Microsoft is rolling out a significant security enhancement for its Authenticator app starting February 2026, introducing jailbreak and root detection capabilities that will automatically wipe Microsoft Entra credentials from compromised devices. This move represents a strategic shift toward strengthening enterprise identity security by preventing unauthorized account access through manipulated mobile platforms. The upcoming change will […]
The cybersecurity threat landscape shifted dramatically on October 30, 2025, when security researchers monitoring honeypot infrastructure detected a significantly evolved variant of the RondoDox botnet. The updated malware now features 75 distinct exploitation vectors, a fundamental expansion that transforms the threat from a primarily IoT-focused botnet into a multifaceted enterprise threat capable of targeting everything […]
The decentralised finance (DeFi) ecosystem was rocked by a significant exploit targeting Balancer, one of the leading DeFi platforms. The breach specifically impacted Balancer’s V2 Composable Stable Pools, resulting in losses that reportedly exceed $100 million. This major incident highlights ongoing security challenges within the DeFi sector and underscores the importance of robust auditing and […]
Security researchers have identified a dangerous remote access trojan called SleepyDuck lurking in the Open VSX IDE extension marketplace, targeting developers who use code editors like Cursor and Windsurf. The malicious extension masqueraded as a legitimate Solidity programming language helper, squatting on the name of an established extension to evade detection. The compromised extension juan-bianco.solidity-vlang […]
An ongoing malicious advertising campaign is weaponizing legitimate software downloads to deploy OysterLoader malware, previously identified as Broomstick and CleanUpLoader.
This sophisticated initial access tool enables cybercriminals to establish footholds in corporate networks, ultimately serving as a delivery mechanism for the notorious Rhysida ransomware gang.
The Rhysida ransomware operation has targeted enterprises since emerging from the Vice Society group in 2021, later rebranding in 2023. Despite attempts to evade law enforcement through name changes, security researchers continue tracking their evolving tactics.
The current campaign uncovered by Expel represents their second major malvertising operation, building on tactics proven successful during their initial run from May to September 2024. Since June 2025, threat actors have maintained persistent operations with dramatically increased intensity and scope.
Rhysida’s Evolution and Persistent Threat
Rhysida operators purchase advertisements on Bing’s search engine, directing unsuspecting users toward convincing but malicious landing pages.
These sponsored results appear prominently in search results and even within Windows 11 start menu searches, placing malware downloads directly before potential victims.
Recent campaigns have impersonated popular software, including Microsoft Teams, PuTTY, and Zoom, with threat actors creating nearly identical fake download pages.
Bing ads showing up in the Windows 11 start menu, that one result is sponsored and misspells PuTTy as “Putty”
The malicious PuTTY advertisements demonstrate this technique, with sponsored results intentionally misspelling “PuTTY” as “Putty” while appearing legitimate enough to deceive users seeking the authentic remote access tool.
OysterLoader’s effectiveness stems from two primary evasion techniques. First, attackers pack the malware through compression and obfuscation, hiding its true capabilities from security tools.
This results in remarkably low initial detection rates, with fewer than five antivirus engines typically flagging new samples. Second, threat actors employ code-signing certificates, exploiting Windows trust mechanisms to appear legitimate.
Due to their obfuscation, it can take several days before more AV engines flag the malware
The scale of this operation is evident in certificate usage. While the 2024 campaign utilized seven certificates, the current 2025 campaign has burned through over 40 unique code-signing certificates, indicating substantial resource investment and operational commitment.
Rhysida doesn’t rely solely on OysterLoader. Expel researchers discovered the gang simultaneously deploying Latrodectus malware, confirmed when identical code-signing certificates appeared on both malware families.
Additionally, Rhysida has exploited Microsoft’s Trusted Signing service, circumventing its 72-hour certificate validity restrictions. Microsoft reports revoking over 200 certificates associated with this campaign, yet operations remain active.
Security teams should remain vigilant against malvertising campaigns and verify software downloads exclusively through official channels to avoid compromise.
Google’s artificial intelligence (AI)-powered cybersecurity agent called Big Sleep has been credited by Apple for discovering as many as five different security flaws in the WebKit component used in its Safari web browser that, if successfully exploited, could result in a browser crash or memory corruption.
The list of vulnerabilities is as follows –
CVE-2025-43429 – A buffer overflow
Federal prosecutors in the U.S. have accused a trio of allegedly hacking the networks of five U.S. companies with BlackCat (aka ALPHV) ransomware between May and November 2023 and extorting them.
Ryan Clifford Goldberg, Kevin Tyler Martin, and an unnamed co–conspirator (aka “Co-Conspirator 1”) based in Florida, all U.S. nationals, are said to have used the ransomware strain against a medical
The Rhysida ransomware gang has been running a sophisticated malvertising campaign that delivers OysterLoader malware through deceptive search engine advertisements, giving attackers complete access to compromised devices and networks. The Rhysida gang, formerly known as Vice Society before rebranding in 2023, has perfected a dangerous infection chain using paid Bing search advertisements. The gang purchases […]
Microsoft’s Detection and Response Team has exposed a sophisticated backdoor malware that exploits the OpenAI Assistants API as an unconventional command-and-control communication channel. Named SesameOp, this threat demonstrates how adversaries are rapidly adapting to leverage legitimate cloud services for malicious purposes, making detection significantly more challenging for security teams. The discovery highlights the evolving tactics […]
Microsoft has acknowledged a critical issue affecting Windows Server 2025 systems enrolled in the Hotpatch program. A recent Windows Server Update Services (WSUS) patch was inadvertently distributed to machines configured to receive Hotpatch updates, causing disruptions to the seamless patching process that allows security updates without requiring system restarts. Distribution Error Impacts Hotpatch-Enrolled Systems The […]
