RadioCSIRT - Your Cybersecurity update for Saturday, November 8, 2025 (Ep. 479)

Welcome to your weekend cybersecurity bulletin 🕵️‍♂️🔥 💰 Microsoft warns of payroll phishing campaign Microsoft is alerting organizations to a sophisticated phishing operation dubbed Payroll Pirates. Attackers impersonate HR departments to steal Microsoft 365 credentials and divert employee payroll deposits. The campaign uses spoofed domains and genuine Microsoft forms to bypass security filters. 🎓 Iranian APT targets academic researchers An Iran-linked group known as APT42 is conducting espionage campaigns against academics and researchers in Europe and North America. Attackers use fake university contact emails and cloned institutional portals to harvest personal data and login credentials. 🎥 ClickFix — Fake CAPTCHA sites now include video tutorials Operators behind the ClickFix campaign have added video guides to their fake CAPTCHA pages. These malicious sites automatically copy code to the user’s clipboard, tricking them into running info-stealers like Lumma or Atomic Stealer. A countdown timer adds urgency, enhancing the social engineering effect. 🛡️ U.S. Defense Department unveils long-term cyber force strategy The Pentagon has released a complete overhaul of its cyber doctrine. The plan, a successor to Cyber Command 2.0, aims to structure cyber training and innovation over the next decade. The Advanced Cyber Training Center is not expected to reach initial capability until 2028 and full readiness until 2031, highlighting the slow implementation timeline. 🇪🇺 EU Parliament backs broader data powers for Europol The LIBE Committee of the European Parliament approved a proposal to expand Europol’s ability to collect and share biometric data to combat human trafficking. Privacy advocates warn it could pave the way for mass surveillance. The proposal now moves to a full plenary vote later this month. 🧩 Drupal — Two new vulnerabilities in contributed modules Two Drupal modules were found vulnerable: Simple multi step form (XSS, CVE-2025-12761) and Email TFA (access bypass, CVE-2025-12760). Both are rated moderately critical and should be patched immediately. 📱 LANDFALL — New Android spyware targeting Samsung devices Researchers at Unit 42 have uncovered LANDFALL, a commercial-grade Android spyware delivered via malicious DNG image files. Exploiting a zero-day in Samsung’s libimagecodec.quram.so, it enables remote code execution and access to microphones, calls, and location data. 🐧 Red Hat — 24 Linux kernel vulnerabilities patched Advisory CERTFR-2025-AVI-0978 lists 24 CVEs impacting Linux kernel versions in Red Hat Enterprise Linux 8, 9, and 10. The flaws include arbitrary code execution, data leakage, and denial of service. Fixes are available through Red Hat’s RHSA bulletins released in early November. 🏦 UK — Bank of England monitoring cyber incident at Jaguar Land Rover The Bank of England is monitoring a cyberattack that disrupted systems at Jaguar Land Rover. The breach, traced to a supplier, caused major logistical disruptions and highlights the cyber risks of industrial supply chains. 🐧 Ubuntu — 261 Linux kernel vulnerabilities fixed Advisory CERTFR-2025-AVI-0977 reports 261 CVEs affecting Ubuntu kernels from 14.04 through 25.04, including several critical ones. Patches are available via recent USN bulletins, and a full system reboot is required after applying updates. ⚡️ Don’t think — just patch! 🚀 📚 Sources: 🔗 https://thehackernews.com/2025/10/microsoft-warns-of-payroll-pirates.html?_m=3n.009a.3796.bx0ao08q8s.2u1l 🔗 https://cyberpress.org/iranian-apt-targeting-academics/ 🔗 https://www.malwarebytes.com/blog/news/2025/11/fake-captcha-sites-now-have-tutorial-videos-to-help-victims-install-malware 🔗 https://therecord.media/revised-cyber-command-master-plan-dod-pentagon 🔗 https://therecord.media/eu-parliament-committee-votes-europol-data-sharing-agreement 🔗 https://www.drupal.org/security 🔗 https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/ 🔗 https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-0978/ 🔗 https://www.theregister.com/2025/11/07/bank_of_england_says_jlrs/ 🔗 https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-0977/ 📞 Share your feedback: 📧 [e-mail] 🌐 www.radiocsirt.com 📰 radiocsirtintl.substack.com #CyberSécurité #Microsoft #APT42 #ClickFix #Pentagone #Europol #Drupal #Android #LANDFALL #RedHat #Ubuntu #RadioCSIRT 🎧🔥