The New York Algorithmic Pricing Disclosure Act, effective November 10, 2025, mandates businesses to disclose when they use personalized algorithmic pricing based on personal data. Enforcement will be strict, with penalties up to $1,000 per violation, aiming to increase transparency in digital commerce. #AlgorithmicPricing #DataPrivacy…
Category: Cyber Security News
The Asahi Group Holdings faces significant operational disruptions due to a ransomware cyberattack, impacting its supply chain during a peak sales period. Competitors like Kirin, Sapporo, and Suntory are capitalizing on the situation, potentially altering Japan’s beer market dynamics. #AsahiCyberattack #Ransomware #Kirin #Sapporo #Suntory…
North Korean hackers are exploiting Google’s Find Hub tool to locate targets via GPS and remotely reset Android devices, primarily targeting South Koreans. The attack involves spear-phishing, malware deployment, and device wiping to erase evidence and disrupt victims’ communication channels. #NorthKoreanHackers #GoogleFindHub
![Cybersecurity News | Daily Recap [10 Nov 2025]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [10 Nov 2025]")
Daily Recap, Widespread ClickFix phishing targets hotel systems alongside the reappearance of GlassWorm on Open VSX and GitHub, with LANDFALL Android malware exploiting a Samsung 0-day in WhatsApp images. The report also covers runc container flaws, OWASP Top 10 updates, and rising enterprise risks across IoT and mobile devices.
#ClickFix #GlassWorm #LANDFALL #Samsung0day #OWASPTop10 #IoT #IlluminateFine #TISZABreach
North Korea-linked hackers known as Konni have launched new attacks on Android and Windows devices, involving sophisticated malware and remote device management. These campaigns include impersonation tactics, data exfiltration, and device wiping using legitimate Google services, indicating a high level of operational sophistication. #Konni #LilithRAT…
Google’s Mandiant Threat Defense reports on the exploitation of a zero-day vulnerability in Gladinet’s Triofox platform, leading to unauthorized access and remote code execution. The threat actors weaponized this flaw to create admin accounts, deploy remote access tools, and establish encrypted tunnels for privilege escalation. #CVE2025-12480 #UNC6485…
New York has implemented a law requiring companies to disclose when they use consumers’ personal data for algorithmic pricing. This regulation aims to increase transparency and prevent unfair pricing practices based on personal information. #AlgorithmicPricing #ConsumerProtection…
A Russian national, Aleksey Volkov, is preparing to plead guilty for his role as an initial access broker in Yanluowang ransomware attacks that targeted U.S. organizations, earning him millions in ransom payments. This case highlights the interconnectedness of hacking groups, cryptocurrency laundering, and the threat to critical infrastructure. #Yanluowang #AlekseyVolkov #LockBit…
Cybersecurity experts at ENKI have uncovered a sophisticated new variant of the Comebacker backdoor linked to the North Korean Lazarus Group, targeting aerospace and defense sectors through spear phishing. The attack uses malicious Word documents with multi-stage infection chains employing advanced encryption like ChaCha20 and AES-128-CBC to evade detection. #Comebacker #LazarusGroup…
The Genians Security Center has revealed a sophisticated state-sponsored KONNI APT campaign targeting South Korean victims, utilizing Google’s Find Hub for remote device wipes and tracking. The campaign involves social engineering via KakaoTalk and malware distribution under legitimate signatures, showcasing advanced tactics in cyberespionage—highlighting threats linked to North Korea’s Kimsuky and…
A critical vulnerability in the expr-eval JavaScript library allows remote code execution through malicious input, affecting over 250 projects. Developers are urged to upgrade to expr-eval-fork v3.0.0 to mitigate the risk. #CVE-2025-12735 #expr-eval #NodeJS
A Russian national, Aleksey Olegovich Volkov, is set to plead guilty for acting as an initial access broker for Yanluowang ransomware attacks targeting multiple U.S. companies between 2021 and 2022. Investigations linked him to network breaches, ransom negotiations, and receiving a portion of $1.5 million in ransom payments. #Yanluowang #LockBit
A critical Samsung vulnerability (CVE-2025-21042) was exploited in zero-day attacks to deploy the LandFall spyware via WhatsApp, affecting flagship Galaxy devices. U.S. federal agencies are mandated to patch this flaw to prevent further breaches, with potential targets including multiple countries and espionage activities. #CVE-2025-21042 #LandFallSpyware
A new phishing automation platform called Quantum Route Redirect (QRR) uses approximately 1,000 domains to steal Microsoft 365 credentials globally, primarily targeting users in the U.S. It leverages advanced routing and filtering techniques to evade detection, posing significant threats to organizational security. #QuantumRouteRedirect #Microsoft365
Mozilla is enhancing privacy features in Firefox 145 to further reduce user vulnerability to digital fingerprinting. The new protections, initially in Private Browsing Mode and Strict mode, will later become default, blocking more unique device identifiers. #Firefox145 #DigitalFingerprinting