← Cybersecurity Headlines
Cybersecurity Headlines
US taps private firms in cyber offensive, Microsoft updates cause queuing failures, phishing campaign delivers Phantom Stealer
00:07:46
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Tuesday, December 16, 2025. I'm Sarah Lane. U.S. turns to private Firms in Cyber Offensive Late last week, Bloomberg sources say that the US Administration is preparing a new national cyber strategy that that would enlist private companies to help carry out offensive cyber operations against criminal and state backed attackers. The plan would expand the government's cyber capacity but raises legal and security risks since private firms currently lack clear authority to conduct attacks and could become targets themselves. The strategy also calls for streamlining cyber regulations, modernizing federal systems and and accelerating post quantum security with more details expected through an executive order or legislation. Microsoft Updates cause Queuing Failures Microsoft said its latest Patch Tuesday updates introduced a breaking change to the message queuing, or MSMQ security model, causing enterprise apps and some sites to fail on Windows 10 22H2 and Windows Server 2016 and 2019. The updates altered NTFS permissions on a core MSMQ system folder, requiring write access normally limited to administrators, which can trigger misleading resource errors and disrupt clustered environments. Admins now face rolling back the patches or leaving systems exposed. MSMQ has a history of critical remote code execution flaws. Russian phishing campaign delivers Phantom stealer Researchers at socrite Labs have identified a Russian linked phishing campaign dubbed Operation Money Mount ISO that delivers phantom stealer malware using ISO files to bypass email security controls. The attack uses fake payment confirmation emails in Russian, luring finance related staff into opening a zip file that contains a malicious ISO which mounts a disguised executable and injects the stealer directly into memory. Phantom Stealer harvests browser credentials, financial and crypto data, keystrokes and tokens, exfiltrating the information via Telegram, Discord and FTP. Jaguar Land Rover payroll data Stolen Jaguar Land Rover disclosed that the cyber attack that shut down its factories back in August also included theft of sensitive payroll data belonging to thousands of current and former employees, including bank details and tax information. JLR says there's no evidence of misuse. So far, Bud has warned staff to watch for fraud and phishing. The attack is attributed to the scattered Lapses Hunters group and has already cost JLR around £1.5 billion in lost sales and has been classified as a systemic event that could cost the UK economy more than 2 billion pounds. Huge thanks to our sponsor Adaptive Security. This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Attackers don't need malware anymore. They need trust. Set a simple passphrase for high risk actions like wire requests or urgent account recovery, especially within finance teams and families. And if the caller can't answer it, pause and verify adaptive runs, deepfake and phishing simulations so employees practice this before it is real. Learn more@adaptivesecurity.com CISA adds Apple and Gladonet center stack and trio Fox flaws to exploits the US Cybersecurity and Infrastructure Security Agency known as CISA added two vulnerabilities to its known exploited catalog, a use after free flaw in Apple's WebKit affecting iOS, iPadOS and macros which we told you about yesterday, and a hard coded AES key issue in gladonet Center Stack and Trio Fox. Both have been actively targeted, including in sophisticated attacks against high value individuals. Federal agencies are required to remediate these flaws by January 5th. Private organizations should review and patch affected systems to prevent exploitation. Opexus says Background checks missed flags before insider breach US Federal contractor Opexus admits it failed to identify red flags when hiring twin brothers Moonib and Sohaib actor who had pleaded guilty to cybercrimes in 2015. Back in February of this year, minutes after being fired, Muneeb allegedly deleted 96 U.S. government databases and stole sensitive records from DHS, IRS and EEOC. Opexis has acknowledged errors in hiring, termination and access controls and has enhanced background checks to 10 years. The brothers face up to 45 years in prison for computer fraud, data theft and aggravated identity theft. Chrome Extension intercepts AI chats Chrome Extension Urban VPN Proxy, which has 6 million users, was found intercepting all prompts and responses from AI chatbots like ChatGPT, Claude, Copilot, Gemini and Meta AI. The extension was updated back in July and collects this data through injected JavaScript and sends it to two servers. The company shares raw data with its affiliated ad intelligence firm By Science, which also owns Urban Cybersecurity. Similar harvesting was observed in three other extensions from the same publisher. Google shutters Dark Web Tool Google emailed users that on February 16th it is shutting down its Dark Web Report tool, which monitored email addresses on the Dark Web. Dark Web scans will end on January 15th and all data will be deleted on the shutdown date. Google said. Feedback claimed it didn't provide helpful next steps, and it plans to focus on tools going forward, offering actionable guidance like security checkup, password Manager, passkeys and two step verification. CISOs first appeared in the C Suite more than 30 years ago, but that their responsibilities and function within an organization still vary pretty wildly. Organizations need to understand how their CISO operates if they want to make them effective. We dig into how to bridge that gap in our latest CISO series podcast episode. Look for the episode how much risk would a CISO risk if a CISO could Risk Risk. Wherever you get your podcasts, if you have thoughts on the news from today or about our show in general this, be sure to reach out to us. Feedbackisoseries.com we would love to hear from you. I am Sarah Lane reporting for the CISO series and I will talk to you tomorrow.
- [07:30]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the headlines.