⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More
If you use a smartphone, browse the web, or unzip files on your computer, you are in the crosshairs this week. Hackers are currently exploiting critical flaws in the daily software we all rely on—and in some cases, they started attacking before a fix was even ready. Below, we list the urgent updates you need to install right now to stop these active threats. ⚡ Threat of the Week Apple and Google Release Fixes for Actively Exploited Flaws — Apple released security updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari web browser to address two zero-days that the company said have been exploited in highly targeted attacks. CVE-2025-14174 has been described as a memory corruption issue, while the second, CVE-2025-43529, is a use-after-free bug. They can both be exploited using maliciously crafted web content to execute arbitrary code. CVE-2025-14174 was also addressed by Google in its Chrome browser since it resides in its open-source Almost Native Graphics Layer Engine (ANGLE) library. There are currently no details on how these flaws were exploited, but evidence points to it likely having been weaponized by commercial spyware vendors. The CISO Org Chart Playbook This playbook is for security leaders who are scaling CloudSec teams and need a structure that keeps up with cloud complexity. Built specifically for modern cloud-forward security teams, it breaks down how CISOs are structuring cloud security functions today – including emerging roles, team models, reporting lines, and practical templates for planning headcount and responsibilities across cloud, AppSec, platform security, and more. Download Org Charts ➝ 🔔 Top News SOAPwn Exploits HTTP Client Proxies in .NET for RCE — Cybersecurity researchers uncovered an unexpected behavior of HTTP client proxies in .NET applications, potentially allowing attackers to achieve remote code execution. The vulnerability has been codenamed SOAPwn. At its core, the problem has to do with how .NET applications might be vulnerable to arbitrary file writes because .NET's HTTP client proxies also accept non-HTTP URLs such as files, a behavior that Microsoft says developers are responsible for guarding against — but not likely to expect. This, in turn, can open remote code execution (RCE) attack paths through web shells and malicious PowerShell scripts in many .NET applications, including commercial products. By being able to pass an arbitrary URL to a SOAP API endpoint in an affected .NET application, an attacker can trigger a leak of NTLM challenge. The issue can also be exploited through Web Services Description Language (WSDL) imports, which can then be used to generate client SOAP proxies that can be controlled by the attacker. "The .NET Framework allows its HTTP client proxies to be tricked into interacting with the filesystem. With the right conditions, they will happily write SOAP requests into local paths instead of sending them over HTTP," watchTowr said. "In the best case, this results in NTLM relaying or challenge capture. In the worst case, it becomes remote code execution through webshell uploads or PowerShell script drops." Attackers Exploit New Flaw in CentreStack and Triofox — A new vulnerability in Gladinet's CentreStack and Triofox products is being actively exploited by unknown threat actors to achieve code execution. The vulnerability, which does not have a CVE identifier, can be abused to access the web.config file, which can then be used to execute arbitrary code. At the core of the issue is a design failure in how they generate the cryptographic keys used to encrypt the access tokens the products use to control who can retrieve what files. As a result, the cryptographic keys never change and can be used to access files containing valuable data. Huntress said, as of December 10, 2025, nine organizations have been affected by the newly disclosed flaw. WinRAR Flaw Exploited by Multiple Threat Actors — A high-severity flaw in WinRAR (CVE-2025-6218, CVSS score: 7.8) has come under active exploitation, fueled by three different threat actors tracked as GOFFEE (aka Paper Werewolf), Bitter (aka APT-C-08 or Manlinghua), and Gamaredon. CVE-2025-6218 is a path traversal vulnerability that allows an attacker to execute code in the context of the current user. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary fixes by December 30, 2025. Exploitation of React2Shell Surges — The recently disclosed maximum-severity security flaw in React (CVE-2025-55182, CVSS score: 10.0) has come under widespread exploitation, with threat actors targeting unpatched systems to deliver various kinds of malware. Public disclosure of the flaw triggered a "rapid wave of opportunistic exploitation," according to Wiz. Google said it observed a China-nexus espionage cluster UNC6600 exploiting React2Shell to deliver MINOCAT, a tunneling utility based on Fast Reverse Proxy (FRP). Other exploitation efforts included the deployment of the SNOWLIGHT downloader by UNC6586 (China-nexus), the COMPOOD backdoor (linked to suspected China-nexus espionage activity since 2022) by UNC6588, an updated version of the Go-based HISONIC backdoor by UNC6603 (China-nexus), and ANGRYREBEL.LINUX (aka Noodle RAT) by UNC6595 (China-nexus). "These observed campaigns highlight the risk posed to organizations using unpatched versions of React and Next.js," Google said. Hamas-Affiliated Group Goes After the Middle East — WIRTE (aka Ashen Lepus), a cyber threat group associated with Hamas, has been conducting espionage on government bodies and diplomatic entities across the Middle East since 2018. In recent years, the threat actor has broadened its targeting scope to include Oman and Morocco, while simultaneously evolving its capabilities. The modus operandi follows tried-and-tested cyber espionage tactics, using spear-phishing emails to deliver malicious attachments that deliver a modular malware suite dubbed AshTag. The components of the framework are embedded in a command-and-control (C2) web page within HTML tags in Base64-encoded format, from where they are parsed and decrypted to download the actual payloads. "Ashen Lepus remained persistently active throughout the Israel-Hamas conflict, distinguishing it from other affiliated groups whose activities decreased over the same period," Palo Alto Networks Unit 42 said. "Ashen Lepus continued with its campaign even after the October 2025 Gaza ceasefire, deploying newly developed malware variants and engaging in hands-on activity within victim environments." It's being assessed that the group may be operating from outside Gaza, citing continued activity throughout the conflict. ️🔥 Trending CVEs Hackers act fast. They can use new bugs within hours. One missed update can cause a big breach. Here are this week’s most serious security flaws. Check them, fix what matters first, and stay protected. This week’s list includes — CVE-2025-43529, CVE-2025-14174 (Apple), CVE-2025-14174 (Google Chrome), CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 (React), CVE-2025-8110 (Gogs), CVE-2025-62221 (Microsoft Windows), CVE-2025-59718, CVE-2025-59719 (Fortinet), CVE-2025-10573 (Ivanti Endpoint Manager), CVE-2025-42880, CVE-2025-55754, CVE-2025-42928 (SAP), CVE-2025-9612, CVE-2025-9613, CVE-2025-9614 (PCI Express Integrity and Data Encryption protocol), CVE-2025-27019, CVE-2025-27020 (Infinera MTC-9), CVE-2025-65883 (Genexis Platinum P4410 router), CVE-2025-64126, CVE-2025-64127, CVE-2025-64128 (Zenitel TCIV-3+), CVE-2025-66570 (cpp-httplib), CVE-2025-63216 (Itel DAB Gateway), CVE-2025-63224 (Itel DAB Encoder) CVE-2025-13390 (WP Directory Kit plugin), CVE-2025-65108 (md-to-pdf), CVE-2025-58083 (General Industrial Controls Lynx+ Gateway), CVE-2025-66489 (Cal.com), CVE-2025-12195, CVE-2025-12196, CVE-2025-11838, CVE-2025-12026 (WatchGuard), CVE-2025-64113 (Emby Server), CVE-2025-66567 (ruby-saml), CVE-2025-24857 (Universal Boot Loader), CVE-2025-13607 (D-Link DCS-F5614-L1, Sparsh Securitech, Securus CCTV), CVE-2025-13184 (TOTOLINK AX1800), CVE-2025-65106 (LangChain), CVE-2025-67635 (Jenkins), CVE-2025-12716, CVE-2025-8405, CVE-2025-12029, CVE-2025-12562 (GitLab CE/EE), and CVE-2025-64775 (Apache Struts 2). 📰 Around the Cyber World U.K. Fines LastPass for 2022 Breach — The U.K. Information Commissioner's Office (ICO) fined LastPass's British subsidiary £1.2 million ($1.6 million) for a data breach in 2022 that enabled attackers to access personal information belonging to its customers, including their encrypted password vaults. The hackers compromised a company-issued MacBook Pro of a software developer based in Europe to access the corporate development environment and related technical documentation, and exfiltrate a little over a dozen repositories. It's unclear how the MacBook was infected. Subsequently, the threat actors gained access to one of the DevOps engineers' PCs by exploiting CVE-2020-5741, a vulnerability in Plex Media Server, installed a keylogger used to steal the engineer's master password, and breached the cloud storage environment. The ICO said LastPass failed to implement sufficiently robust technical and security measures. "LastPass customers had a right to expect the personal information they entrusted to the company would be kept safe and secure," John Edwards, U.K. Information Commissioner, said. "However, the company fell short of this expectation, resulting in the proportionate fine being announced today." APT-C-60 Targets Japan with SpyGlace — The threat actor known as APT-C-60 has been linked to continued cyber attacks targeting Japan to deliver SpyGlace using spear-phishing emails impersonating job seekers. The attacks were observed between June and August 2025, per JPCERT/CC. "In the previous attacks, victims were directed to download a VHDX file from Google Drive," the agency said. "However, in the latest attacks, the malicious VHDX file was directly attached to the email. When the recipient clicks the LNK file contained within the VHDX, a malicious script is executed via Git, which is a legitimate file." The attacks leverage GitHub to download the main malware components, marking a shift from Bitbucket. ConsentFix, a New Twist on ClickFix — Cybersecurity researchers have discovered a new variation of the ClickFix attack. Called ConsentFix, the new technique relies on tricking users into copy-pasting text that contains their OAuth material into an attacker-controlled web page. Push Security said it spotted the technique in attacks targeting Microsoft business accounts. In these attacks, targets are funneled through Google Search to compromised but reputable websites injected with a fake Cloudflare Turnstile challenge that instructs them to sign in to their accounts and paste the URL. Once the targets log in, they are redirected to a localhost URL containing the OAuth authorization code for their Microsoft account. The phishing process ends when the victims paste the URL back into the original page, granting the threat actors unauthorized access. The attack "sees the victim tricked into logging into Azure CLI, by generating an OAuth authorization code — visible in a localhost URL — and then pasting that URL, including the code, into the phishing page," the security company said. "The attack happens entirely inside the browser context, removing one of the key detection opportunities for ClickFix attacks because it doesn't touch the endpoint." The technique is a variation of an attack used by Russian state-sponsored hackers earlier this year that deceived victims into sending their OAuth authorization code via Signal or WhatsApp to the hackers. 2025 CWE Top 25 Most Dangerous Software Weaknesses — The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the MITRE Corporation, released the 2025 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses, identifying the most critical vulnerabilities that adversaries exploit to compromise systems, steal data, or disrupt services. It was compiled from 39,080 CVEs published this year. Topping the list is cross-site scripting, followed by SQL Injection, Cross-Site Request Forgery (CSRF), missing authorization, and out-of-bounds write. Salt Typhoon Spies Reportedly Attended Cisco Training Scheme — Two of Salt Typhoon's members, Yu Yang and Qiu Daibing, have been identified as participants of the 2012 Cisco Networking Academy Cup. Both Yu and Qiu are co-owners of Beijing Huanyu Tianqiong, one of the Chinese companies that the U.S. government and its allies allege as being fronts for Salt Typhoon activity. Yu is also tied to another Salt Typhoon-connected company, Sichuan Zhixin Ruijie. SentinelOne found that Yu and Qiu represented Southwest Petroleum University in Cisco's academy cup in China. Yu's team was placed second in the Sichuan region, while Qiu's team took the first prize and later claimed the third spot nationally, despite the university being considered as a poorly-regarded academic institution. "The episode suggests that offensive capabilities against foreign IT products likely emerge when companies begin supplying local training and that there is a potential risk of such education initiatives inadvertently boosting foreign offensive research," security researcher Dakota Cary said. The episode stresses the need for demonstrating technical competencies when hiring technical professionals and that offensive teams may benefit from putting their own employees through similar training initiatives like Huawei's ICT academy. Freedom Chat Flaws Detailed — A pair of security flaws has been disclosed in Freedom Chat that could have allowed a bad actor to guess registered users' phone numbers (similar to the recent WhatsApp flaw) and expose user-set PINs to others on the app. The issues, discovered by Eric Daigle, have since been addressed by the privacy-focused messaging app as of December 7, 2025. In an update pushed out to Apple and Google's app stores, the company said: "A critical reset: A recent backend update inadvertently exposed user PINs in a system response. No messages were ever at risk, and because Freedom Chat does not support linked devices, your conversations were never accessible; however, we’ve reset all user PINs to ensure your account stays secure. Your privacy remains our top priority." Unofficial Patch for New Windows RasMan 0-Day Released — Free unofficial patches have been made available for a new Windows zero-day vulnerability that allows unprivileged attackers to crash the Remote Access Connection Manager (RasMan) service. ACROS Security's 0patch service said it discovered a new denial-of-service (DoS) flaw while looking into CVE-2025-59230, a Windows RasMan privilege escalation vulnerability exploited in attacks that was patched in October. The new flaw has not been assigned a CVE identifier, and there is no evidence of it having been abused in the wild. It affects all Windows versions, including Windows 7 through Windows 11 and Windows Server 2008 R2 through Server 2025. Ukrainian National Charged for Cyber Attacks on Critical Infra — U.S. prosecutors have charged a Ukrainian national for her role in cyberattacks targeting critical infrastructure worldwide, including U.S. water systems, election systems, and nuclear facilities, on behalf of Russian state-backed hacktivist groups. Victoria Eduardovna Dubranova (aka Vika, Tory, and SovaSonya), 33, was allegedly part of two pro-Kremlin hacktivist groups named NoName057(16) and CyberArmyofRussia_Reborn (CARR), the latter of which was founded, funded, and directed by Russia's military intelligence service GRU. NoName057(16), a hacktivist group active since March 2022, has over 1,500 DDoS attacks against organizations in Ukraine and NATO countries. If found guilty, Dubranova faces up to 32 years in prison. She was extradited to the U.S. earlier this year. The U.S. Justice Department said the groups tampered with U.S. public water systems and caused an ammonia leak at a U.S. meat processing factory. Dubranova pleaded not guilty in a U.S. court last week. The U.S. government is also offering rewards for additional information on other members of the two groups. Prosecutors said administrators of the two collectives, dissatisfied with the level of support and funding from the GRU, went on to form Z-Pentest in September 2024 to conduct hack-and-leak operations and defacement attacks. "Pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems," U.S. and other allies said in a joint advisory. "Pro-Russia hacktivist groups – Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector 16, and affiliated groups – are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage." These groups are known for their opportunistic attacks, typically leveraging unsophisticated tradecraft like known security flaws, reconnaissance tools, and common password-guessing techniques to access networks and conduct SCADA intrusions. While their ability to consistently cause significant impact is limited, they also tend to work together to amplify each other's posts to reach a broader audience on platforms like Telegram and X. X's Safety team said it cooperated with U.S. authorities to suspend NoName057(16)'s account ("@NoName05716") for facilitating criminal conduct. APT36 Targets Indian Government Entities with Linux Malware — A new phishing campaign orchestrated by APT36 (aka Transparent Tribe) has been observed delivering tailored malware specifically crafted to compromise Linux-based BOSS operating environments prevalent in Indian government networks. "The intrusion begins with spear-phishing emails designed to lure recipients into opening weaponized Linux shortcut files," CYFIRMA said. "Once executed, these files silently download and run malicious components in the background while presenting benign content to the user, thereby facilitating stealthy initial access and follow-on exploitation." The attack culminates with the deployment of a Python-based Remote Administration Tool (RAT) that can collect system information, contact an external server, and run commands, granting the attackers remote control over infected hosts. "The group’s current activity reflects a broader trend in state-aligned espionage operations: the adoption of adaptive, context-aware delivery mechanisms designed to blend seamlessly into the target's technology landscape," the company said. Vietnamese IT and HR Firms Targeted by Operation Hanoi Thief — A threat cluster referred to as Operation Hanoi Thief has targeted Vietnamese IT departments and HR recruiters using fake resumes distributed as ZIP files in phishing emails to deliver malware called LOTUSHARVEST. The ZIP file contains a Windows shortcut (LNK) file that, when opened, executes a "pseudo-polyglot" payload present in the archive that serves as the lure and as well as the container for a batch script that displays a decoy PDF and uses DLL side-loading to load the LOTUSHARVEST DLL. The malware runs various anti-analysis checks and proceeds to harvest data from web browsers such as Google Chrome and Microsoft Edge. The activity has been attributed with medium confidence to a threat cluster of Chinese origin. Microsoft Adds New PowerShell Security Feature — With PowerShell 5.1, Microsoft has added a new feature to warn users when they're about to execute web content. The warning will alert users when executing the Invoke-WebRequest command without additional special parameters. "This prompt warns that scripts in the page could run during parsing and advises using the safer -UseBasicParsing parameter to avoid any script execution," Microsoft said. "Users must choose to continue or cancel the operation. This change helps protect against malicious web content by requiring user consent before potentially risky actions." The company also said it's rolling out a new Baseline Security Mode in Office, SharePoint, Exchange, Teams, and Entra that can automatically configure apps with minimum security requirements. The centralized experience began rolling out in phases last month and will be completed by March next year. "It provides admins with a dashboard to assess and improve security posture using impact reports and risk-based recommendations, with no immediate user impact," Microsoft said. "Admins can view the tenant's current security posture compared to Microsoft’s recommended minimum security bar." U.S. to Require Foreign Travelers to Share 5-Year Social Media History — The U.S. government will soon require all foreign travelers to provide five years' worth of social media history prior to their entry. This includes details about social media accounts, email addresses, and phone numbers used over the past five years. The new requirement will be applied to foreigners from all countries, including those who are eligible to visit the U.S. for 90 days without a visa. "We want to make sure we're not letting the wrong people enter our country," U.S. President Donald Trump said. New AitM Phishing Campaign Targets Microsoft 365 and Okta Users — An active adversary-in-the-middle (AitM) phishing campaign is targeting organizations that use Microsoft 365 and Okta for their single sign-on (SSO), with the main goal of hijacking the legitimate SSO flow and bypassing multi-factor authentication (MFA) methods that are not phishing-resistant. "When a victim uses Okta as their identity provider (IdP), the phishing page hijacks the SSO authentication flow to bring the victim to a second-stage phishing page, which acts as a proxy to the organization's legitimate Okta tenant and captures the victim’s credentials and session tokens," Datadog said. Phishing Campaign Uses Fake Calendly Invites to Spoof Major Brands — A large-scale phishing campaign has Calendly-themed phishing lures entered around a fake job opportunity to steal Google Workspace and Facebook business account credentials. These emails purport to originate from brands like Louis Vuitton, Unilever, Lego, and Disney, among others. "Only after the victim has responded to an initial email was the phishing link delivered under the guise of a Calendly link to book time for a call," Push Security said. "Clicking the link takes the victim to an authentic-looking page impersonating a Calendly landing page. From there, users are prompted to complete a CAPTCHA check and continue to sign in with their Google account, which causes their credentials to be stolen using an AitM phishing page. A similar variant has also been observed tricking victims into entering their Facebook account credentials on bogus pages, while another targets both Google and Facebook credentials using Browser-in-the-Browser (BitB) techniques that display fake pop-up windows featuring legitimate URLs to steal account credentials. The fact that the campaign is focused on compromising accounts responsible for managing digital ads on behalf of businesses shows that the threat actors are looking to launch malvertising campaigns for other kinds of attacks, including ClickFix. This is not the first time job-related lures have been used to steal account information. In October 2025, phishing emails impersonating Google Careers were used to phish credentials. In tandem, Push Security said it also observed a malvertising campaign in which users who searched for "Google Ads" on Google Search were served a malicious sponsored ad that's designed to capture their credentials. Calendar Subscriptions for Phishing and Malware Delivery — Threat actors have been found leveraging digital calendar subscription infrastructure to deliver malicious content. "The security risk arises from third-party calendar subscriptions hosted on expired or hijacked domains, which can be exploited for large-scale social engineering," Bitsight said. "Once a subscription is established, they can deliver calendar files that may contain harmful content, such as URLs or attachments, turning a helpful tool into an unexpected attack vector." The attack takes advantage of the fact that these third-party servers can add events directly to users' schedules. The cybersecurity company said it discovered more than 390 abandoned domains related to iCalendar synchronization (sync) requests for subscribed calendars, potentially putting about four million iOS and macOS devices at risk. All the identified domains have been sinkholed. The Gentlemen Ransomware Uses BYOVD Technique in Attacks — A nascent ransomware group called The Gentlemen has employed tactics common to advanced e-crime groups, such as Group Policy Objects (GPO) manipulation and Bring Your Own Vulnerable Driver (BYOVD), as part of double extortion attacks aimed at manufacturing, construction, healthcare, and insurance sectors across 17 countries. "Since its emergence, Gentlemen has been evaluated as one of the most active emerging ransomware groups in 2025, having attacked multiple regions and industries in a relatively short period," AhnLab said. The group emerged around July 2025, with PRODAFT noting in mid-October that Phantom Mantis (ArmCorp), led by LARVA-368 (hastalamuerte), tested Qilin (Pestilent Mantis), Embargo (Primeval Mantis), LockBit (Tenacious Mantis), Medusa (Venomous Mantis), and BlackLock (Incredible Mantis), before building their own ransomware-as-a-service (RaaS): The Gentlemen. 🎥 Cybersecurity Webinars Defining the New Layers of Cloud Defense with Zero Trust and AI: This webinar shows how Zero Trust and AI help stop modern, fileless attacks. Zscaler experts explain new tactics like “living off the land” and fileless reassembly, and how proactive visibility and secure developer environments keep organizations ahead of emerging threats. Speed vs. Security: How to Patch Faster Without Opening New Doors to Attackers: This session explores how to balance speed and security when using community patching tools like Chocolatey and Winget. Gene Moody, Field CTO at Action1, examines real risks in open repositories—outdated packages, weak signatures, and unverified code—and shows how to set clear guardrails that keep patching fast but safe. Attendees will learn when to trust community sources, how to detect version drift, and how to run controlled rollouts without slowing operations. 🔧 Cybersecurity Tools Strix: A small open-source tool that helps developers build command-line interfaces (CLIs) more easily. It focuses on keeping setup simple and commands clear, so you can create tools that behave the same way every time. Instead of dealing with complex frameworks, you can use Strix to define commands, handle arguments, and manage output in a few straightforward steps. Heisenberg: It is a simple, open-source tool that looks at the software your projects depend on and checks how healthy and safe those parts are. It reads information about packages from public sources and “software bills of materials” (SBOMs) to find security problems or bad signals in your dependency chain and can produce reports for one package or many at once. The idea is to help teams spot risky or vulnerable components early, especially as they change, so you can understand supply chain risks without a complex setup. Disclaimer: These tools are for learning and research only. They haven’t been fully tested for security. If used the wrong way, they could cause harm. Check the code first, test only in safe places, and follow all rules and laws. Conclusion We listed a lot of fixes today, but reading about them doesn't secure your device—installing them does. The attackers are moving fast, so don't leave these updates for 'later.' Take five minutes right now to check your systems, restart if you need to, and head into the weekend knowing you are one step ahead of the bad guys.
thehackernews.comDec 15, 2025extracted