Daily Cyber Threat Brief – December 24, 2025 (Ep. 1033)

Host: Ben (DJ B Sec) | Simply Cyber Media Group

Featuring: Sarah Lane (CISO Series Headlines) & Community Interaction

Episode Overview

On this Christmas Eve edition, Ben (DJ B Sec) walks the community through eight of the day's top cybersecurity news stories. Even during the holidays, cyber threats don’t stop, and today’s episode highlights major corporate acquisitions, new malware variants, social engineering schemes, significant software vulnerabilities, and more. The briefing balances technical analysis with practical, relatable advice for both blue and red teamers, and offers a healthy portion of community interaction, using real-world stories to drive home security awareness and actionable mitigations.

Key News Stories & Insights

1. ServiceNow Acquires Armis for $7.7 Billion

• [07:25 - 11:08]
• ServiceNow, a major platform in IT service management, is set to acquire Armis, a leader in cyber exposure management—especially for IT, OT, and medical devices.
• Ben’s Take:
  • “That is a massive payout… ServiceNow is already huge, used for help desks and ticketing, now they're going to become even bigger with AI-powered security & vulnerability response.”
• Implications:
  • The acquisition gives ServiceNow deeper security capabilities, notably around cyber-physical asset management, making it a “bigger, badder, one of the big boys on the block.”

2. Mac Stealer Variant Uses Quieter, Signed Install

• [11:08 - 17:02]
• JAMF Threat Labs found a new, sophisticated variant of the MacSteal Sync Stealer malware disguised as a notarized, Apple-signed Swift app.
  • Distributed via disk images (.img file), appears legit, and uses an automated install process to evade user suspicion.
  • Payload is downloaded and executed in-memory, leaving few forensic traces; user interaction is cleverly minimized.
• Technical Insights:
  • “It passes static code analysis – nothing to see here. The installer prompts the user to right-click and open (bypassing Gatekeeper warnings). Detection rates are low—virus total flags range from 1 to 13 engines.”
• Defensive Guidance:
  • Ben urges defenders to block email distribution of disk images (both .iso and .img files) and educate users (execs, marketers, etc.) about suspicious Mac downloads.

3. SEC Sues Crypto Firms Using Deepfake Scams

• [17:02 - 23:27]
• The US Securities and Exchange Commission (SEC) sued seven crypto-related firms for using WhatsApp-based investment clubs, deepfakes, and AI-generated tips to steal $14+ million from investors.
  • Victims were lured to bogus platforms, then blocked from withdrawals unless extra “fees” were paid; funds moved to Southeast Asian accounts.
• Memorable Quote:
  • “If somebody’s sending you something on WhatsApp, Signal, Telegram and you don’t know these people, stop clicking… Quit going out to it!” – Ben (17:51)
• Key Takeaways:
  • Scammers leverage deepfake voices and videos for credibility (“I created a deepfake of our CEO and sent that out. Everyone’s like, whoa, that’s really good.”)
• Actionable Advice:
  • Train users to recognize deepfakes; “if it seems too good to be true, it probably is.”
  • Encourage reporting and use of secure payment methods (credit, PayPal).

4. Nissan Data Breach via Red Hat Managed GitLab

• [23:27 - 27:52]
• Roughly 21,000 Japanese Nissan customers had PII (names, addresses, phones, partial emails) exposed after attackers breached a Red Hat managed GitLab server used by a former Nissan dealer.
  • No payment info was taken. Notably, it’s Nissan’s third major breach in three years.
• Insight:
  • “This is a third-party risk problem… When you use SaaS and outsourcing, your risk register has to reflect theirs.”– Ben (24:05)
• Takeaway:
  • Third-party risk management is often overlooked but critical, especially when cloud providers or vendors host sensitive data.

5. N8N Workflow Automation Platform Vulnerability

• [30:49 - 35:50]
• A critical flaw in n8n’s workflow expression system allows authenticated users to run arbitrary code.
  • Up to 100,000 internet-facing n8n instances may be vulnerable; CVSS 9.9. PATCH URGENTLY.
• Why It Matters:
  • n8n connects multiple services (Gmail, ChatGPT, etc.)—compromise grants “keys to the kingdom.”
  • “If someone got into that automation, they have access to… everything.”– Ben (31:25)
• Advice:
  • Immediate patching is vital. If you self-host n8n, DON’T delay. Attackers could chain this with other exploits for broad compromise.

6. WebRAT Malware Hidden in GitHub Proof-of-Concept Exploits

• [35:50 - 43:02]
• Kaspersky identified at least 15 malicious GitHub repositories posing as PoC exploits for Windows and WordPress vulnerabilities, actually delivering WebRAT backdoor.
  • Capabilities include disabling Windows Defender, stealing login credentials, crypto wallets, webcam spying, and keylogging.
• Ben’s Guidance:
  • “Don’t download and install things you don’t know. Use a sandbox before touching anything from GitHub you’re unsure about.”
• Defensive Actions:
  • Threat hunters should check registry modifications, block hardcoded Russian C2 URLs, and monitor hash signatures Kaspersky provided.

7. Feds Disrupt Multi-Million Dollar Bank Account Takeover Panel

• [43:02 - 48:03]
• DOJ seized web3adspanels.org, a criminal control panel for bank account takeovers. Criminals bought fraudulent ads on Google/Bing mimicking real banks; victims entered credentials, which were sent to crooks.
  • At least $14.6 million in confirmed losses among 19 victims; losses this year top $262 million.
• Memorable Advice:
  • “Don’t click on ads for your bank! Type the URL. Ads can be typosquatted… Always trust but verify.”– Ben (43:54)
• Key Point:
  • Awareness and user training are the best mitigation. Don’t assume the first search result is legitimate.

8. Malicious Chrome Extensions – Phantom Shuttle

• [48:03 - 55:57]
• Two Chrome extensions named “Phantom Shuttle” (posing as network speed test/VPN) were found exfiltrating credentials, payment data, and more from 170+ domains via proxies.
  • Operation has reportedly run for years; likely tied to China.
• Security Lessons:
  • “Don’t install random extensions—if you don’t know it’s 100% legit, assume it’s hostile. 100% clean-looking code isn’t always safe anymore.”
  • These extensions added auto-configuration proxy scripts, rerouting all traffic.
• Threat Hunting Tip:
  • Look for network calls to “phantomshuttle.space” to identify infections.

Notable Community Moments, Practical Security Lessons, and Quotes

Deepfake Awareness & Family

• [17:51]: Ben shares that he created a deepfake of his own CEO to test colleagues. “We need to start exposing users to deepfakes and show them how good they’ve gotten.”
• Personal anecdote: Ben’s parents nearly fell for a social media scam, only saved by using PayPal. “We all need to tell and explain to people what’s going on… they know about scams but don’t always understand the details.”

Social Engineering Training

• [48:03+]: Numerous stories highlight that technical controls are only half the battle—user education (family, coworkers, C-suite) is vital.
• “If something seems off, question it. That’s all we ask,” says Ben, echoing viewer Marcus’ comment about his dad calling for help if suspicious.

Defense-in-Depth: Block List Building

• Multiple segments include tips for blue teamers:
  • Maintain hash and domain blocklists (especially Russian or .ru C2 domains).
  • Block risky filetypes (.img, .iso) in email to reduce phishing/malware.
  • Review browser extension lists on endpoints for new/unknown entries.

Engaging & Memorable Quotes

• On User Training:
  “The whole week is just one big, don’t go out willy-nilly clicking on things...don’t just go out there clicking on things and not knowing what they are!” – Ben (55:57)
• On Third-Party Risk:
  “Third party risk is usually the last part that gets put in place because it’s so cumbersome… but it’s a big deal.” – Ben (24:05)
• On Education:
  “Use the technologies that are used against us, for us… Show people deepfakes, social engineering, so they’re not caught off guard.” – Ben
• On Bank Account Takeover Scams:
  “Don’t click on ads. PERIOD. I type Chase.com. I don’t trust ads.” – Ben

Community Q&A & Jawjacking (Post-News)

• [58:06+]: Ben answers questions about moving into management in cybersecurity, cert prep (SecAI+ vs ISACA CRISC), the value of learning automation (n8n, Make, Zapier), and how AI and LLM knowledge will be increasingly relevant.
• Fun aside: The community jokes that “If Die Hard is a Christmas movie, is Home Alone 2 a hacker movie? Since Kevin McCallister social engineered his way into the hotel.”
• Ben shares personal anecdotes about Texas “snow days,” holiday traditions, and how the blue team philosophy is to always stay vigilant—even on Christmas Eve.

Timestamps – Jump to the Top Segments

• 07:25: ServiceNow/Armis acquisition analysis
• 11:08: New Mac Stealer variant technical dive
• 17:02: SEC sues crypto firms for deepfake investment scams
• 23:27: Nissan's customer data breach via Red Hat
• 30:49: Critical n8n platform RCE vulnerability
• 35:50: WebRAT malware on GitHub PoCs
• 43:02: DOJ bank account takeover disruption
• 48:03: Malicious “Phantom Shuttle” Chrome extensions in the wild
• 58:06 onward: Jawjacking/Q&A – career, certs, AI, automation, and holiday community vibes

Summary Takeaways

• Holidays or not, cyber threats keep coming; defenders must stay alert.
• AI and automation are double-edged swords—in the hands of attackers and defenders.
• Third-party and supply chain risk continue to drive major breaches.
• User education, skepticism, and clear communication are the best front-line defenses.

“If something seems off—question it. That’s all we ask.”

For Further Engagement

Catch the daily live briefings at 8AM ET: Simply Cyber Streams
And join the community discussion for career guidance, hands-on security chat, and always a dose of cybersecurity camaraderie.

Happy Holidays and Stay Secure!