Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks.

WhatsApp device linking abused in account hijacking attacks.

Amazon: Ongoing cryptomining campaign uses hacked AWS accounts.

Zeroday Cloud hacking event awards $320,0000 for 11 zero days.

France Arrests 22 Year Old After Hack of Interior Ministry Systems.

Cisco Warns of Active Attacks Exploiting Unpatched 0-Day in AsyncOS Email Security Appliances.

14 Malicious NuGet Packages Found Stealing Crypto Wallets and Ad Data.

GachiLoader: Defeating Node.js Malware with API Tracing.

Sonicwall warns of new SMA1000 zero-day exploited in attacks.

New $150 Cellik RAT Grants Android Control, Trojanizes Google Play Apps.

Auto Parts Giant LKQ Confirms Oracle EBS Breach.

Operation ForumTroll continues: Russian political scientists targeted using plagiarism reports.

GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads.

CISA has added 3 vulnerabilities to the KEV Catalog

CVE-2025-59374: ASUS Live Update Embedded Malicious Code Vulnerability

CVE-2025-40602: SonicWall SMA1000 Missing Authorization Vulnerability

CVE-2025-20393: Cisco Multiple Products Improper Input Validation Vulnerability

Tor Project received $2.5M from the US government to bolster privacy.

Mozilla’s new CEO says Firefox’s future is AI, but with a kill switch.

ESET has identified a China-aligned cyber espionage group, LongNosedGoblin, active since 2023 and targeting government networks in Southeast Asia and Japan.

It spreads malware via Windows Group Policy and uses OneDrive and Google Drive as C2, with full backdoors deployed only on select targets.

HPE patched a CRITICAL CVSS 10.0 flaw in OneView that allows unauthenticated remote code execution.

All versions before 11.00 are affected, with hotfixes for 5.20–10.20.

No active exploits reported, but patching is urgent.

North Korea–linked hackers dominated crypto crime in 2025.

They stole $2.02B, more than half of all crypto taken worldwide, per Chainalysis. One breach at Bybit alone accounted for $1.5B, making this the worst year on record for DPRK theft.

React2Shell. Weaxor. GhostPairing. ClickFix. RC4. RuTube. MCP leaks. DDoSia. Modbus. Google Phish. DarkGate. Token spills.

Dozens of stories from one chaotic week. Read the latest ThreatsDay Bulletin — what security teams are tracking now.