The cyber underground has been busy, Digital Defenders. |
Today brings browser backdoors hiding in plain sight, developer tools turning against their users, inbox traps spiking for the holidays, mandatory system apps reshaping mobile security, and a fast-evolving stealer tearing through Discord. |
|
|
Here’s what you need to know: |
|
|
RCE Backdoor in Extensions Hits 4.3 Million Users |
A long-running spyware campaign quietly turned trusted Chrome and Edge extensions into surveillance tools for more than 4.3 million users.
Researchers say ShadyPanda spent years building trust before delivering a mid-2024 update that enabled hourly RCE with full browser access — allowing persistent monitoring, cookie theft, keystroke capture, HTTPS interception, and cross-device tracking. |
This is an active campaign in the wild.
Regularly audit and control extensions, monitor for compromise, restrict updates, reset affected profiles, harden high-risk devices, and train users to recognize extension risks. |
Codex Flaw Enables Silent RCE in Developer Workflows |
A command-injection flaw in OpenAI’s Codex CLI lets attackers run arbitrary commands the instant a developer uses the tool in a compromised repository.
Check Point researchers found that simple project files like .env or config.toml can silently trigger remote-execution payloads with no prompts or approvals. OpenAI has released a patch for the issue.
Audit repos for risky Codex configs, centralize approved settings, monitor activity, rotate exposed credentials, enforce strict PR hygiene, and run Codex only in sandboxed or least-privilege environments. |
FBI Warns Gmail and Outlook Users of Holiday Phishing Surge |
A new FBI alert warns that criminals are intensifying phishing campaigns targeting Gmail and Outlook users as holiday shopping peaks.
Despite built-in filtering, dangerous emails, including malicious links, spoofed offers, and weaponized PDFs, are still reaching users, with VIPRE reporting that over 90% of phishing attempts now target Gmail and Outlook.
Verify senders, use email protections, avoid clicking email links or attachments, and use phishing-resistant MFA. |
|
|
How safe is your browser, really? |
|
|
Yesterday's Pulse Check Results |
How confident are you in your org’s playbook for a large-scale breach? |
|
|
Security Tools You Can Use |
-
Gain real-world IT expertise and earn certifications from A+ to CySA+ with a single comprehensive training bundle.
-
Don’t let hidden gaps become liabilities — see which vulnerability tools reveal risks before adversaries can exploit them.
-
Keep a step ahead of threat actors — explore tools designed to reinforce your defenses before attacks land.
|
|
|
India Requires Undeletable Security App on All Smartphones |
India has ordered every major smartphone vendor to preload Sanchar Saathi, an undeletable government security app, onto all new devices sold in the country.
The mandate sparked immediate concern from privacy advocates and device makers, who warn it eliminates user consent and installs a privileged system app that can’t be removed. |
Source: Naveed Ahmed/Unsplash |
For enterprises operating in India, the move expands the attack surface, forces unavoidable data flows, and complicates BYOD and fleet compliance.
Update mobile policies, monitor for abnormal device behavior, enforce strong privacy controls, limit sensitive access, deploy mobile threat defense, minimize local data, and clearly guide employees on compliance requirements.. |
Rapidly Evolving Arkanix Stealer Targets Credentials and Wallets |
A rapidly spreading infostealer called Arkanix is moving through Discord, giving attackers a quick path to steal credentials, wallets, system data, and more.
In a matter of weeks, Arkanix has moved from a simple Python script to a full C++ stealer with Chrome decryption, premium tiers, and real-time victim tracking.
Block untrusted executables from Discord, harden browsers, watch for suspicious outbound traffic, rotate exposed credentials, enforce least-privilege, block malicious behaviors with EDR, and train users to avoid untrusted files.
|
|
|
Build automated playbooks, streamline incident response, and eliminate repetitive tasks in minutes — Blink Copilot turns complex security operations into effortless execution. Experience the speed of no-code automation. Build in minutes, not months. |
|
|
How Strong Is Your DevSecOps Workflow Today? |
DevSecOps matters now more than ever because CI/CD systems have become high-value paths into production — and even small misconfigurations can create outsized risk when code ships continuously. |
How to harden your software supply chain: |
-
Integrate security early by combining shift-left testing, dependency/SBOM checks, and IaC scanning to catch vulnerabilities before they reach production.
-
Protect sensitive assets through secrets scanning and strict access controls that limit who can modify pipelines or deploy code.
- Ensure build integrity using signed artifacts and attestation to verify that only trusted, untampered code moves through the CI/CD workflow.
|
By applying these DevSecOps controls, teams can surface vulnerabilities earlier and meaningfully reduce supply-chain exposure. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
