===================== = End-of-Day report = =====================
Timeframe: Montag 01-12-2025 18:00 − Dienstag 02-12-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer
===================== = News = =====================
∗∗∗ Glassworm malware returns in third wave of malicious VS Code packages ∗∗∗ --------------------------------------------- The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms. --------------------------------------------- https://www.bleepingcomputer.com/news/security/glassworm-malware-returns-in-...
∗∗∗ [Guest Diary] Hunting for SharePoint In-Memory ToolShell Payloads, (Tue, Dec 2nd) ∗∗∗ --------------------------------------------- In July 2025, many of us were introduced to the Microsoft SharePoint exploit chain known as ToolShell. ToolShell exploits the deserialization and authentication bypass vulnerabilities, CVE-2025-53770 [2] and CVE-2025-53771 [3], in on-premises SharePoint Server 2016, 2019, and Subscription editions. --------------------------------------------- https://isc.sans.edu/diary/rss/32524
∗∗∗ Iran-Linked Hackers Hits Israeli Sectors with New MuddyViper Backdoor in Targeted Attacks ∗∗∗ --------------------------------------------- Israeli entities spanning academia, engineering, local government, manufacturing, technology, transportation, and utilities sectors have emerged as the target of a new set of attacks undertaken by Iranian nation-state actors that have delivered a previously undocumented backdoor called MuddyViper. --------------------------------------------- https://thehackernews.com/2025/12/iran-linked-hackers-hits-israeli_2.html
∗∗∗ Stealthy browser extensions waited years before infecting 4.3M Chrome, Edge users with backdoors and spyware ∗∗∗ --------------------------------------------- And some are still active in the Microsoft Edge store A seven-year malicious browser extension campaign infected 4.3 million Google Chrome and Microsoft Edge users with malware, including backdoors and spyware sending peoples data to servers in China. --------------------------------------------- https://www.theregister.com/2025/12/01/chrome_edge_malicious_browser_extensi...
∗∗∗ Dont say "Jehova" to an LLM ∗∗∗ --------------------------------------------- The Rabbi in the old skit from Monty Python's "Life of Brian" fell for it, and for a long time, philosophers argued whether quoting someone is fundamentally different to just saying the sentence. I remember a story where one actor smuggled a wedding promise in a co-actor's copy of his lines: After the vow was made on the set and the sentence couldn't be found in the official script: is the actor now bound in real life by his promise? --------------------------------------------- https://www.cert.at/en/blog/2025/12/dont-say-jehova-to-an-llm
∗∗∗ Proxyearth Tool Lets Anyone Trace Users in India with Just a Mobile Number ∗∗∗ --------------------------------------------- Proxyearth is a new site that shows names, Aadhaar numbers, and live locations of users in India using only mobile numbers, raising serious privacy and security concerns. --------------------------------------------- https://hackread.com/proxyearth-trace-users-india-mobile-number/
∗∗∗ Android TV: YouTube-Client SmartTube war mit Malware verseucht ∗∗∗ --------------------------------------------- Unbekannte konnten SmartTube mit Malware verseuchen und die Version kurzzeitig in Umlauf bringen. Nun gibt der Entwickler Einblicke zum Vorfall. --------------------------------------------- https://heise.de/-11099310
∗∗∗ Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact ∗∗∗ --------------------------------------------- A deeper look at the Shai-Hulud 2.0 supply chain attack: reviewing the infection spread, victimology, leaked secrets distribution, and community response so far. --------------------------------------------- https://www.wiz.io/blog/shai-hulud-2-0-aftermath-ongoing-supply-chain-attack
∗∗∗ 68% Of Phishing Websites Are Protected by CloudFlare ∗∗∗ --------------------------------------------- Earlier this year, our CTI team set out to build something wed been thinking about for a while: a phishing intelligence pipeline that could actually keep up with the threat. We combined feeds from hundreds of independent sources with our own real-time hunt for suspicious SSL/TLS certificates. --------------------------------------------- https://blog.sicuranext.com/68-of-phishing-websites-are-protected-by-cloudfl...
===================== = Vulnerabilities = =====================
∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (gnutls, libpng, mingw-python3, python-spotipy, source-to-image, unbound, and webkitgtk), Mageia (libpng), SUSE (bash-git-prompt, gitea-tea, java-17-openjdk, java-21-openjdk, kernel, openssh, python, and shadowsocks-v2ray-plugin, v2ray-core), and Ubuntu (binutils, openjdk-17-crac, openjdk-21-crac, and openjdk-25-crac). --------------------------------------------- https://lwn.net/Articles/1048973/
∗∗∗ Patchday: Attacken auf Geräte mit Android 13, 14, 15 und 16 beobachtet ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für verschiedene Androidversionen erschienen. Es gibt bereits Attacken. --------------------------------------------- https://heise.de/-11099576
∗∗∗ Qualcomm Issues Critical Security Alert Over Secure Boot Vulnerability ∗∗∗ --------------------------------------------- Qualcomm warned partners and device manufacturers about multiple newly discovered vulnerabilities that span its chipset ecosystem. The Qualcomm released a detailed security bulletin on December 1, 2025, outlining six high-priority weaknesses in its proprietary software, including one flaw that directly compromises the secure boot process, one of the most sensitive stages in a device’s startup chain. --------------------------------------------- https://thecyberexpress.com/qualcomm-2025-security-alert/
∗∗∗ Critical SQL Injection Flaw Exposes Sensitive Data in Devolutions Server ∗∗∗ --------------------------------------------- A batch of new vulnerabilities in Devolutions Server targets organizations that depend on the platform to manage privileged accounts, passwords, and sensitive authentication data. Devolutions has released a security advisory, identified as DEVO-2025-0018, warning customers of multiple vulnerabilities, including a critical flaw that could enable attackers to extract confidential data directly from the system’s database. --------------------------------------------- https://thecyberexpress.com/devolutions-server-sql-injection-flaw/