ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

A critical exploit targeting Yearn Finance’s yETH pool on Ethereum has been exploited by unknown threat actors, resulting in the theft of approximately $9 million from the protocol. The attack is said to have abused a flaw in how the protocol manages its internal accounting, stemming from the fact that a cache containing calculated values to save on gas fees was never cleared when the pool was completely emptied. “The attacker achieved this by minting an astronomical number of tokens – 235 septillion yETH (a 41-digit number) – while depositing only 16 wei, worth approximately $0.000000000000000045,” Check Point said. “This represents one of the most capital-efficient exploits in DeFi history.”

Fortinet said it discovered 151 new samples of BPFDoor and three of Symbiote exploiting extended Berkeley Packet Filters (eBPFs) to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert command-and-control (C2) communication. In the case of Symbiote, the BPF instructions show the new variant only accepts IPv4 or IPv6 packets for protocols TCP, UDP, and SCTP on non-standard ports 54778, 58870, 59666, 54879, 57987, 64322, 45677, and 63227. Coming to BPFDoor, the newly identified artifacts have been found to support both IPv4 and IPv6, as well as switch to a completely different magic packet mechanism. “Malware authors are enhancing their BPF filters to increase their chances of evading detection. Symbiote uses port hopping on UDP high ports, and BPFDoor implements IPv6 support,” security researcher Axelle Apvrille said.

Microsoft said it detected and blocked on November 26, 2025, a high-volume phishing campaign from a threat actor named Storm-0900. “The campaign used parking ticket and medical test result themes and referenced Thanksgiving to lend credibility and lower recipients’ suspicion,” it said. “The campaign consisted of tens of thousands of emails and targeted primarily users in the United States.” The URLs redirected to an attacker-controlled landing page that first required users to solve a slider CAPTCHA by clicking and dragging a slider, followed by ClickFix, which tricked users into running a malicious PowerShell script under the guise of completing a verification step. The end goal of the attacks was to deliver a modular malware known as XWorm that enables remote access, data theft, and deployment of additional payloads. “Storm-0900 is a prolific threat actor that, when active, launches phishing campaigns every week,” Microsoft said.

A new phishing campaign has been observed distributing bogus emails claiming to be about a professional achievement grant that lures them with supposed monetary grants. “It includes a password-protected ZIP and personalized details to appear legitimate, urging the victim to open the attached ‘secure digital package’ to claim the award, setting up the credential phish and malware chain that follows,” Trustwave said. The ZIP archive contains an HTML page that’s designed to phish their webmail credentials and exfiltrate it to a Telegram bot. Then a malicious SVG image is used to trigger a PowerShell ClickFix chain that installs the Stealerium infostealer to fix a purported issue with Google Chrome.

A fresh wave of spear-phishing activity linked to the Russia-nexus intrusion set COLDRIVER has targeted non-profit organization Reporters Without Borders (RSF), which was designated as an “undesirable” entity by the Kremlin in August 2025. The attack, observed in March 2025, originated from a Proton Mail address, urging targets to review a malicious document by sharing a link that likely redirected to a Proton Drive URL hosting a PDF file. In another case targeting a different victim, the PDF came attached to the email message. “The retrieved file is a typical Calisto decoy: it displays an icon and a message claiming that the PDF is encrypted, instructing the user to click a link to open it in Proton Drive,” Sekoia said. “When the user clicks the link, they are first redirected to a Calisto redirector hosted on a compromised website, which then forwards them to the threat actor’s phishing kit.” The redirector is a PHP script deployed on compromised websites, which ultimately takes the victims to an adversary-in-the-middle (AiTM) phishing page that can capture their Proton credentials. Proton has since taken down the attacker-controlled accounts.

Google has expanded in-call scam protection on Android to Cash App and JPMorganChase in the U.S., after piloting the feature in the U.K., Brazil, and India. “When you launch a participating financial app while screen sharing and on a phone call with a number that is not saved in your contacts, your Android device will automatically warn you about the potential dangers and give you the option to end the call and to stop screen sharing with just one tap,” Google said. “The warning includes a 30-second pause period before you’re able to continue, which helps break the ‘spell’ of the scammer’s social engineering, disrupting the false sense of urgency and panic commonly used to manipulate you into a scam.” The feature is compatible with Android 11+ devices.

A previously undocumented packer for Windows malware named TangleCrypt has been used in a September 2025 Qilin ransomware attack to conceal malicious payloads like the STONESTOP EDR killer by using the ABYSSWORKER driver as part of a bring your own vulnerable driver (BYOVD) attack to forcefully terminate installed security products on the device. “The payload is stored inside the PE Resources via multiple layers of base64 encoding, LZ78 compression, and XOR encryption,” WithSecure said. “The loader supports two methods of launching the payload: in the same process or in a child process. The chosen method is defined by a string appended to the embedded payload. To hinder analysis and detection, it uses a few common techniques like string encryption and dynamic import resolving, but all of these were found to be relatively simple to bypass. Although the packer has an overall interesting design, we identified several flaws in the loader implementation that may cause the payload to crash or show other unexpected behaviour.”

Let’s Encrypt has officially announced plans to reduce the maximum validity period of its SSL/TLS certificates from 90 days to 45 days. The transition, which will be completed by 2028, aligns with broader industry shifts mandated by the CA/Browser Forum Baseline Requirements. “Reducing how long certificates are valid for helps improve the security of the internet, by limiting the scope of compromise, and making certificate revocation technologies more efficient,” Let’s Encrypt said. “We are also reducing the authorization reuse period, which is the length of time after validating domain control that we allow certificates to be issued for that domain. It is currently 30 days, which will be reduced to 7 hours by 2028.”

A malicious Visual Studio Code (VS Code) extension named “prettier-vscode-plus” has been published to the official VS Code Marketplace, impersonating the legitimate Prettier formatter. The attack starts with a Visual Basic Script dropper that’s designed to run an embedded PowerShell script to fetch the next-stage payloads. “The extension served as the entry point for a multi-stage malware chain, starting with the Anivia loader, which decrypted and executed further payloads in memory,” Hunt.io said. “OctoRAT, the third-stage payload dropped by the Anivia loader, provided full remote access, including over 70 commands for surveillance, file theft, remote desktop control, persistence, privilege escalation, and harassment.” Some aspects of the attack were disclosed last month by Checkmarx.

Cybersecurity and intelligence agencies from Australia, Canada, Germany, the Netherlands, New Zealand, the U.K., and the U.S. have released new guidelines for secure integration of Artificial Intelligence (AI) in Operational Technology (OT) environments. The key principles include educating personnel on AI risks and its impacts, evaluating business cases, implementing governance frameworks to ensure regulatory compliance, and maintaining oversight, keeping safety and security in mind. “That kind of coordination is rare and signals the importance of this issue,” Floris Dankaart, lead product manager of managed extended detection and response at NCC Group, said. “Equally important, most AI-guidance addresses IT, not OT (the systems that keep power grids, water treatment, and industrial processes running). It’s refreshing and necessary to see regulators acknowledge OT-specific risks and provide actionable principles for integrating AI safely in these environments.”

The Indian government has revealed that local authorities have detected GPS spoofing and jamming at eight major airports, including those in Delhi, Kolkata, Amritsar, Mumbai, Hyderabad, Bangalore, and Chennai. Civil Aviation Minister Ram Mohan Naidu Kinjarapu, however, did not provide any details on the source of the spoofing and/or jamming, but noted the incidents did not cause any harm. “To enhance cyber security against global threats, AAI [Airports Authority of India] is implementing advanced cyber security solutions for IT networks and infrastructure,” Naidu said.

The second Shai-Hulud supply chain attack targeting the npm registry exposed around 400,000 unique raw secrets after compromising over 800 packages and publishing stolen data in 30,000 GitHub repositories. Of these, only about 2.5% those are verified. “The dominant infection vector is the @postman/tunnel-agent-0.6.7 package, with @asyncapi/specs-6.8.3 identified as the second-most frequent,” Wiz said. “These two packages account for over 60% of total infections. PostHog, which provided a detailed postmortem of the incident, is believed to be the ‘patient zero’ of the campaign. The attack stemmed from a flaw in CI/CD workflow configuration that allowed malicious code from a pull request to run with enough privileges to grab high-value secrets. “At this point, it is confirmed that the initial access vector in this incident was abuse of pull_request_target via PWN request,” Wiz added. The self-replicating worm has been found to steal cloud credentials and use them to “access cloud-native secret management services,” as well as unleash destructive code that wipes user data if the worm is unsuccessful in propagating further.

Michael Clapsis, a 44-year-old Australian man, has been sentenced to over seven years in prison for setting up fake Wi-Fi access points to steal personal data. The defendant, who was charged in June 2024, ran fake free Wi-Fi access points at the Perth, Melbourne, and Adelaide airports during multiple domestic flights and at work. He deployed evil twin networks to redirect users to phishing pages and capture credentials, subsequently using the information to access personal accounts and collect intimate photos and videos of women. Clapsis also hacked his employer in April 2024 and accessed emails between his boss and the police after his arrest. The investigation was launched that month after an airline employee discovered a suspicious Wi-Fi network during a domestic flight. “The man used a portable wireless access device, sometimes known as a Wi-Fi Pineapple, to passively listen for device probe requests,” the Australian Federal Police (AFP) said. “When detecting a request, the Wi-Fi Pineapple instantly creates a matching network with the same name, tricking a device into thinking it is a trusted network. The device would then connect automatically.”

Authorities in South Korea have arrested four individuals, believed to be working independently, for collectively hacking into more than 120,000 internet protocol cameras. Three of the suspects are said to have taken the footage recorded from private homes and commercial facilities, including a gynaecologist’s clinic, and created hundreds of sexually exploitative materials to sell them to a foreign adult site (referred to as “Site C”). In addition, three individuals who purchased such illegal content from the website have already been arrested and face up to three years in prison.

A scan of about 5.6 million public repositories on GitLab has revealed over 17,000 verified live secrets, according to TruffleHog. Google Cloud Platform (GCP) credentials were the most leaked secret type on GitLab repositories, followed by MongoDB, Telegram bots, OpenAI, OpenWeather, SendGrid, and Amazon Web Services. The 17,430 leaked secrets belonged to 2804 unique domains, with the earliest valid secret dating back to December 16, 2009.

The cybercriminal alliance known as Scattered LAPSUS$ Hunters has been observed going after Zendesk servers in an effort to steal corporate data they can use for ransom operations. ReliaQuest said it detected more than 40 typosquatted and impersonating domains mimicking Zendesk environments. “Some of the domains are hosting phishing pages with fake single sign-on (SSO) portals designed to steal credentials and deceive users,” it said. “We also have evidence to suggest that fraudulent tickets are being submitted directly to legitimate Zendesk portals operated by organizations using the platform for customer service. These fake submissions are crafted to target support and help-desk personnel, infecting them with remote access trojans (RATs) and other types of malware.” While the infrastructure patterns point to the notorious cybercrime group, ReliaQuest said that copycats inspired by the group’s success couldn’t be ruled out.

Cato Networks has demonstrated that it’s possible to leverage Anthropic’s Claude Skills, which allows users to create and share custom code modules that expand on the AI chatbot’s capabilities, to execute a MedusaLocker ransomware attack. The test shows “how a trusted Skill could trigger real ransomware behavior end-to-end under the same approval context,” the company said. “Because Skills can be freely shared through public repositories and social channels, a convincing ‘productivity’ Skill could easily be propagated through social engineering, turning a feature designed to extend your AI’s capabilities into a malware delivery vector.” However, Anthropic has responded to the proof-of-concept (PoC) by stating the feature is by design, adding “Skills are intentionally designed to execute code” and that users are explicitly asked and warned prior to running a skill. Cato Networks has argued that the chief concern revolves around trusting the skill. “Once a Skill is approved, it gains persistent permissions to read/write files, download or execute additional code, and open outbound connections, all without further prompts or visibility,” it noted. “This creates a consent gap: users approve what they see, but hidden helpers can still perform sensitive actions behind the scenes.”

A .NET loader has been observed using steganographic techniques to deliver various remote access trojans like Quasar RAT and LokiBot. The loader, per Splunk, disguises itself as a legitimate business document to trick users into decompressing and opening the file. Once launched, it decrypts and loads an additional module directly into the process’s allocated memory space. LokiBot “primarily targets Windows (and later Android variants), harvesting browser and app credentials, cryptocurrency wallets, and keystrokes, and can provision backdoors for further payloads,” Splunk said.

Deep Instinct has analyzed a 64-bit binary that’s linked to a hacking group known as Nimbus Manticore. It’s compiled using Microsoft Visual C/C++ and the Microsoft Linker. The malware, besides featuring advanced capabilities to dynamically load additional components at runtime and hide itself from static analysis tools, attempts to move laterally across the network and gain elevated access. “This malware isn’t content to sit on a single compromised machine,” the company said. “It wants to spread, gain administrative access, and position itself for maximum impact across your infrastructure.”

Threat actors have been found to impersonate IT personnel in social engineering attacks via Microsoft Teams to approach victims and deceive them into installing Quick Assist after providing their credentials on a phishing link shared on the messaging platform. Also executed were commands to conduct reconnaissance, command and control (C2), and data exfiltration, as well as drop what appears to be a Python-compiled infostealer. However, the most notable aspect of the attack is that it leverages Teams’ guest access feature to send invites. “On November 4, 2025, suspicious activity was observed in a customer environment through the Microsoft Teams ‘Chat with Anyone’ feature, which allows direct messaging with external users via email addresses,” CyberProof said. “An external user (mostafa.s@dhic.edu[.]eg) contacted the user in Teams, claiming to be from IT support.”

A C++ downloader named Matanbuchus has been used in campaigns distributing the Rhadamanthys information stealer and the NetSupport RAT. First observed in 2020, the malware is mainly designed to download and execute second-stage payloads. Version 3.0 of Matanbuchus was identified in the wild in July 2025. “In version 3.0, the malware developer added Protocol Buffers (Protobufs) for serializing network communication data,” Zscaler said. “Matanbuchus implements a number of obfuscation techniques to evade detection, such as adding junk code, encrypted strings, and resolving Windows API functions by hash. Additional anti-analysis features include a hardcoded expiration date that prevents Matanbuchus from running indefinitely and establishes persistence via downloaded shellcode that creates a scheduled task.”