Dartmouth College has disclosed a data breach tied to the Clop extortion group, who claim to have taken data from the school’s Oracle EBS servers through a zero-day. At least 1,494 people were directly impacted, with investigations ongoing. #CyberSecurity #DataBreach #Clop #OracleEBS #ThreatIntel

Code-beautifier tools were found leaking 80k+ JSON pastes containing credentials, keys, tokens, and PII through a public “Recent Links” feature. Automated scanners even hit expired uploads... #CyberSecurity #AppSec #DataExposure #Infosec #CloudSecurity #TechNadu #ThreatIntel

A new study finds that aircraft cabin IoT exposes more information inside the network than in transit. Authorized devices can read full sensor details, revealing vendor IP or passenger patterns... #CyberSecurity #IoTPrivacy #AviationTech #AircraftSystems #InfoSec #TechNadu

Microsoft closes the loophole where phishing meeting invites stayed on calendars even after the email was deleted. Hard Delete now removes both, and domain-level blocking simplifies phishing cleanup. #CyberSecurity #Microsoft365 #PhishingDefense #InfoSec

AI agent ecosystems are expanding fast - but so are the blind spots. We spoke with Britive CEO Artyom Poghosyan about: • Agent-to-agent trust risks • Insider misuse of autonomous agents • How attackers hit the weakest plugin or service account #Cybersecurity #AIsecurity #IdentitySecurity

RomCom is now using SocGholish to deliver its Mythic Agent payload - a first-of-its-kind overlap between the two. Targets include U.S. organizations supporting Ukraine. Researchers link the activity to GRU Unit 29155. #CyberSecurity #RomCom #SocGholish #ThreatIntel #InfoSec

WormGPT 4 - a malicious AI tool marketed for cybercrime - is now available for as little as $50. Unit 42 shows it can generate ransomware scripts, phishing messages, and malicious code without restrictions. #CyberSecurity #AIThreats #WormGPT #InfoSec

ASUS has issued a fix for a high-severity MyASUS privilege escalation flaw (CVE-2025-59373) that allowed SYSTEM-level access with minimal requirements. Updates are now rolling out through Windows Update. #CyberSecurity #ASUS #InfoSec #WindowsSecurity

Tor is rolling out a major encryption update: Counter Galois Onion (CGO). • Replaces aging tor1 scheme • Stronger defenses against tagging attacks • 16-byte authenticator for better integrity • Keys evolve per cell for improved forward secrecy • Tag chaining prevents recovery of altered traffic...

Russian cybersecurity entrepreneur Timur Kilin has been arrested on treason charges after criticizing the state-backed Max app and opposing a proposed law criminalizing security flaw disclosure. Follow TechNadu for more cybersecurity reporting. #CyberSecurity #Russia #TimurKilin #Infosec #TechNews

FBI + Darktrace + Fortinet warn of rising Account Takeover fraud and holiday-season phishing campaigns. • 5,100+ ATO complaints • Losses > $262M • 620% jump in Black Friday phishing • Fake Amazon/Walmart/Macy’s pages • 18k+ malicious holiday domains • Stealer logs + cloned retail sites spreading...

Attackers are using realistic fake “Windows Update” screens to trigger ClickFix infections - leading to in-memory loaders, PNG-encoded shellcode, and infostealers like Lumma and Rhadamanthys. Which early warning signs should users learn first? #Cybersecurity #ClickFix #WindowsSecurity #ThreatIntel

Helping kids stay safe online starts with protecting their devices - automatic updates, unique passwords, safer home networks, and well-set parental controls. What would you add to this list? #CyberSafety #KidsOnline #DeviceSecurity #DigitalParenting #CyberAwareness #ParentalControls

Harvard confirmed a data breach after a phone-based phishing attack targeting systems tied to alumni and donor engagement. Contact info and event records were exposed, though no financial data or passwords were stored there. #CyberSecurity #InfoSec #Vishing #DataBreach #ThreatAwareness

A UK parliamentary report calls for software liability, stronger incentives for cyber resilience, and mandatory reporting of cyber incidents. The committee says the current system places the burden of insecurity on users and the broader economy. #CyberSecurity #InfoSec #TechPolicy

A young Russian cybersecurity entrepreneur has been arrested on treason charges amid reports he criticized the state-backed Max messaging app and new anti-cybercrime policies. While details remain sealed, the case raises broader questions about the boundaries of research and public critique.

Canon confirmed a subsidiary breach tied to the Cl0p Oracle EBS exploit campaign, which has affected 100+ organizations. Impact was limited to one web server, with no leaked data so far. Follow TechNadu for more cybersecurity updates. #Canon #Cl0p #OracleEBS #CyberSecurity #Infosec #ThreatIntel

A new red-team wiper modeled after Sandworm GRU Unit 74455 demonstrates 121 MITRE ATT&CK techniques using only native Windows tools. Follow TechNadu for more cyber threat insights. #Sandworm #GRU74455 #CyberSecurity #RedTeam #BlueTeam #Infosec

Certain Android TV boxes - including Superbox - may be joining users’ networks to botnets through intrusive third-party apps, DNS hijacking & proxy abuse. Follow TechNadu for more cybersecurity insights. #AndroidTV #IoTSecurity #CyberSecurity #Botnet #Infosec #TechNews

FCC fines Comcast $1.5M after the 2024 FBCS vendor breach exposed data from more than 237K customers. Settlement requires enhanced vendor-risk controls and stronger cybersecurity practices. Follow us for more updates. #Comcast #FCC #DataBreach #CyberSecurity #Infosec #Privacy #VendorRisk

AstrillVPN rolls out a major Black Friday 2025 offer: 27 months for $199 (40%+ savings). Includes 350+ servers, AES-256 encryption, advanced protocols & strong privacy tools. Follow us for more cyber updates. #AstrillVPN #CyberSecurity #VPN #BlackFriday2025 #OnlinePrivacy #Infosec

Surfshark introduces Multi IP + upgraded Rotating IP, giving users stronger anonymity with automatic and per-session IP changes. Built on the Nexus network for stability + privacy. Follow us for more cyber insights. #Surfshark #CyberSecurity #OnlinePrivacy #VPN #Infosec #TechNews

GTG-1002 shows the shift to autonomous cyber operations — 80–90% of the attack was run by an AI agent at machine speed. • Zero exploit window • Recon → exploit → exfiltration in seconds • Detect-and-respond models can’t keep up #CyberSecurity #InsiderThreat #ThreatIntel #DataSecurity #DataProtection

Holiday phishing scams surge as 1,728+ malicious domains impersonate luxury brands and holiday deals. • Fake Dolce & Gabbana & Pandora storefronts • Black Friday keyword abuse • Crypto “seasonal token” scams • DGAs + bulk domain registrations • .com & .shop heavily used

Microsoft is officially phasing out WINS after Windows Server 2025, with support running until Nov 2034. Admins are encouraged to start migrating to DNS and review any remaining NetBIOS/WINS dependencies. #WindowsServer #DNS #Networking #CyberSecurity #TechNews #Infrastructure #Microsoft

CrowdStrike confirms an Insider Threat, not a breach, after internal screenshots appeared on Telegram. • Employee terminated • Scattered Lapsus$ Hunters claims denied • No system compromise reported • Gainsight/ShinyHunters link rejected Follow TechNadu for more cybersecurity reports.

Roblox and Twitch are tightening youth-safety controls amid new global policies. Roblox is rolling out optional facial-scan and ID-based age verification via Persona and will restrict cross-age communication across six groups. #CyberSecurity #OnlineSafety #TechPolicy #DigitalSafety #Privacy

ShadowPad malware is being deployed via active exploitation of CVE-2025-59287 in WSUS. Attackers gain system access, use PowerCat for shells, and install ShadowPad through certutil/curl with DLL side-loading using legitimate binaries. #cybersecurity #malware #infosec #techsecurity #sysadmin

The UAE Cybersecurity Council says 79% of travellers may be vulnerable to data theft at unsafe public charging points. Compromised stations can silently install malware or access personal info using auto-enabled transfer protocols. #cybersecurity #travelsecurity #UAE #datatheft #infosec #malware

A cyberattack on SitusAMC may have exposed data linked to JPMorgan Chase, Citi, and Morgan Stanley. No encrypting malware involved; FBI confirms no operational disruptions. #CyberSecurity #DataBreach #SupplyChainSecurity #SitusAMC #BankingSecurity

Veracode’s CISO Sohail Iqbal breaks down how attackers compromise CI/CD pipelines and why third-party dependencies remain the toughest threats to contain. #CyberSecurity #AppSec #Veracode #ThreatDetection #SupplyChainSecurity #CICD

Two local law enforcement agencies - in Oklahoma and Massachusetts - faced cyber incidents this week that disrupted internal networks, phones, and email systems. Emergency services remain fully operational, and IT teams are working with federal partners on recovery. #cybersecurity #publicsafety

AI moves fast - but humans must steer. David Brumley of Bugcrowd outlines why guardrails, testing, and human oversight are essential in AI-powered AppSec and vulnerability discovery. #AI #CyberSecurity #Bugcrowd #AppSec

Grafana issued patches for CVE-2025-41115, a CVSS 10.0 SCIM flaw allowing impersonation or privilege escalation when certain SCIM settings were enabled. The issue stems from numeric externalId values potentially conflicting with internal user IDs. Updated builds are now available. #TechNews #Infosec

CISA added a critical Oracle Identity Manager flaw (CVE-2025-61757) to the Known Exploited list after detecting active scanning and attempted attacks. The issue stems from an authentication bypass that can lead to remote code execution using simple URL modifiers like ? #CyberSecurity #Oracle #CISA

When a caller says you’re linked to crimes and an “agent” warns you to stay off the internet, that’s a major scam pattern. These scammers isolate you, create panic, and pressure immediate action. Your safest move? Pause, verify, and talk to someone you trust. #CyberSafety #OnlineSecurity

The FCC has voted to reverse a telecom security rulemaking tied to the Salt Typhoon intrusions. Backers say the earlier mandate overreached; critics believe the rollback may reduce safeguards for lawful intercept systems. #Cybersecurity #FCC #Telecom #Infosec #CriticalInfrastructure #DigitalSafety

A hacker claims to have stolen and leaked 2.3TB of data tied to Almaviva, the IT provider for Italy’s FS Italiane Group. Analysts say the material looks recent and includes technical docs, HR archives, and internal repositories. #Cybersecurity #Infosec #DataBreach #Italy #ThreatIntel

Michigan’s HB 4938 could unintentionally affect VPN use, raising concerns for remote workers across essential industries. Experts say the bill’s broad language around tools that “conceal online activity” may cause major operational issues. #VPN #RemoteWork #Cybersecurity #TechPolicy #Infosec

X has begun testing a feature that detects when users are browsing through a VPN or proxy - raising new privacy and safety concerns. The company says it's meant to reduce troll activity, but experts warn it could endanger users who rely on VPNs in restrictive regions. #VPN #Privacy #Cybersecurity

A new oversight report finds the FBI doesn’t buy real-time location data - but does use historical datasets from brokers like Babel Street, alongside open-source info. #Cybersecurity #Privacy #FBI #DataBrokers #InfosecNews

The SEC has dropped its lawsuit against SolarWinds and its CISO, following a judge’s earlier dismissal of most claims. SolarWinds says the outcome backs their position and may bring reassurance to CISOs concerned about disclosure expectations #Cybersecurity #CyberAwareness #RiskManagement #TechNews

Two people accused in the TfL cyber incident have now entered not-guilty pleas. The NCA and international partners say the investigation includes additional incidents affecting U.S. healthcare organizations. #Cybersecurity #DigitalSafety #Cybercrime #Infosec #TechNews #UKLaw #CyberAwareness

This Week in Cyber: privacy battles, outages, ransomware claims & policy shifts. • Samsung AppCloud concerns • French medical software outage • India rolls out DPDP privacy rules • Everest ransomware claims Under Armour breach • Cloudflare outage • SEC drops SolarWinds case #Cloudflare #SalesForce

Fairplay is warning families to be careful with AI toys, pointing to privacy issues, data collection, and the risk of young children trusting AI companions too deeply. Some toys were even suspended after giving unsafe advice. Do AI toys help kids learn, or introduce risks too early? #AI #ChildSafety

Mozilla will officially end its partnership with Onerep next month, closing out the Monitor Plus data-removal service. What’s changing: • Service ends Dec 17, 2025 • Prorated refunds issued • Firefox Monitor’s free breach alerts remain #Privacy #Mozilla #Firefox #Cybersecurity #DigitalSafety

Cloud ransomware is evolving fast - with attackers now abusing AWS-native encryption (SSE-C, KMS, imported key material) to lock victims out of their own S3 data. Experts highlight: • Misconfigured buckets + leaked IAM keys keep enabling entry • Trend Micro maps 5 distinct S3 ransomware variants...

A Colorado man has been sentenced to 10 years in federal prison for participating in an encrypted online group involved in CSAM activity. Investigators recovered thousands of files and secured a plea deal earlier this year. The case falls under Project Safe Childhood.

GTIG reports a 3-year APT24 cyberespionage operation targeting Taiwan with the BADAUDIO loader. • DLL hijacking + heavy obfuscation • Supply chain compromise of a marketing firm (1,000+ domains) • Secondary payload: Cobalt Strike Beacon #SupplyChainAttack #Taiwan #CobaltStrike #Malware #ThreatIntel

Cl0p ransomware claims a breach impacting Canon and Mazda, possibly linked to an Oracle E-Business Suite zero-day. Verification is still underway, but the case reflects ongoing risks to global manufacturing and supply chain operations. #CyberSecurity #Ransomware #ManufacturingSecurity #SupplyChain