🛑 State-linked hackers are hijacking Signal, WhatsApp, and Telegram accounts using spyware disguised as real apps — some use zero-click bugs on iPhones and Androids.

Targets include diplomats and officials across the U.S., Europe, and the Middle East.

Read the full report ↓ https://thehackernews.com/2025/11/cisa-warns-of-active-spyware-campaigns.html

Most insider threat tools still expose personal data during monitoring.

That means even your “secure” session recordings may violate GDPR or HIPAA — without you realizing it.

Ani Khachatryan, CTO at Syteca, explains how real-time data masking can preserve visibility without breaching privacy.

Learn more ↓ https://thehackernews.com/expert-insights/2025/11/smarter-access-better-protected-data.html

Hackers are weaponizing Blender files.

Malicious .blend projects uploaded to CGTrader run hidden Python scripts that install StealC V2 — a stealer able to grab data from 23 browsers, 15 crypto wallets, VPNs, and email clients.

It’s been active for at least 6 months.

Keep Auto Run off. Read here ↓ https://thehackernews.com/2025/11/hackers-hijack-blender-3d-assets-to.html

🚨 Hackers known as "ToddyCat" found a new way to steal #Outlook emails.

Their tool TCSectorCopy skips Outlook locks and copies mail files straight from the disk — no network use, no alerts.

They also use TomBerBil and SharpTokenFinder to steal OAuth and #Microsoft365 tokens.

More details here ↓ https://thehackernews.com/2025/11/toddycats-new-hacking-tools-steal.html

In 2026, hackers will use AI as their main weapon.

They’ll use it to run scams, copy people, and trick systems fast. Many security tools can’t spot it.

ANYRUN built a sandbox that clicks and tests like a real person to find these attacks.

Learn about it here ↓ https://thehackernews.com/2025/11/3-soc-challenges-you-need-to-solve.html

1 in 5 DevOps, Security, Product, and Developer professionals say vulnerable and outdated components are their biggest security concern.

If you’re building or running container-based systems, this is your cue to pause and ask: Do you know which container images are hardened, which ones still carry drift, and how you’ll prove they’re safe before they hit production?

This checklist is designed for teams to consistently build hardened, trustworthy containers by covering four key areas: base image selection, application-dependency management, minimization & hardening, and signing/verification.

👉 Download the checklist here: https://thn.news/container-checklist

🚨 Hackers built fake adult sites that show a fake Windows update.

It tells you to copy and paste a “fix” — but that command secretly installs up to 8 programs that steal passwords and data.

Researchers call it JackFix, part of the ClickFix trend now behind nearly half of all breaches.

Details ↓ https://thehackernews.com/2025/11/jackfix-uses-fake-windows-update-pop.html

🚨 WARNING: Over 80,000 files with passwords and keys from governments, banks, and tech firms were found online — all pasted into public code tools like JSONFormatter and CodeBeautify.

Hackers are already scraping and using the data.
And yes — it’s still live.

Details here → https://thehackernews.com/2025/11/years-of-jsonformatter-and-codebeautify.html

🚨 FBI ALERT: Scammers are posing as banks to steal logins — causing $262M in losses this year.

Now they’re using AI to create fake Black Friday sites and ads that look real.

They trick people into handing over passwords and money.

Learn more ↓ https://thehackernews.com/2025/11/fbi-reports-262m-in-ato-fraud-as.html

Russia’s GRU tried a new way to spread RomCom malware.

For the first time, they used SocGholish — fake browser update malware — to target a U.S. engineering firm linked to Ukraine.

The attack went from click to malware in under 30 minutes.

Read the latest report ↓ https://thehackernews.com/2025/11/romcom-uses-socgholish-fake-update.html

🚨 A Chrome extension is stealing crypto.

“Crypto Copilot” looks like a trading tool for X — but it secretly adds a hidden Solana transfer and sends your money to a hacker’s wallet.

It’s still live on the Chrome Web Store.

Full story ↓ https://thehackernews.com/2025/11/chrome-extension-caught-injecting.html

⚠️ Hackers love community update tools.
Why? Because anyone can upload a package.
One bad update = hacked systems.

🔒 Join our free live webinar with Action1 CTO Gene Moody — see how to patch safely without slowing down.

Save your spot ↓ https://thehackernews.com/2025/11/webinar-learn-to-spot-risks-and-patch.html

🤖 We talk a lot about securing AI.

Almost no one talks about where it’s actually hiding.

NetworkChuck just dropped a video with Wiz, showing how they’re finding hidden AI risks—“shadow AI”—before attackers do. It’s a smart look at where cloud security is headed next.

🚀See Wiz in Action → https://thn.news/cloud-security-demo

🔥 Hackers hit South Korea’s banks through one IT vendor — spreading Qilin ransomware to 28 firms and stealing 2 TB of data.

Evidence suggests Russian and North Korean groups worked together.

Full story ↓ https://thehackernews.com/2025/11/qilin-ransomware-turns-south-korean-msp.html

⚠️ Eight “advanced” tools failed at once.

A phishing attack slipped past all of them and reached exec inboxes. Only one thing stopped it — a strong SOC.

🔗 Learn why your “first line” is useless without the last ↓ https://thehackernews.com/2025/11/when-your-2m-security-detection-fails.html

⚠️ Hundreds of Maven packages just got caught running Shai-Hulud v2 — the same malware that hijacked npm.

It spread through automated rebuilds, infecting devs who never used npm.

Hiding in the Bun runtime, it steals GitHub + cloud creds and self-replicates like a worm — already leaking 11,000+ secrets across 4,600 repos.

Details here ↓ https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spreads-from-npm.html