Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

NVIDIA patches two high-severity code injection flaws (CVE-2025-33183/4) in Isaac-GROOT, risking code execution & privilege escalation in robotics.

Acronis exposed TamperedChef, a global campaign using US shell companies to sign trojanized apps. The malware deploys a stealthy, obfuscated JavaScript backdoor via a scheduled task for long-term persistence.

A RCE flaw (CVE-2025-62164) in the vLLM inference engine allows attackers to crash servers or execute code by exploiting an out-of-bounds memory write via malicious prompt embeddings.

Google exposed APT24's stealth BADAUDIO C++ downloader. The three-year campaign includes a supply chain hack hitting 1,000+ domains, using control flow flattening and AES-encrypted cookies for C2.

Sophos exposed STAC3150, a campaign using fake "View Once" messages to deploy Astaroth banking trojan. The malware hijacks WhatsApp Web sessions via WPPConnect/Selenium for self-propagation.

CERT/CC warned that Tenda 4G03 Pro/N300 routers are exposed to an unpatched RCE flaw (CVE-2025-13207). Authenticated attackers can execute root-level commands via web requests due to insecure input handling.

Darktrace exposed Xillen Stealer v4/v5, a new MaaS threat using Rust polymorphism and an AIEvasionEngine to target 100+ browsers and Kubernetes/DevOps secrets. It uses steganography for exfiltration.

ABB patched a Critical (CVSS 9.6) Auth Bypass flaw (CVE-2025-10571) in Edgenius Management Portal. The bug allows unauthenticated remote attackers to install apps and execute arbitrary code. Update to v3.2.2.0.

Kaspersky exposed Tsundere, a Node.js botnet using an Ethereum smart contract for unkillable C2 updates. The system includes a cybercrime marketplace and spreads via fake MSI game installers for RCE.

A malicious PyPI typosquat (spellcheckers) infected 950+ users. The package deploys an XOR-encrypted Python RAT via a hidden index file, granting full remote execution (exec()) and is linked to crypto scams.

A Critical (CVSS 10.0) RCE flaw (CVE-2025-65108) in md-to-pdf allows arbitrary JavaScript code execution via malicious front-matter. Over 47K weekly downloads are affected. Update to v5.2.5.

Trustwave exposed Eternidade Stealer, a sophisticated Brazilian Trojan. The Python WhatsApp worm steals contact lists and uses IMAP email for covert C2 retrieval to launch banking overlays.

K7 Labs exposed a Python malware using multi-layer encoding (Base64/BZ2/Zlib) and a PNG-disguised RAR archive. The payload executes in memory and achieves stealth by injecting into cvtres.exe.

Wscan is a new open-source web scanner using Machine Learning for fully automated, personalized penetration testing, aiming for high efficiency, accuracy, and low false positives.

A new GRUB2 patch fixes six critical flaws (like CVE-2025-61661) that could bypass UEFI Secure Boot. Full boot chain rebuild and SBAT support are required.

The UK's NCA dismantled the financial network that bankrolled a spy ring linked to Jan Marsalek, exposing a sophisticated crypto-laundering scheme that moved billions.

Cyberattacks on universities (Princeton, Harvard, UPenn) surge globally. Experts warn that AI-augmented hacking and complex infrastructure make the sector highly vulnerable.

NSO Group is appealing a federal injunction banning it from using WhatsApp's infrastructure to deploy Pegasus spyware, arguing the order could force the company to shut down.

Microsoft released out-of-band update KB5072753 for Windows 11 25H2 to fix a bug where the previous KB5068966 hotfix was being repeatedly reinstalled on affected systems.