Tag: 2025-12-03

9 Attack Reports | 94 Vulnerabilities

Attack reports

4.3 Million Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign

A threat actor named ShadyPanda has been identified as responsible for a seven-year browser extension campaign that has infected 4.3 million Chrome and Edge users. The campaign includes two active operations: a 300,000-user RCE backdoor and a 4-million-user spyware operation. ShadyPanda's extension…
spyware
data exfiltration
malware campaign
chrome
edge
browser extension
trust exploitation
2025-12-03
infinity v+
clean master
wetab
rce backdoor
Published: December 3, 2025
Downloadable IOCs: 0

Albiriox Exposed: A New RAT Mobile Malware Targeting Global Finance and Crypto Wallets

Albiriox is a newly identified Android malware offered as Malware-as-a-Service, likely managed by Russian-speaking threat actors. It employs a two-stage deployment chain using dropper applications and packing techniques to evade detection. The malware exhibits advanced On-Device Fraud capabilities,…
rat
android
cryptocurrency
banking trojan
maas
evasion techniques
overlay attacks
on-device fraud
2025-12-03
vnc
albiriox
Published: December 3, 2025
Downloadable IOCs: 4

Bootstrap script exposes PyPI to domain takeover attacks

A vulnerability in legacy Python packages could enable an attack on PyPI through a domain compromise. The issue stems from bootstrap files for a build tool that installs the 'distribute' package, which fetch and execute an installation script from a now-available domain. Affected packages include t…
supply chain
vulnerability
open-source
pypi
domain takeover
bootstrap script
2025-12-03
python packaging
Published: December 3, 2025
Linked vulnerabilities : CVE-2023-45311
Downloadable IOCs: 2

DNS Uncovers Infrastructure Used in SSO Attacks

The threat actor leveraged Evilginx (likely version 3.0), an open source, advanced phishing adversary-in-the-middle (AITM, aka MITM) framework designed to steal login credentials and session cookies. Evilginx is widely used by cybercriminals to undermine multi-factor authentication (MFA) security, …
phishing
aitm
reverse proxy
evilginx
2025-12-03
tinyurl
mitm
sso
Published: December 3, 2025
Downloadable IOCs: 15

Operation DupeHike: Targeting Russian employees with DUPERUNNER and AdaptixC2

A campaign targeting Russian corporate entities, particularly HR, payroll, and administrative departments, has been uncovered. The attack uses realistic decoy documents themed around employee bonuses and financial policies. The malware ecosystem involves a malicious LNK file leading to an implant d…
process injection
c2 communication
spear-phishing
adaptixc2
2025-12-03
employee bonus lure
duperunner
russian corporate
Published: December 3, 2025
Downloadable IOCs: 12

Teams Social Engineering Attack: Threat Actors Impersonate IT to Steal Credentials via Quick Assist

A sophisticated social engineering attack utilizing Microsoft Teams' new 'Chat with Anyone' feature has been uncovered. Threat actors impersonated IT support to trick users into initiating Quick Assist sessions, ultimately leading to credential theft and potential data exfiltration. The attack invo…
phishing
social engineering
infostealer
credential theft
reconnaissance
microsoft teams
2025-12-03
quick assist
Published: December 3, 2025
Downloadable IOCs: 0

ValleyRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading

A ValleyRAT campaign is targeting job seekers through email, disguising itself as a Foxit PDF reader and using DLL side-loading for initial system access. The campaign exploits job seekers' eagerness by using recruitment-related lures in archive files. The attack employs sophisticated techniques, i…
social engineering
data theft
valleyrat
dll side-loading
remote access trojan
job seekers
2025-12-03
foxit pdf reader
Published: December 3, 2025
Downloadable IOCs: 25

Technical Analysis of Matanbuchus 3.0

Matanbuchus, a C++ malicious downloader offered as Malware-as-a-Service since 2020, has evolved to version 3.0. It comprises a downloader and main module, utilizing obfuscation techniques like junk code, encrypted strings, and API hashing. The malware implements anti-analysis features, including an…
backdoor
ransomware
rhadamanthys
matanbuchus
downloader
chacha20
netsupport rat
2025-12-03
Published: December 3, 2025
Downloadable IOCs: 5

Shai-Hulud V2 Poses Risk to NPM Supply Chain

A second wave of the Shai-Hulud malware campaign, dubbed 'The Second Coming', has emerged targeting the npm ecosystem. This advanced software supply chain attack has compromised over 700 npm packages and created more than 27,000 malicious GitHub repositories. Shai-Hulud V2 introduces critical advan…
backdoor
supply chain
worm
exfiltration
credential theft
github
2025-12-03
shai-hulud v2
Published: December 3, 2025
Downloadable IOCs: 3
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-13390

10.0
    Wpdirectorykit
  • Wp Directory Kit
Published: December 3, 2025

CVE-2025-55182

10.0
    Facebook
  • React
    Vercel
Published: December 3, 2025

CVE-2025-66489

9.9
    cal
Published: December 3, 2025

CVE-2025-13486

9.8
    advanced_custom_fields_extended
Published: December 3, 2025

CVE-2025-13342

9.8
    wordpress
    frontend_admin
Published: December 3, 2025

CVE-2024-32641

9.8
    Masacms
  • Masacms
Published: December 3, 2025

CVE-2025-64055

9.8
    Tenda
  • X210 Firmware
  • X210
Published: December 3, 2025

CVE-2025-66222

9.6
    Thinkinai
  • Deepchat
Published: December 3, 2025

CVE-2025-34319

9.3
    n300rt
    n300rt_firmware
Published: December 3, 2025

CVE-2025-65267

9.0
    Frappe
  • Erpnext
  • Frappe
Published: December 3, 2025

CVE-2025-12744

8.8
    abrt
Published: December 3, 2025

CVE-2025-57198

8.8
    Avtech
  • Dgm1104 Firmware
  • Dgm1104
Published: December 3, 2025

CVE-2025-57199

8.8
    Avtech
  • Dgm1104 Firmware
  • Dgm1104
Published: December 3, 2025

CVE-2025-57201

8.8
    Avtech
  • Dgm1104 Firmware
  • Dgm1104
Published: December 3, 2025

CVE-2024-32642

8.8
    Masacms
  • Masacms
Published: December 3, 2025

CVE-2025-33208

8.8
    tao
Published: December 3, 2025

CVE-2025-66032

8.7
    Anthropic
  • Claude Code
Published: December 3, 2025

CVE-2025-12385

8.7
    qt
    qt
    qt
Published: December 3, 2025

CVE-2025-50360

8.4
    Dannyvankooten
  • Pepper
Published: December 3, 2025

CVE-2025-20386

8.0
    Splunk
  • Splunk
    Microsoft
Published: December 3, 2025

CVE-2025-20387

8.0
    Splunk
  • Splunk
Published: December 3, 2025

CVE-2025-54065

7.9
    gzdoom
Published: December 3, 2025

CVE-2025-53841

7.8
    guardicore_platform_agent
    guardicore_platform_agent
    guardicore_platform_agent
Published: December 3, 2025

CVE-2025-66431

7.8
    plesk
    plesk
Published: December 3, 2025

CVE-2025-66411

7.8
    coder
    coder
    coder
Published: December 3, 2025

CVE-2025-7044

7.7
    Canonical
  • Maas
Published: December 3, 2025

CVE-2025-65843

7.7
    Acustica-Audio
  • Aquarius
Published: December 3, 2025

CVE-2025-65027

7.6
    rom_manager
    rom_manager
Published: December 3, 2025

CVE-2025-13646

7.5
    Wpchill
  • Modula Image Gallery
Published: December 3, 2025

CVE-2025-65320

7.5
    Abacre
  • Restaurant Point Of Sale
Published: December 3, 2025

CVE-2024-32643

7.5
    Masacms
  • Masacms
Published: December 3, 2025

CVE-2025-54326

7.5
    Samsung
  • Exynos 1280 Firmware
  • Exynos 1280
  • Exynos 2200 Firmware
  • Exynos 2200
Published: December 3, 2025

CVE-2024-3884

7.5
    undertow
Published: December 3, 2025

CVE-2025-12819

7.5
    Pgbouncer
  • Pgbouncer
Published: December 3, 2025

CVE-2025-33201

7.5
    Nvidia
  • Triton Inference Server
    Linux
Published: December 3, 2025

CVE-2025-33211

7.5
    Nvidia
  • Triton Inference Server
    Linux
Published: December 3, 2025

CVE-2025-65868

7.5
    Eyoucms
  • Eyoucms
Published: December 3, 2025

CVE-2025-13947

7.4
    webkitgtk
Published: December 3, 2025

CVE-2025-64443

7.3
    gateway
    gateway
Published: December 3, 2025

CVE-2025-13645

7.2
    Wpchill
  • Modula Image Gallery
Published: December 3, 2025

CVE-2025-66208

7.2
    Collabora
  • Online
Published: December 3, 2025

CVE-2025-65097

7.1
    rom_manager
    rom_manager
Published: December 3, 2025

CVE-2025-66293

7.1
    Libpng
  • Libpng
Published: December 3, 2025

CVE-2025-39665

6.9
    Nagvis
  • Nagvis
Published: December 3, 2025

CVE-2025-13359

6.5
    Taxopress
  • Taxopress
Published: December 3, 2025

CVE-2025-57200

6.5
    dgm1104
Published: December 3, 2025

CVE-2025-64527

6.5
    Envoyproxy
  • Envoy
Published: December 3, 2025

CVE-2025-61727

6.5
    Golang
  • Go
Published: December 3, 2025

CVE-2025-65345

6.5
    Alexusmai
  • Laravel File Manager
Published: December 3, 2025

CVE-2025-13448

6.4
    shortcodes
Published: December 3, 2025

CVE-2025-13401

6.4
    autoptimize
Published: December 3, 2025

CVE-2025-66404

6.4
    Suyogs
  • Mcp-Server-Kubernetes
Published: December 3, 2025

CVE-2025-13948

6.3
    go-ldap-admin
Published: December 3, 2025

CVE-2025-12084

6.3
    Python
  • Python
Published: December 3, 2025

CVE-2025-29864

6.2
    alzip
Published: December 3, 2025

CVE-2025-55076

6.2
    Plugin-Alliance
  • Installation Manager
    Apple
Published: December 3, 2025

CVE-2025-62686

6.2
    Plugin-Alliance
  • Installation Manager
    Apple
Published: December 3, 2025

CVE-2025-65841

6.2
    Acustica-Audio
  • Aquarius
Published: December 3, 2025

CVE-2025-57202

6.1
    Avtech
  • Dgm1104 Firmware
  • Dgm1104
Published: December 3, 2025

CVE-2025-13945

5.5
    Wireshark
  • Wireshark
Published: December 3, 2025

CVE-2025-13946

5.5
    Wireshark
  • Wireshark
Published: December 3, 2025

CVE-2025-63401

5.5
    Hcltech
  • Dragon
Published: December 3, 2025

CVE-2025-63402

5.5
    Hcltech
  • Dragon
Published: December 3, 2025

CVE-2025-66453

5.5
    rhino
Published: December 3, 2025

CVE-2025-12887

5.4
    post_smtp
Published: December 3, 2025

CVE-2025-13492

5.4
    Hp
  • Image Assistant
Published: December 3, 2025

CVE-2025-20381

5.4
    mcp_server_app
Published: December 3, 2025

CVE-2025-10304

5.3
    everest_backup
Published: December 3, 2025

CVE-2025-12585

5.3
    mxchat
Published: December 3, 2025

CVE-2025-13472

5.3
    jenkins_plugin
Published: December 3, 2025

CVE-2025-13949

5.3
    gofilm
Published: December 3, 2025

CVE-2025-20384

5.3
    Splunk
  • Splunk
  • Splunk Cloud Platform
Published: December 3, 2025

CVE-2025-53965

5.3
    Samsung
  • Exynos 1280 Firmware
  • Exynos 1280
  • Exynos 1330 Firmware
  • Exynos 1330
  • Exynos 1380 Firmware
  • Exynos 1380
  • Exynos 1480 Firmware
  • Exynos 1480
  • Exynos 1580 Firmware
  • Exynos 1580
  • Exynos 2100 Firmware
  • Exynos 2100
  • Exynos 2200 Firmware
  • Exynos 2200
  • Exynos 2400 Firmware
  • Exynos 2400
  • Exynos 2500 Firmware
  • Exynos 2500
  • Exynos 850 Firmware
  • Exynos 850
  • Exynos 980 Firmware
  • Exynos 980
  • Exynos 990 Firmware
  • Exynos 990
  • Exynos W1000 Firmware
  • Exynos W1000
  • Exynos W930 Firmware
  • Exynos W930
  • Exynos W920 Firmware
  • Exynos W920
  • Modem 5123 Firmware
  • Modem 5123
  • Modem 5300 Firmware
  • Modem 5300
  • Modem 5400 Firmware
  • Modem 5400
Published: December 3, 2025

CVE-2025-65096

5.3
    rom_manager
Published: December 3, 2025

CVE-2025-65842

5.1
    Acustica-Audio
  • Aquarius Helpertool
Published: December 3, 2025

CVE-2025-50361

5.1
    Smallbasic
  • Smallbasic
Published: December 3, 2025

CVE-2025-66220

5.0
    Envoyproxy
  • Envoy
Published: December 3, 2025

CVE-2025-66406

5.0
    step_ca
Published: December 3, 2025

CVE-2025-13495

4.9
    fluentcart
Published: December 3, 2025

CVE-2025-13992

4.7
    Google
  • Chrome
    Apple
    Linux
    Microsoft
Published: December 3, 2025

CVE-2025-13086

4.6
    openvpn
Published: December 3, 2025

CVE-2025-12358

4.3
    shopengine
Published: December 3, 2025

CVE-2025-13109

4.3
    HUSKY_Products_Filter_Professional_for_WooCommerce
Published: December 3, 2025

CVE-2025-13354

4.3
    Taxopress
  • Taxopress
Published: December 3, 2025

CVE-2025-13756

4.3
    fluent_booking
Published: December 3, 2025

CVE-2025-20383

4.3
    Splunk
  • Splunk
  • Splunk Cloud Platform
  • Splunk Secure Gateway
Published: December 3, 2025

CVE-2025-20389

4.3
    Splunk
  • Splunk
  • Splunk Cloud Platform
  • Splunk Secure Gateway
Published: December 3, 2025

CVE-2025-64763

3.7
    Envoyproxy
  • Envoy
Published: December 3, 2025

CVE-2025-20382

3.5
    Splunk
  • Splunk
  • Splunk Cloud Platform
Published: December 3, 2025

CVE-2025-12954

2.7
    timetable_and_event_schedule
Published: December 3, 2025

CVE-2025-20388

2.7
    Splunk
  • Splunk
  • Splunk Cloud Platform
Published: December 3, 2025

CVE-2025-20385

2.4
    Splunk
  • Splunk
  • Splunk Cloud Platform
Published: December 3, 2025

CVE-2025-13751

1.3
    openvpn
Published: December 3, 2025

CVE-2025-66478

None
    *
Published: December 3, 2025
Click here to see more Vulnerabilities