#android-malware

The Massiv Android banking trojan disguises itself as IPTV apps, using overlays, keylogging, SMS interception, and Accessibility services to perform full device takeovers.

Source: ThreatFabric

Actively exploited zero-days in Dell RecoverPoint and Google Chrome triggered urgent remediation orders, as a self-propagating npm worm and token compromise hit developer toolchains, and AI-assisted credential abuse led to mass FortiGate breaches worldwide.

Microsoft released its November Patch Tuesday updates, addressing sixty-three vulnerabilities, including one actively exploited Windows kernel zero-day. The patches covered multiple products, including Windows 10, Windows 11, and server editions, with several critical flaws identified.

SAP published its November security advisories, including fixes for a maximum severity flaw, CVE-2025-42890, involving hard-coded credentials in SQL Anywhere Monitor. The issue allowed unauthorised remote code execution without authentication.

Synology issued patches for critical remote code execution vulnerabilities in its BeeStation devices, disclosed at the Pwn2Own Ireland competition. The company advised immediate updates to prevent exploitation.

Threat actors exploited a serious vulnerability in Gladinet’s Triofox file-sharing platform, using its antivirus feature to gain system-level privileges and deploy remote access tools. Google Cloud researchers confirmed the flaw had been exploited after a patch was released.

CISA added CVE-2025-21042, a Samsung mobile zero-day used to distribute LANDFALL spyware, to its Known Exploited Vulnerabilities catalogue. US federal agencies must apply patches by early December under binding operational directives.

Cybersecurity researchers linked the KONNI advanced persistent threat (APT) group, associated with North Korea, to new Android attacks exploiting Google’s Find Hub feature for remote device wiping. The same campaign targeted South Korean users.

GlobalLogic, a subsidiary of Hitachi, disclosed that data belonging to over 10,000 current and former employees was stolen following a breach of Oracle’s E-Business Suite. The incident forms part of the wider Clop ransomware campaign affecting multiple industries.

The OWASP Top 10 for 2025 reaffirmed broken access control as the most common web application security issue. Security misconfiguration and supply chain vulnerabilities remained high priorities for remediation across software ecosystems.

Patches addressed multiple critical vulnerabilities across widely used platforms including Linux Kernel, Apache HTTP Server, and Google Chrome. Active exploitation was confirmed for CVE-2025-21042 and Gladinet Triofox, while a public PoC emerged for Open WebUI CVE-2025-64495 impacting self-hosted AI systems.

Highlights of the day:

Malicious npm package impersonates GitHub library: fake “@acitons/artifact” mimicked GitHub’s “@actions/artifact” to steal build tokens from GitHub-owned repositories; obfuscated scripts and expiry checks used to evade detection.

GlobalLogic breach exposes 10,000+ employees’ data: Clop-linked attackers exploited Oracle E-Business Suite flaws, stealing personal and financial details from staff in a wider campaign targeting major organisations.

Firefox strengthens anti-fingerprinting defences: version 145 introduces new protections that halve user identifiability by fingerprinters, expanding privacy measures in Private Browsing and ETP Strict modes.

Gootloader returns with font-based evasion: malware uses custom WOFF2 fonts to conceal filenames, delivering encrypted payloads via WordPress sites and compromising domain controllers within a day.

Microsoft fixes zero-day and 63 vulnerabilities: November Patch Tuesday addresses an exploited Windows Kernel flaw (CVE-2025-62215) granting SYSTEM privileges, plus multiple Critical remote code execution bugs.

A stealthy Android malware campaign is hijacking NFC payment data and PINs through a trojanised HandyPay app, enabling fraudulent ATM withdrawals and contactless theft.

Source: ESET Research

G DATA: Android-malware in 2016 flink toegenomen

Malware voor Android is in 2016 enorm toegenomen, zo stellen de marktonderzoekers van G DATA in een recent onderzoek. Belangrijkste oorzaak is dat cybercriminelen steeds meer op internet aanvallen uitvoeren op dit specifieke mobiele besturingssysteem. (more…)