← Cybersecurity Headlines
Cybersecurity Headlines
Spain arrest over data records, goodbye dark Telegram, scammers poison AI search results
00:07:24
Loading summary
Transcript5 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Wednesday, December 10, 2025. I'm Sarah Lane, Spain Arrest over data Records Spanish authorities arrested a 19 year old in Barcelona for allegedly stealing 64 million personal records from nine companies and attempting to sell them online. The data included names, addresses, emails, phone numbers, DNI numbers and ibans. The teen used multiple accounts and pseudonyms on hacker forums, computers and cryptocurrency. Wallets linked to the sales were confiscated. Separately, Ukrainian cyber Police arrested a 22 year old who sold access to hacked switch social media accounts using custom malware and a 5000 account bot farm. Facing up to 15 years in prison. Goodbye Dark Telegram Kaspersky analyzed more than 800 blocked cybercrime channels on Telegram and found the underground is steadily moving away from the platform due to rising shutdowns. The median lifespan of illicit channels grew from five months in 2021 through 2022 to to nine months in 2023 through 2024, but blocking activity accelerated since late 2024. Telegram's lack of default end to end encryption, centralized infrastructure and closed server code make it less attractive to experienced operators. Scammers poison AI search Results Scammers appear to be manipulating the public websites that AI tools rely on, causing systems like Google's AI Overview and Perplexity's comment to recommend fraudulent customer support numbers. Researchers at Aurascapes Ora Labs say that attackers are planting Geo and AEO optimized spam across compromised government and university sites, WordPress blogs, YouTube descriptions and Yelp reviews. LLMs then scrape and merge this poison content into answers that look legitimate. Tests showed bogus numbers for Emirates and British Airways surfaced by both Perplexity and Google. React to Shell tied to North Korea Sysdig researchers say that new React to Shell attacks are starting to resemble North Korean intrusion campaigns. The team found a compromised app dropping Ether Rat, a remote access trojan that uses Ethereum smart contracts for command and control and installs five persistent mechanisms. The tooling overlaps with DPRK linked contagious interview activity, suggesting either North Korean operators have adopted React, who Shell or multiple state groups are sharing techniques. Sysdig says Ether Rat reflects a shift from opportunistic crypto mining to stealthy long term access with blockchain based C2 and resilient persistence.
- [03:18]
Huge thanks to our sponsor Adaptive Security. This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Picture a new hire who interviews well accept their synthetic AI video, AI voice, AI backstory. Once they're in, they go after payroll, internal docs and access. That is the new reality. The attack surface is trust itself. Adaptive fights back with realistic deep fake simulations and training that actually sticks. Learn more@adaptivesecurity.com.
- [04:00]
Humanoid robots go Mainstream Security experts warn that the rise of AI powered humanoid robots poses new cyber risks, including the potential for physical botnets. With forecasts of billions of robots by 2060 across industries and households, vulnerabilities in connectivity, AI learning and embedded sensors could allow attacks, espionage or hijacking. A recent proof of concept exploited unitree robots Bluetooth interface allowing wormable malware Experts predict a new sector for humanoid robot cybersecurity we will emerge Fortinet warns of bypass flaws Fortinet patched critical vulnerabilities in Fort OS, Forti, Web, Fort Proxy and FortiSwitch Manager that could let attackers bypass forticloud SSO authentication exploits abuse weak cryptographic signature verification via malicious SAML messages for to cloud. SSO is not enabled by default, but admins should disable it if it's active until updating. Additional fixes address unverified password changes and hash based authentication bypasses. Khashoggi Widow files Complaint Hanan Alader Khashoggi has filed a complaint in France alleging that Saudi Arabia infected her devices with NSO Groups PA Pegasus spyware before Jamal Khashoggi's 2018 murder. The filing cites Citizen Lab's analysis showing both her phones were compromised, likely during questioning in the United Arab Emirates, and argues that interception is linked to events leading to her husband's death. A French judge will decide whether to investigate. A US judge dismissed her earlier lawsuit against NSO in in 2023 Castle Loader as Gray Bravo Expands Malware service Recorded Futures Insect Group has identified four distinct threat clusters using the Castle Loader Malware Loader, highlighting Gray Bravo's expansion as a malware as a service provider. Gray Bravo's toolkit includes Castle Rat and Castlebot, which deploys dll, EXE and PE payloads for such as Deer Stealer, Redline Stealer and netsupport Rats. The clusters exploit phishing, click fix campaigns, fake software updates and malvertising, often targeting logistics and travel sectors. Operations leverage multi tiered infrastructure including tier 1 C2 servers and VPs backups. If you have thoughts on the news from today or about our show in general, be sure to reach out to us@feedbackisoseries.com we really want to hear from you. I am Sarah Lane reporting for the CISO series and you stay classy. Planet Earth.
- [07:08]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.