostealer is a sophisticated malware distributed as Malware-as-a-Service, targeting Windows systems. It primarily steals sensitive data such as browser credentials, cryptocurrency wallets, and VPN/RDP accounts. Lumma is often used in the initial stages of multi-vector attacks, including…
phishing
windows
infostealer
credential theft
autoit
nsis
lumma
maas
process hollowing
2025-11-27
Published: November 27, 2025
Downloadable IOCs: 3

Striking Panda Attacks: APT31 Today

APT31, a Chinese cyber espionage group, has been actively targeting the Russian IT sector from 2024 to 2025, particularly companies working as contractors for government agencies. The group uses sophisticated tactics to remain undetected, including leveraging cloud services as command and control i…
malware
cyber espionage
chinese
data exfiltration
cloudsorcerer
grewapacha
cloud services
2025-11-27
localplugx
coffproxy
vtchatter
it sector
onedrivedoor
cloudyloader
auftime
government contractors
yaleak
Published: November 27, 2025
Downloadable IOCs: 6

Hidden Google Play Adware Drains Devices and Disrupts Millions of Users

A large-scale Android adware campaign dubbed 'GhostAd' has been uncovered, affecting millions of users primarily in East and Southeast Asia. The campaign involved multiple apps on Google Play that appeared harmless but created persistent background advertising engines, draining device resources and…
android
persistence
adware
google play
east asia
southeast asia
2025-11-27
advertising sdks
ghostad
app removal
resource drain
Published: November 27, 2025
Downloadable IOCs: 5

Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems

The Shai-hulud 2.0 campaign features an advanced malware variant that steals credentials and secrets from major cloud platforms and developer services. It automates the backdooring of NPM packages maintained by victims, enabling rapid propagation across the software supply chain. The malware target…
supply chain
cloud
credential theft
azure
npm
aws
github
shai-hulud
2025-11-27
gcp
Published: November 27, 2025
Downloadable IOCs: 6

Defending Against Sha1-Hulud: The Second Coming

A new variant of the NPM supply chain attack, dubbed Sha1-Hulud, has emerged with enhanced capabilities. Unlike its predecessor, this attack executes in the preinstall phase, targeting popular packages such as Postman, Zapier, and AsyncAPI. The malware harvests credentials across AWS, Azure, and GC…
persistence
npm
supply chain attack
package compromise
2025-11-27
github actions
sha1-hulud
cloud credentials
software development
Published: November 27, 2025
Downloadable IOCs: 3

Scattered Lapsus$ Hunters Take Aim At Zendesk Users

A new campaign potentially linked to the Scattered Lapsus$ Hunters group is targeting Zendesk users. Over 40 typosquatted Zendesk domains have been discovered, featuring organizations' names or brands. These domains host phishing pages designed to harvest credentials. The campaign also involves sub…
phishing
typosquatting
credential harvesting
remote access trojans
2025-11-27
customer service
saas platforms
zendesk
Published: November 27, 2025
Downloadable IOCs: 0

ShadowV2 Casts a Shadow Over IoT Devices

A new Mirai variant called ShadowV2 has been observed spreading through IoT vulnerabilities during a global AWS disruption. The malware targeted multiple countries and industries worldwide, exploiting vulnerabilities in devices from vendors like DD-WRT, D-Link, Digiever, TBK, and TP-Link. ShadowV2 …
vulnerability
ddos
iot
botnet
mirai
c2
aws
CVE-2024-10914
CVE-2024-10915
CVE-2024-53375
CVE-2023-52163
CVE-2024-3721
shadowv2
CVE-2020-25506
2025-11-27
CVE-2009-2765
CVE-2022-37055
Published: November 27, 2025
Linked vulnerabilities : CVE-2024-10914 (CVSS 8.1), CVE-2024-10915 (CVSS 8.1), CVE-2024-53375 (CVSS 8.0), CVE-2023-52163 (CVSS 5.9), CVE-2024-3721, CVE-2020-25506, CVE-2009-2765, CVE-2022-37055
Downloadable IOCs: 15

Shai-Hulud 2.0: Aggressive & Automated, One Of Fastest Spreading NPM Supply Chain Attacks Ever Observed

In November 2025, security researchers identified Shai-Hulud 2.0, an aggressive and automated supply-chain attack targeting the npm ecosystem. This second wave of the Shai-Hulud campaign demonstrated unprecedented automation and propagation speed, compromising hundreds of npm packages within hours.…
backdoor
worm
credential harvesting
npm
github
automation
supply-chain attack
2025-11-27
shai-hulud 2.0
Published: November 27, 2025
Downloadable IOCs: 4
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-12419

9.9
    Mattermost
  • Mattermost Server
Published: November 27, 2025

CVE-2025-12421

9.9
    Mattermost
  • Mattermost Server
Published: November 27, 2025

CVE-2025-13538

9.8
    findall_listing
Published: November 27, 2025

CVE-2025-13539

9.8
    findall_membership_plugin
Published: November 27, 2025

CVE-2025-13540

9.8
    tiare_membership
Published: November 27, 2025

CVE-2025-13675

9.8
    tiger
Published: November 27, 2025

CVE-2025-12140

9.3
    *
Published: November 27, 2025

CVE-2025-8890

9.3
    ne6037
Published: November 27, 2025

CVE-2024-5539

9.2
    alc_webctrl
    i-vu
Published: November 27, 2025

CVE-2025-0657

8.8
    i-vu_gen5_router
Published: November 27, 2025

CVE-2025-13680

8.8
    tiger_theme
Published: November 27, 2025

CVE-2025-13536

8.8
    powerpress
Published: November 27, 2025

CVE-2025-13757

8.8
    Devolutions
  • Devolutions Server
Published: November 27, 2025

CVE-2025-0658

8.7
    zone_controller
Published: November 27, 2025

CVE-2025-12758

7.7
    validator
Published: November 27, 2025

CVE-2025-66314

7.5
    elasticnet_ume
Published: November 27, 2025

CVE-2025-7820

7.5
    skt_paypal_for_woocommerce
Published: November 27, 2025

CVE-2025-59890

7.3
    galileo
Published: November 27, 2025

CVE-2025-13692

7.2
    unlimited_elements_for_elementor
Published: November 27, 2025

CVE-2024-5540

6.9
    alc_webctrl
    i-vu
Published: November 27, 2025

CVE-2025-13378

6.5
    plugin
Published: November 27, 2025

CVE-2025-12649

6.4
    sorttable_post
Published: November 27, 2025

CVE-2025-12666

6.4
    google_drive_upload_and_download_link_plugin
Published: November 27, 2025

CVE-2025-12670

6.4
    wp-twitpic
Published: November 27, 2025

CVE-2025-12712

6.4
    shouty
Published: November 27, 2025

CVE-2025-12713

6.4
    soundslides
Published: November 27, 2025

CVE-2025-12151

6.4
    simple_folio
Published: November 27, 2025

CVE-2025-12123

6.1
    customer_reviews_collector
Published: November 27, 2025

CVE-2025-13525

6.1
    wp_directory_kit
Published: November 27, 2025

CVE-2025-59025

6.1
    open-xchange
Published: November 27, 2025

CVE-2025-54057

6.1
    Apache
  • Skywalking
Published: November 27, 2025

CVE-2025-3784

5.5
    electric
Published: November 27, 2025

CVE-2025-30186

5.4
    application
Published: November 27, 2025

CVE-2025-30190

5.4
    office_documents
Published: November 27, 2025

CVE-2025-59026

5.4
    *
Published: November 27, 2025

CVE-2025-12579

5.3
    reuters_direct_plugin
Published: November 27, 2025

CVE-2025-13157

5.3
    wishlist_for_woocommerce
Published: November 27, 2025

CVE-2025-13441

5.3
    hide_category_by_user_role
Published: November 27, 2025

CVE-2025-12584

5.3
    quick_view
Published: November 27, 2025

CVE-2025-13381

5.3
    chatgpt_content_generator
Published: November 27, 2025

CVE-2025-13762

4.8
    cyberark_secure_web_sessions_extension
Published: November 27, 2025

CVE-2025-59302

4.7
    Apache
  • Cloudstack
Published: November 27, 2025

CVE-2025-12185

4.4
    plugin
    stafflist
Published: November 27, 2025

CVE-2025-12578

4.3
    reuters_direct
Published: November 27, 2025

CVE-2025-13143

4.3
    poll_survey_quiz_maker
Published: November 27, 2025

CVE-2025-10476

4.3
    wp_fastest_cache
Published: November 27, 2025

CVE-2025-59454

4.3
    Apache
  • Cloudstack
Published: November 27, 2025

CVE-2025-12971

4.3
    folders
Published: November 27, 2025

CVE-2025-13765

4.3
    Devolutions
  • Devolutions Server
Published: November 27, 2025

CVE-2025-12559

4.3
    Mattermost
  • Mattermost Server
Published: November 27, 2025

CVE-2025-66040

3.6
    spotipy
Published: November 27, 2025

CVE-2025-13758

3.5
    Devolutions
  • Devolutions Server
Published: November 27, 2025

CVE-2025-13742

2.4
    pretix
Published: November 27, 2025

CVE-2025-34351

None
    ray
Published: November 27, 2025

CVE-2025-3261

None
    thingsboard
Published: November 27, 2025

CVE-2025-13338

None
    gitlab
Published: November 27, 2025
Click here to see more Vulnerabilities