All news in category “Threat and Trends Reports”

⚠️ Cellik is a new Android malware-as-a-service advertised on underground forums that enables operators to create trojanized copies of legitimate Google Play apps. Attackers can select Play Store apps and build malicious APKs that retain the original UI, potentially helping infections remain unnoticed and, the seller claims, bypass Play Protect. The service, discovered by iVerify, is offered for $150 per month or $900 for lifetime access and includes capabilities such as screen streaming, notification interception, file exfiltration, a hidden browser mode, and an encrypted command-and-control channel.

🔒 Kaspersky describes a phishing campaign that abuses Telegram Mini Apps to harvest credentials by promising free NFT-style 'gifts' and airdrops. Attackers embed convincing fake Mini Apps inside the official Telegram client, exploiting users' trust in in-app content and minimal platform vetting. Kaspersky urges users to verify sources, avoid entering login codes inside Mini Apps, enable two-step verification and passkeys, and store credentials in a password manager.

🔒 Hypervisors are increasingly attractive targets for ransomware because a single host compromise can expose dozens or hundreds of VMs. Huntress Labs reports hypervisor ransomware involvement jumped from 3% to 25% in the second half of 2025, with the Akira group a major driver. The article urges treating hypervisor security with the same rigor as endpoints: strict access controls, runtime hardening, timely patching, and immutable backups. It also recommends improved monitoring, SIEM integration, and annual recovery drills to ensure rapid restoration.

🔒 Infoblox researchers found that most parked and typosquatting domains now redirect visitors to scams, scareware, or malware without any user click. The redirects are frequently conditional — benign when accessed via a VPN or non‑residential IP, but malicious for residential addresses — and rely on device fingerprinting, geolocation, and chained resells. The study highlights widespread abuse of expired and lookalike domains and the growing role of affiliate networks in distributing harmful traffic.

🔒 The Palo Alto Networks State of Cloud Security Report 2025 warns that rapid enterprise AI adoption has massively expanded the cloud attack surface, with 75% running AI in production and 99% reporting at least one AI-targeted incident last year. It finds GenAI-assisted coding accelerating insecure code into production and AppSec teams unable to keep pace with weekly deploys. The research highlights rising API attacks, persistent identity weaknesses, and widespread tool sprawl, and argues for agentic security to unify cloud and SOC operations.

🔒 Amazon Threat Intelligence has attributed with high confidence a years‑long campaign to Russia’s GRU, noting a shift in 2025 from exploiting software flaws to compromising misconfigured customer network edge devices. The actor has targeted enterprise routers, VPN concentrators, network management appliances and cloud-hosted edge instances, including some hosted on AWS, to gain initial access. This tactic supports credential harvesting, replay attacks and lateral movement while reducing attacker exposure and resource expenditure.

🔍 A new ASPI report, discussed here, documents how Chinese state actors rapidly embedded advanced AI into political control systems between 2023 and 2025. It highlights four accelerated areas: multimodal censorship of politically sensitive images; AI integration into the criminal‑justice pipeline; industrialised online information control; and AI‑enabled platforms run by Chinese firms abroad. The post frames this evidence to inform policymakers, civil society, the media and technology companies seeking to counter AI‑enabled repression.

🔍 ESET's H2 2025 threat report documents rapid attacker innovation, including the first known AI-driven ransomware, PromptLock, which can generate malicious scripts on demand. The report also highlights a near-collapse of Lumma Stealer, a roughly thirtyfold surge in the CloudEyE downloader, and a sharp rise in ransomware victims and NFC-based Android fraud. It underscores evolving distribution and evasion techniques across platforms.

⚠️ Check Point reports a surge in Christmas-themed phishing and social scams, detecting 33,500 unique phishing emails and over 10,000 seasonal social ads in a recent two-week period. Threat actors are using AI to produce flawless local-language messages, build fake e-commerce sites with working checkouts, and generate deepfake audio and smishing that mimic delivery alerts. Consumers should watch for spoofed URLs, unusual payment requests, new or inactive accounts and emotional triggers, and avoid clicking unsolicited links or sharing credentials.

🛡️ Organizations must build a ransomware playbook that pairs planning, technology, and people to reduce disruption and protect business continuity. Regular tabletop exercises create the muscle memory experts recommend, clarifying decision authority, communications, and containment steps across legal, IT, and executive stakeholders. Prevention should be layered — prioritized patching, behavior-based EDR, email/phishing defenses, MFA, least-privilege controls, and verified offline backups — while recovery playbooks, pre-engaged legal and forensics contacts, and tested restore procedures speed remediation and limit reputational harm.

⚠️Rapid7 researchers report a new malware-as-a-service called SantaStealer, advertised on Telegram and hacker forums as an in-memory info‑stealer designed to evade file-based detection. The operation appears to be a rebranding of BluelineStealer by a Russian-speaking developer and is being marketed with Basic ($175/month) and Premium ($300/month) tiers. Samples and an affiliate panel show 14 modular data-collection threads that harvest browser credentials, cookies, saved cards, messaging and gaming app data, crypto wallets and documents, bundle results into ZIPs in memory, and exfiltrate them in 10MB chunks to a hardcoded C2 on port 6767. Despite claims of stealth, leaked builds include symbol names and unencrypted strings that make analysis straightforward.

🔒 Organizations regularly leave servers, accounts, APIs, applications, and storage unmanaged or forgotten, creating high‑risk “IT zombies” that attackers exploit. The post outlines detection approaches — Automated Discovery and Reconciliation (AD&R), CMDB reconciliation, directory analysis, WAF/NGFW monitoring and SCA — and prescribes concrete responses for decommissioning, credential rotation, and data lifecycle control. Implementing IAM, SBOMs, DLP/CASB and automated test‑environment lifecycles reduces exposure and helps meet regulatory obligations.

🔒2025 saw substantial attacker innovation in phishing, with identity-focused techniques becoming more effective and pervasive. Phishing moved beyond email into omni-channel vectors such as LinkedIn DMs, malicious search results, compromised sites and malvertising, which evade traditional email defenses. Criminal PhaaS kits (Tycoon, Sneaky2FA, Evilginx variants and others) commoditized AiTM and MFA-bypass capabilities. Security teams are urged to expand detection into the browser and close visibility gaps with browser-based response.

🔍 The 2025 Cloudflare Radar Year in Review summarizes Internet trends observed across Cloudflare’s global network, covering January–December 2025. The report highlights rapid growth in traffic (up 19%), dramatic increases in AI crawling and user-action requests, and widespread adoption of post-quantum TLS, which reached 52% of human web traffic. It also documents hyper-volumetric DDoS escalation — multiple attacks exceeded 10 Tbps with records hitting 31.4 Tbps — and provides sector, device, and connectivity insights informed by new AI and speed‑test datasets.

📊 Cloudflare’s Radar report summarizes the Top Internet Services of 2025 using anonymized DNS queries from the 1.1.1.1 resolver and a machine-learning ranking method. It highlights continued dominance by Google and Facebook, strong gains by generative AI like ChatGPT and emerging rivals, and regional shifts such as Kwai rising in emerging markets. The analysis spans nine categories and includes country-level Top 10s for local context. E-commerce momentum saw Shopee and Temu join Amazon in the global top three, while crypto, news, and streaming showed event-driven volatility.

🛳️ A single vessel carrying orange juice concentrate illustrates systemic risk at US ports: one weekly ship supplies millions and a localized outage would ripple across supply chains. Recent policy gaps — a furlough of CISA/FEMA staff and the lapse of the Cybersecurity Information Sharing Act — increase exposure, while nation-state malware is reportedly pre-positioned. New Title 33 CFR mandates and scarce maritime cybersecurity talent create urgent operational shortfalls; facilities must prioritize practical resilience testing, penetration tests, and cross-sector collaboration.

⚠️ Apple and Google issued urgent patches for two actively exploited zero-days affecting iOS, macOS, Safari and Chrome's ANGLE library, while multiple high‑severity flaws in React, WinRAR, and .NET proxies are being weaponized in live attacks. Researchers also disclosed SOAPwn .NET proxy abuse and a CentreStack/Triofox token‑encryption failure leading to remote code execution. CISA added the WinRAR path‑traversal bug to KEV; LastPass was fined after the 2022 breach. Prioritize immediate patching and validate web and SSO defenses.

🎄 AI and automation are enabling more sophisticated holiday scams in 2025, making fraudulent emails, fake retail sites, and social media giveaways harder to detect. Check Point researchers flagged over 33,500 Christmas-themed phishing emails and more than 10,000 suspicious holiday ads within a 14-day window, underscoring a global surge. Practical guidance emphasizes recognizing red flags, validating sellers, and using multi-factor authentication and updated security tools to protect holiday shoppers.

🛡️MITRE has published its annual CWE Top 25, ranking the most dangerous software weaknesses identified from 39,080 CVEs. Cross-site scripting (XSS) remains top, with SQL injection and cross-site request forgery following; several memory- and injection-related flaws shifted positions. New entries include classic, stack and heap buffer overflows, improper access control, authorization bypass via user-controlled keys, and resource allocation issues. Experts warn that weak credential protection and authorization failures are driving growing real-world risk in SaaS and API-driven environments.

🛡️ In 2025 CISOs reported that AI moved from experiment to dominant force, giving defenders major productivity gains while simultaneously enabling faster, more precise attacks. Leaders from Smartsheet, Calendly, Elastic and HCLTech say AI reshaped priorities, forced strategy changes, and amplified non-human identities and third-party risk. Heightened regulation and stricter enforcement of standards like NIST and ISO pushed security accountability up to boards.