This analysis examines Infostealer malware trends during December 2025, focusing on distribution methods, volume, and disguising techniques. Key findings include the prevalence of ACRStealer, LummaC2, and Stealc Infostealers, with malware primarily distributed through SEO poisoning and compromised legitimate websites. The report highlights two significant trends: the abuse of Python scripts for malware distribution and the emergence of cryptocurrency-stealing malware using Tor. Distribution methods evolved from direct blog posts to leveraging legitimate websites and forums. The analysis also notes a shift in malware execution methods, with 65.8% distributed as EXE files and 34.2% using DLL Sideloading techniques. The report emphasizes the importance of vigilance against these evolving threats and provides detailed insights into the malware's behavior and infrastructure.
We've known that social engineering would get AI wings. Now, at the beginning of 2026, we are learning just how high those wings can soar. The post Cyber Insights 2026: Social Engineering appeared first on SecurityWeek .
The critical issue impacts Bluetooth audio accessories with improper Google Fast Pair implementations. The post WhisperPair Attack Leaves Millions of Audio Accessories Open to Hijacking appeared first on SecurityWeek .
China has more than 5,000 cybersecurity companies and all the top 20 firms are working with the government. The post Cybersecurity Firms React to China’s Reported Software Ban appeared first on SecurityWeek .
Researchers have disclosed technical details on a new AMD processor attack that allows remote code execution inside confidential VMs. The post New ‘StackWarp’ Attack Threatens Confidential VMs on AMD Processors appeared first on SecurityWeek .
A targeted malware campaign against U.S.government entities has been observed, utilizing a politically themed ZIP archive containing a loader executable and a malicious DLL. The DLL functions as a backdoor named LOTUSLITE, communicating with a hard-coded command-and-control server. The campaign demonstrates minimal technical sophistication but shows deliberate victim selection and use of geopolitical lures. Attribution analysis suggests moderate-confidence overlap with Mustang Panda tradecraft, including delivery style, loader-DLL separation, and infrastructure usage. The backdoor supports basic remote tasking and data exfiltration, indicating an espionage-focused capability. This activity reflects a trend of targeted spear phishing using geopolitical themes and reliable execution techniques like DLL sideloading.
Hackers stole the personal and reservation information of people with a Eurail pass and those who made a seat reservation with the company. The post Traveler Information Stolen in Eurail Data Breach appeared first on SecurityWeek .
CVE-2025-70892 is a critical SQL Injection vulnerability in Phpgurukul Cyber Cafe Management System v1.0, specifically in the user management module's add-users.php endpoint. The flaw arises from improper validation of the username parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands. This vulnerability has a CVSS score of 9.8, indicating a critical risk with high impact on confidentiality, integrity, and availability. Although no known exploits are currently in the wild, exploitation could lead to full database compromise, data leakage, or system disruption. European organizations using this system, especially cyber cafes or small businesses managing user access, are at risk. Mitigation requires immediate input validation, parameterized queries, and restricting database permissions. Countries with higher adoption of cyber cafe management solutions and significant small business sectors, such as Germany, France, Italy, Spain, and the UK, are likely most affected.
RedVDS enables threat actors to set up servers that can be used for phishing, BEC attacks, account takeover, and fraud. The post RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement appeared first on SecurityWeek .
Key findings Introduction In December 2025, a previously unknown Ransomware-as-a-Service (RaaS) operation calling itself Sicarii began advertising its services across multiple underground platforms. The group’s name references the Sicarii, a 1st-century Jewish assassins group that opposed Roman rule in Judea. From its initial appearance, the Sicarii ransomware group distinguished itself through unusually explicit and persistent use of Israeli […] The post Sicarii Ransomware: Truth vs Myth appeared first on Check Point Research .
The Predator spyware is more sophisticated and dangerous than previously realized. The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek .
CVE-2025-68963 is a medium-severity vulnerability in Huawei's HarmonyOS version 4.3.1, caused by weak password requirements in the Clone module. This flaw enables a man-in-the-middle (MitM) attack that can compromise service confidentiality without impacting integrity or availability. Exploitation requires network-level access and some user interaction but no privileges. There are no known exploits in the wild, and no patches have been released yet. The vulnerability primarily threatens confidentiality by allowing attackers to intercept sensitive data during cloning operations. European organizations using HarmonyOS devices, especially those in sectors relying on Huawei technology, could be at risk. Mitigation involves enforcing stronger password policies, network segmentation, and monitoring for suspicious MitM activities. Countries with higher Huawei device adoption and strategic interest in Huawei technology, such as Germany, France, Italy, Spain, and the UK, are most likely affected.
