🚨 Threat Alert: A new group, TA585, is running end-to-end phishing campaigns delivering MonsterV2 malware.

No middlemen. Just pure, in-house cybercrime ops.

Phishing → fake CAPTCHAs → PowerShell payloads → MonsterV2.

Learn how their stack works → https://thehackernews.com/2025/10/researchers-expose-ta585s-monsterv2.html

🚨 Attackers are turning Discord into a command center — using webhooks to steal API keys and config files right from npm, PyPI, and Ruby installs.

⚙️ North Korean actors even pushed 300+ fake packages with 50K+ downloads.

Details here → https://thehackernews.com/2025/10/npm-pypi-and-rubygems-packages-found.html

⚡ New Android exploit “Pixnapping” steals 2FA codes via GPU side-channels.

— No special permissions
— Works across apps (Maps, Authenticator, etc.)
— Full 2FA capture in ~30s

Read the full story ↓ https://thehackernews.com/2025/10/new-pixnapping-android-flaw-lets-rogue.html

🧩 AMD’s “secure” virtualization can be broken with a single memory write.

A new flaw, RMPocalypse (CVE-2025-0033), lets attackers corrupt the Reverse Map Table and steal data from virtual machines — all through one 8-byte overwrite.

Read the details ↓ https://thehackernews.com/2025/10/rmpocalypse-single-8-byte-write.html

🤖 AI lets attackers map your environment before sending a payload.

No exploits needed — your JS, APIs, and error logs are enough. Harmless data is now reconnaissance fuel.

See how it changes defense strategy ↓ https://thehackernews.com/2025/10/what-ai-reveals-about-web-applications.html

⚠️ Security training ≠ security.

Training teaches people to see risk — threat hunting proves whether it still exists. Real security starts before the first alert.

🔍 Don’t just educate. Learn how to validate ↓ https://thehackernews.com/2025/10/moving-beyond-awareness-how-threat.html

🚨 A Chinese APT hid inside ArcGIS for over a year.

They turned a legit Java extension into a web shell.

🔑 Added a hardcoded key → exclusive access
💾 Hid it in backups → survived restores

That’s what “living off the land” really means ↓ https://thehackernews.com/2025/10/chinese-hackers-exploit-arcgis-server.html

⚠️ Heads-up! SAP just re-patched a critical CVSS 10.0 flaw (CVE-2025-42944) in NetWeaver AS Java — a deserialization bug that lets attackers execute commands without authentication.

Apply. The. Fix. → https://thehackernews.com/2025/10/new-sap-netweaver-bug-lets-attackers.html

🍪 A cookie that spawns a shell 💀

A critical flaw (CVE-2025-2611, CVSS 9.3) in ICTBroadcast autodialer software is under active exploitation.

Attackers inject commands via the BROADCAST session cookie for unauthenticated remote code execution.

No patch yet — check your stack → https://thehackernews.com/2025/10/hackers-target-ictbroadcast-servers-via.html

~200 servers are exposed.

🔥 Agentic AI isn’t just automating—it’s thinking and acting.

Zscaler’s CEO says it’s a bigger shift than cloud or IoT.

The upside? Faster support and instant threat response.
The risk? Rogue AIs scanning your network right now.

Learn why Zero Trust isn’t optional anymore → https://thehackernews.com/videos/2025/10/exploring-agentic-ai-innovation-meets.html

⚙️ If you run industrial gear — check your Red Lion RTUs.

Two CVEs (both 10/10) let anyone pop root via one open port. Water, energy, transport — all at risk.

Patch ASAP. Details here → https://thehackernews.com/2025/10/two-cvss-100-bugs-in-red-lion-rtus.html

🔴 Microsoft just dropped fixes for 183 security flaws.

3 are already being exploited — including one buried in every Windows PC since XP.

...and at the same time, it is ending Windows 10 support (unless you pay).

Details + patch info ↓ https://thehackernews.com/2025/10/two-new-windows-zero-days-exploited-in.html

🔥 New free playbook from Pillar Security : a hands-on framework for red-teaming agentic AI systems.

Covers the AI Kill Chain, context engineering, and the CFS model for crafting and testing realistic attack simulations.

🔗 No sign-up required: https://thn.news/agentic-defend

🚨 Over 100 VS Code extensions leaked access tokens — letting attackers push malicious updates to 150,000+ installs.

A single exposed key could’ve weaponized the software supply chain.

Full story ↓ https://thehackernews.com/2025/10/over-100-vs-code-extensions-exposed.html

👀 F5 just confirmed a nation-state breach that went undetected for months.

Hackers stole BIG-IP source code and data on undisclosed vulnerabilities.

Full story ↓ https://thehackernews.com/2025/10/f5-breach-exposes-big-ip-source-code.html