Cyber adversaries are sharpening their tools, Digital Defenders.

Phishing kits drive ransomware, wormable malware targets open-source systems, and fake job postings conceal espionage. The playbook is evolving… are your defenses keeping up?

Before you jump into today's news: Think you know Snapdragon inside and out? Take the quiz and prove it.

Here’s what you need to know:

Zero-Day Download

Phishing Is Now the Leading Cause of Ransomware

SpyCloud reports that phishing now accounts for 35% of ransomware in 2025, up from 25% in 2024.

The SpyCloud team warns PhaaS, phishing kits, and AiTM proxies lower the skill barrier, arming novices with powerful tools. Yet, with 85% of firms hit by ransomware, confidence still outpaces readiness. The report cautions that AI-powered phishing will escalate risks ahead.

Source: SpyCloud

Require MFA, enforce domain security, leverage AI analytics, train staff with advanced simulations, and integrate threat intel with EDR to quickly stop phishing, infostealers, and session hijacking.

npm Supply Chain Shaken: GitHub Responds With New Rules

GitHub introduced new npm publishing rules after the Shai-Hulud worm compromised 500+ JavaScript packages in September 2025.

The worm spread through hijacked maintainer accounts, injected post-install scripts, and stole secrets—illustrating how rapidly self-replicating malware and token theft can cascade across ecosystems and endanger enterprises relying on open-source software.

GitHub’s roadmap introduces stricter safeguards, including mandatory 2FA, short-lived, granular tokens, and wider adoption of trusted publishing, to prevent API token abuse. GitHub recommends adopting the new safeguards.

Adopt WebAuthn-based 2FA, audit publishing permissions, and transition to trusted publishing workflows. 

ICS Malware Declines but Risks Persist in Q2 2025

Industrial automation systems experienced a slight decline in overall infections last quarter. But the risks are far from eliminated. 

Kaspersky ICS CERT found 20.5% of ICS systems blocked threats in Q2 2025, down from Q1 and 2024. Biometrics experienced the highest infection rates, while phishing emails increased, even as removable media threats reached record lows. The threats to global OT security remain ongoing. 

Strengthen phishing defenses by segmenting OT from enterprise IT environments and enforcing MFA on remote access to reduce risk.

Share this newsletter!

Pulse Check

What’s your biggest concern with open source?

Yesterday's Pulse Check Results

Which cyber trend keeps you up at night?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

APT Job Scam Targets Defense and Telecom With Advanced Malware

Check Point uncovered an Iranian-linked campaign where Nimbus Manticore lures job seekers with fake career portals to deliver advanced malware.

Victims are lured via networking sites and spear-phishing emails posing as aerospace and defense firms. They were then directed to fake portals that deliver MiniJunk (DLL hijacking persistence) and MiniBrowse (cookie and credential theft), both designed to evade detection and maintain covert access.

Source: ChatGPT

This is an ongoing attack targeting job seekers.

Enforce code integrity, track DLL load anomalies, and deploy advanced phishing defenses to block malicious job lures before they reach applicants.

Telecom Threat Neutralized: 100K SIM Cards Seized by Feds

The US Secret Service seized 300+ SIM servers and 100,000 SIM cards in New York, disrupting an “imminent threat” to senior officials.

Investigators warned the network could disable cell towers, launch DoS attacks, and enable encrypted channels for hostile actors, with early forensics tying it to foreign entities. This is an ongoing investigation.

The case is a stark reminder that telecom infrastructure is a prime target for disruption. Audit your organization’s telecom dependencies and ensure continuity plans account for service outages driven by targeted attacks.

Join top identity and security experts at HIPConf25 in Charleston! Sharpen your skills, connect with peers, and explore the latest in hybrid identity protection. Don’t miss keynotes from Former Director of the Cybersecurity and Infrastructure Security Agency (CISA) Jen Easterly, Cyberpsychologist Dr. Mary Aiken, and Former U.S. National Cyber Director Chris Inglis.

Security Tip of the Day

Are Attackers Already Inside Your ICS Network?

Industrial control systems (ICS) and operational technology (OT) are prime targets for attackers looking to disrupt critical infrastructure. 

Strengthening defenses now is essential to prevent costly downtime and cascading failures.

Source: ChatGPT

Here's how to bolster your OT defenses:

ICS networks can’t afford weak links—one breach can trigger major outages. Combining segmentation, phishing defense, strong authentication, and continuous monitoring reduces risk and strengthens resilience. 

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.