The Hacker News

"Warning:  Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 06 October 2025, 1350 UTC.

Content and Source:  "The Hacker News."

https://mail.google.com/mail/u/0/#inbox/FMfcgzQcqHQSGgbNrWwCpBBKDdqFgflh

URL--thehackernews.com.

Please check email link, URL, or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

Oct 06, 2025Cybersecurity / Hacking News

The cyber world never hits pause, and staying alert matters more than ever. Every week brings new tricks, smarter attacks, and fresh lessons from the field. This recap cuts through the noise to share what really matters—key trends, warning signs, and stories shaping today's security landscape. Whether you're defending systems or just keeping up, these highlights help you spot what's coming before it lands on your screen. ⚡ Threat of the Week Oracle 0-Day Under Attack — Threat actors with ties to the Cl0p ransomware group have exploited a zero-day flaw in E-Business Suite to facilitate data theft attacks. The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network access via HTTP to compromise and take control of the Oracle Concurrent Processing component. In a post shared on LinkedIn, Charles Carmakal, CTO of Mandiant at Google Cloud, said "Cl0p exploited multiple vulnerabilities in Ora...

5 Critical Questions For Adopting an AI Security Solution

Oct 06, 2025Artificial Intelligence / Data Protection

In the era of rapidly advancing artificial intelligence (AI) and cloud technologies, organizations are increasingly implementing security measures to protect sensitive data and ensure regulatory compliance. Among these measures, AI-SPM (AI Security Posture Management) solutions have gained traction to secure AI pipelines, sensitive data assets, and the overall AI ecosystem. These solutions help organizations identify risks, control security policies, and protect data and algorithms critical to their operations.  However, not all AI-SPM tools are created equal. When evaluating potential solutions, organizations often struggle to pinpoint which questions to ask to make an informed decision. To help you navigate this complex space, here are five critical questions every organization should ask when selecting an AI-SPM solution: 1: Does the solution offer comprehensive visibility and control over AI and associated data risk? With the proliferation of AI models across enterprises, m...

Oracle Rushes Patch for CVE-2025-61882 After Cl0p Exploited It in Data Theft Attacks

Oct 06, 2025Vulnerability / Threat Intelligence

Oracle has released an emergency update to address a critical security flaw in its E-Business Suite that it said has been exploited in the recent wave of Cl0p data theft attacks. The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network access via HTTP to compromise and take control of the Oracle Concurrent Processing component. "This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password," Oracle said in an advisory. "If successfully exploited, this vulnerability may result in remote code execution." In a separate alert, Oracle's Chief Security Officer Rob Duhart said the company has released fixes for CVE-2025-61882 to "provide updates against additional potential exploitation that were discovered during our investigation." As indicators of compromise (IoCs), ...

New Webinar: Analyzing Real-world ClickFix Attacks

Push SecurityBrowser Security / Threat Detection

Learn how ClickFix-style attacks are bypassing detection controls, and what security teams can do about it.

Chinese Cybercrime Group Runs Global SEO Fraud Ring Using Compromised IIS Servers

Oct 06, 2025Malware / Data Breach

Cybersecurity researchers have shed light on a Chinese-speaking cybercrime group codenamed UAT-8099 that has been attributed to search engine optimization (SEO) fraud and theft of high-value credentials, configuration files, and certificate data.  The attacks are designed to target Microsoft Internet Information Services (IIS) servers, with most of the infections reported in India, Thailand, Vietnam, Canada, and Brazil, spanning universities, tech firms, and telecom providers. The group was first discovered in April 2025. The targets are primarily mobile users, encompassing both Android and Apple iPhone devices. UAT-8099 is the latest China-linked actor to engage in SEO fraud for financial gain. As recently as last month, ESET revealed details of another threat actor named GhostRedirector that has managed to compromise at least 65 Windows servers primarily located in Brazil, Thailand, and Vietnam with a malicious IIS module codenamed Gamshen to facilitate SEO fraud. "UAT-809...

Zimbra Zero-Day Exploited to Target Brazilian Military via Malicious ICS Files

Oct 06, 2025Email Security / Zero-Day

A now patched security vulnerability in Zimbra Collaboration was exploited as a zero-day earlier this year in cyber attacks targeting the Brazilian military. Tracked as CVE-2025-27915 (CVSS score: 5.4), the vulnerability is a stored cross-site scripting (XSS) vulnerability in the Classic Web Client that arises as a result of insufficient sanitization of HTML content in ICS calendar files, resulting in arbitrary code execution. "When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag," according to a description of the flaw in the NIST National Vulnerability Database (NVD). "This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's acco...

Weaponized GenAI + Extortion-First Strategies Fueling a New Age of Ransomware

ZscalerRansomware / Endpoint Security

Trends and insights based on expert analysis of public leak sites, ransomware samples and attack data.

CometJacking: One Click Can Turn Perplexity's Comet AI Browser Into a Data Thief

Oct 04, 2025Agentic AI / Enterprise Security

Cybersecurity researchers have disclosed details of a new attack called CometJacking targeting Perplexity's agentic AI browser Comet by embedding malicious prompts within a seemingly innocuous link to siphon sensitive data, including from connected services, like email and calendar. The sneaky prompt injection attack plays out in the form of a malicious link that, when clicked, triggers the unexpected behavior unbeknownst to the victims. "CometJacking shows how a single, weaponized URL can quietly flip an AI browser from a trusted co-pilot to an insider threat," Michelle Levy, Head of Security Research at LayerX, said in a statement shared with The Hacker News. "This isn't just about stealing data; it's about hijacking the agent that already has the keys. Our research proves that trivial obfuscation can bypass data exfiltration checks and pull email, calendar, and connector data off-box in one click. AI-native browsers need security-by-design for agent...

Scanning Activity on Palo Alto Networks Portals Jump 500% in One Day

Oct 04, 2025Vulnerability / Network Security

Threat intelligence firm GreyNoise disclosed on Friday that it has observed a massive spike in scanning activity targeting Palo Alto Networks login portals. The company said it observed a nearly 500% increase in IP addresses scanning Palo Alto Networks login portals on October 3, 2025, the highest level recorded in the last three months. It described the traffic as targeted and structured, and aimed primarily at Palo Alto login portals. As many as 1,300 unique IP addresses have participated in the effort, a significant jump from around 200 unique IP addresses observed before. Of these IP addresses, 93% are classified as suspicious and 7% as malicious. The vast majority of the IP addresses are geolocated to the U.S., with smaller clusters detected in the U.K., the Netherlands, Canada, and Russia. "This Palo Alto surge shares characteristics with Cisco ASA scanning occurring in the past 48 hours," GreyNoise noted. "In both cases, the scanners exhibited regional clu...

Detour Dog Caught Running DNS-Powered Malware Factory for Strela Stealer

Oct 03, 2025Malware / Botnet

A threat actor named Detour Dog has been outed as powering campaigns distributing an information stealer known as Strela Stealer. That's according to findings from Infoblox, which found the threat actor to maintain control of domains hosting the first stage of the stealer, a backdoor called StarFish. The DNS threat intelligence firm said it has been tracking Detour Dog since August 2023, when GoDaddy-owned Sucuri disclosed details of attacks targeting WordPress sites to embed malicious JavaScript that used DNS TXT records as a communication channel for a traffic distribution system (TDS), redirecting site visitors to sketchy sites and malware. Traces of the threat actor date back to February 2020. "While traditionally these redirects led to scams, the malware has evolved recently to execute remote content through the DNS-based command-and-control (C2) system," Infoblox said . "We are tracking the threat actor who controls this malware as Detour Dog." Det...

Rhadamanthys Stealer Evolves: Adds Device Fingerprinting, PNG Steganography Payloads

Oct 03, 2025Malware / Cybercrime

The threat actor behind Rhadamanthys has also advertised two other tools called Elysium Proxy Bot and Crypt Service on their website, even as the flagship information stealer has been updated to support the ability to collect device and web browser fingerprints, among others. "Rhadamanthys was initially promoted through posts on cybercrime forums, but soon it became clear that the author had a more ambitious plan to connect with potential customers and build visibility," Check Point researcher Aleksandra "Hasherezade" Doniec said in a new report. First advertised by a threat actor named kingcrete2022, Rhadamanthys has emerged as one of the most popular information stealers available under a malware-as-a-service (MaaS) model alongside Lumma, Vidar, StealC, and, more recently, Acreed. The current version of the stealer is 0.9.2. Over the years, the stealer's capabilities have extended far beyond simple data collection, representing a comprehensive threat to ...

Researchers Warn of Self-Spreading WhatsApp Malware Named SORVEPOTEL

Oct 03, 2025Malware / Online Security

Brazilian users have emerged as the target of a new self-propagating malware that spreads via the popular messaging app WhatsApp. The campaign, codenamed SORVEPOTEL by Trend Micro, weaponizes the trust with the platform to extend its reach across Windows systems, adding the attack is "engineered for speed and propagation" rather than data theft or ransomware. "SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments," researchers Jeffrey Francis Bonaobra, Maristel Policarpio, Sophia Nilette Robles, Cj Arsley Mateo, Jacob Santos, and Paul John Bardon said . "Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers." Once the attachment is opened, the malware automatically propagates via the desktop web version of...

Product Walkthrough: How Passwork 7 Addresses Complexity of Enterprise Security

Oct 03, 2025Enterprise Security / DevOps

Passwork is positioned as an on-premises unified platform for both password and secrets management, aiming to address the increasing complexity of credential storage and sharing in modern organizations. The platform recently received a major update that reworks all the core mechanics. Passwork 7 introduces significant changes to how credentials are organized, accessed, and managed, reflecting feedback from real-world users. The redesign prioritizes usability and security, with a focus on streamlining workflows and making key features more accessible. Passwork isn't trying to reinvent the wheel. Instead, it focuses on solving a very real problem: how do businesses keep credentials organized, secure, and accessible without adding complexity or risk? In this article, we'll look at what Passwork 7 delivers, how it fits into a business environment, and what makes it different. Below is a walkthrough of its main features and workflows. Getting started: User experience and onboarding The...

New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT

Oct 03, 2025Cybersecurity / Malware

A threat actor that's known to share overlaps with a hacking group called YoroTrooper has been observed targeting the Russian public sector with malware families such as FoalShell and StallionRAT. Cybersecurity vendor BI.ZONE is tracking the activity under the moniker Cavalry Werewolf . It's also assessed to have commonalities with clusters tracked as SturgeonPhisher, Silent Lynx, Comrade Saiga, ShadowSilk, and Tomiris. "In order to gain initial access, the attackers sent out targeted phishing emails disguising them as official correspondence from Kyrgyz government officials," BI.ZONE said . "The main targets of the attacks were Russian state agencies, as well as energy, mining, and manufacturing enterprises." In August 2025, Group-IB revealed attacks mounted by ShadowSilk targeting government entities in Central Asia and Asia-Pacific (APAC), using reverse proxy tools and remote access trojans written in Python and subsequently ported to PowerShell. C...

CISA Flags Meteobridge CVE-2025-4008 Flaw as Actively Exploited in the Wild

Oct 03, 2025Vulnerability / IoT Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting Smartbedded Meteobridge to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. The vulnerability, CVE-2025-4008 (CVSS score: 8.7), is a case of command injection in the Meteobridge web interface that could result in code execution. "Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices," CISA Said. According to ONEKEY, which discovered and reported the issue in late February 2025, the Meteobridge web interface lets an administrator manage their weather station data collection and control the system through a web application written in CGI shell scripts and C. Specifically, the web interface exposes a "template.cgi" script through "/cgi-bin/tem...

Trending News

Urgent: China-Linked Hackers Exploit New VMware Zero-Day Since October 2024

Researchers Warn of Self-Spreading WhatsApp Malware Named SORVEPOTEL

Evolving Enterprise Defense to Secure the Modern AI Supply Chain

ThreatsDay Bulletin: CarPlay Exploit, BYOVD Tactics, SQL C2 Attacks, iCloud Backdoor Demand and More

New Android Banking Trojan "Klopatra" Uses Hidden VNC to Control Infected Smartphones

CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm and More

New WireTap Attack Extracts Intel SGX ECDSA Key via DDR4 Memory-Bus Interposer

New $50 Battering RAM Attack Breaks Intel and AMD Cloud Security Protections

Researchers Disclose Google Gemini AI Flaws Allowing Prompt Injection and Cloud Exploits

CometJacking: One Click Can Turn Perplexity's Comet AI Browser Into a Data Thief

New Android Trojan "Datzbro" Tricking Elderly with AI-Generated Facebook Travel Events

Red Hat OpenShift AI Flaw Exposes Hybrid Cloud Infrastructure to Full Takeover

Stop Alert Chaos: Context Is the Key to Effective Incident Response

First Malicious MCP Server Found Stealing Emails in Rogue Postmark-MCP Package

Popular Resources

Expert InsightsArticlesVideos

Cracking the Boardroom Code: Helping CISOs Speak the Language of Business

October 6, 2025Read ➝

Continuous Patch Management: Why the Future of Cybersecurity Demands Real-Time Vulnerability Remediation

October 6, 2025Read ➝

The State of DDoS Defenses: Unpacking a New Survey of 300 CISOs & Security Directors

September 22, 2025Read ➝

Turning Intelligence Into Action with Threat-Informed Defense

September 22, 2025Read ➝

Cybersecurity Resources

Get Latest News in Your Inbox!

Get the latest news, expert insights, exclusive resources, and strategies from industry leaders – all for free.

Email