GPS Is Vulnerable to Jamming—here’s How We Might Fix It

,

GPS is susceptible to jamming, as evidenced by a recent incident involving a Widerøe Airlines flight in Norway during Russian military exercises causing navigation failures. The frequency of GPS disruptions has risen globally, impacting various sectors, including emergency services and agriculture. Agencies like the Department of Defense and the FAA are seeking alternatives and enhancements to GPS, investing in modernization efforts totaling billions. Innovations include higher frequency signals and alternative positioning systems to reduce vulnerability to interference. While improvements are in progress, the reliance on GPS remains a challenge due to its ubiquity and free access.

https://arstechnica.com/information-technology/2025/12/gps-is-vulnerable-to-jamming-heres-how-we-might-fix-it/

27 Malicious Npm Packages Used as Phishing Infrastructure to Steal Login Credentials

, , ,

27 malicious npm packages were discovered in a phishing campaign targeting U.S. and allied organizations, primarily in sales and commercial sectors. The campaign utilized these packages to host phishing infrastructure, mimicking document-sharing portals and Microsoft sign-in pages, to steal login credentials from their targets. Attackers embedded client-side scripts to avoid detection and included checks to filter out bots. Notably, the campaign hard-coded specific email addresses of individuals in targeted firms, raising concerns about the source of this information. To mitigate risks, strong dependency verification, logging unusual CDN requests, enforcing phishing-resistant multi-factor authentication, and monitoring for suspicious activities are recommended.

https://thehackernews.com/2025/12/27-malicious-npm-packages-used-as.html

What We Covered on Cyber Security Headlines in 2025

2025 Cyber Security Headlines Summary:
Key coverage included:
1. AI/ML Security: Dominated with 25% of stories; significant rise in AI threats and incidents.
2. Vulnerabilities/Exploits: Ongoing focus on CVEs and third-party security failures.
3. Malware: Persistent evolution in types of malware; notable waves of attacks.
4. Data Breaches: Frequent occurrences on varying scales highlighted ongoing risks.
5. APT/Nation-State: Increased aggressiveness and diversity in nation-state cyber activities.
6. Ransomware: Remained significant but stabilized in growth; more selective coverage.

Trends included the rising importance of AI security, tangible impacts of cyberattacks on public services, and intensifying geopolitical tensions affecting cybersecurity. Predictions for 2026 suggest continuation of these trends.

https://cisoseries.com/what-we-covered-on-cyber-security-headlines-in-2025/

Threat Actor Landscape: What Every CISO Must Know to Stay Ahead

,

CISO advice: use threat intelligence for tailored cybersecurity. Actors use targeted tactics based on industry, requiring defenses to adapt. Key sectors face unique threats, necessitating a robust intelligence program that informs strategies, detects risks, and trains teams effectively. Regular updates to executives ensure alignment with evolving threats.

https://www.techradar.com/pro/threat-actor-landscape-what-every-ciso-must-know-to-stay-ahead

How the Human Harms of Cybercrime Shook the World in 2025

Cyberattacks in 2025 caused severe human harm, including the first confirmed ransomware-related death linked to a healthcare disruption, and unsettling incidents of personal data exploitation, such as the leaking of preschoolers’ information. Major corporate attacks, like on Jaguar Land Rover, had significant economic repercussions while spreading fear among employees. Violence associated with cybercrime surged, evidenced by kidnapping and threats during negotiations, raising concerns about future trends. Additionally, advanced scams like AI-powered virtual kidnappings evolved alongside disruptions to emergency alert systems, highlighting the profound impact of cybercrime on society.

https://www.theregister.com/2025/12/28/death_torture_and_amputation_how/

State-linked and Criminal Hackers Use Device Code Phishing Against M365 Users

, ,

State-linked hackers exploit device code phishing to target Microsoft 365 users, using techniques that impersonate legitimate access workflows. Groups from Russia and China lead recent attacks, employing tools like SquarePhish2 and Graphish phishing kits. This method involves users entering a device code, granting hackers access to their accounts. Cybersecurity firm Proofpoint notes the increased use of this tactic for attacks on various sectors, including government and education.

https://www.cybersecuritydive.com/news/state-linked-criminal-hackers-device-code-phishing-m365/808396/

Pen Testers Accused of ‘blackmail’ Over Eurostar AI Flaws

, ,

Pen testers identified four significant flaws in Eurostar’s AI chatbot, allowing potential injection of malicious HTML and system prompts leakage. After initial reports were ignored, the team accused the company’s security head of “blackmail” for following up. Eurostar later found the report and addressed some issues. The chatbot’s poor design permits users to manipulate chat history and bypass security checks, leading to risks like data leaks and phishing attacks. The incident highlights the need for robust security in consumer-facing chatbots.

https://www.theregister.com/2025/12/24/pentesters_reported_eurostar_chatbot_flaws/

Interpol-led Action Decrypts 6 Ransomware Strains, Arrests Hundreds

Operation Sentinel, led by Interpol, arrested 574 individuals and recovered $3 million tied to cybercrimes across 19 countries, deactivating over 6,000 malicious links and decrypting six ransomware strains. The initiative highlights increasing cyber threats, with significant cases in Senegal, Ghana, Benin, and Cameroon reflecting joint international law enforcement efforts.

https://www.bleepingcomputer.com/news/security/interpol-led-action-decrypts-6-ransomware-strains-arrests-hundreds/

NIST Warns of NTP Inaccuracy After Blackouts Across Colorado

NIST faced issues with NTP servers after a power outage in Boulder caused atomic clock drift. A staffer contemplated shutting down servers to prevent spreading incorrect time, but a generator failure complicated efforts. Despite the outage, NIST maintained operations using backup power, reporting minimal time deviation. Users dependent on Boulder’s time were advised to use alternate sources. By December 21, services were restored, showing stability with only slight clock errors, emphasizing the importance of using multiple time sources.

https://www.theregister.com/2025/12/21/nist_ntp_outage_warning/

Robot Crime Could Be Rampant by 2035, Law Enforcement Warns

,

Europol warns of potential rampant robot crime by 2035 due to automation, predicting protests, riots, and hacking of AI-powered robots. The report highlights threats like drones used for attacks, urging police to prepare for criminal actions involving both humans and robots. While acknowledging some scenarios may be exaggerated, the warning illustrates the growing concerns about technology replacing humans in various sectors, leading to societal unrest.

https://www.vice.com/en/article/robot-crime-could-be-rampant-by-2035-law-enforcement-warns/

Meet the Team That Investigates When Journalists and Activists Get Hacked With Government Spyware

Access Now’s Digital Security Helpline investigates government spyware hacks targeting journalists and activists. Staffed by experts from Costa Rica, Manila, and Tunisia, it assists victims by assessing potential spyware infections and offering support. The helpline has seen a surge in cases, now handling about 1,000 per year, driven by increased awareness and the proliferation of spyware. Collaborating with organizations like CiviCERT, they aim to empower civil society in navigating cybersecurity threats.

https://techcrunch.com/2025/12/27/meet-the-team-that-investigates-when-journalists-and-activists-get-hacked-with-government-spyware/

Trust Wallet Confirms Extension Hack Led to $7 Million Crypto Theft

, ,

Trust Wallet’s Chrome extension was hacked on December 24, leading to $7 million in stolen cryptocurrency. Users reported wallet drain incidents post-update. Trust Wallet confirmed the issue and released a security patch (version 2.69) to resolve it, advising users to update immediately. A phishing campaign targeting affected users also emerged, prompting Trust Wallet to warn about compromised domains. Users should refrain from using version 2.68 and secure their funds by moving them to new wallets.

https://www.bleepingcomputer.com/news/security/trust-wallet-confirms-extension-hack-led-to-7-million-crypto-theft/

Meet the Man Hunting the Spies in Your Smartphone

Ronald Deibert, founder of the Citizen Lab, has worked for over two decades to uncover digital threats and abuses of power. Based at the University of Toronto, the lab is unique for its independence from government and corporate interests, focusing on public interest investigations into cyberthreats. Deibert warns that democracy, particularly in the U.S., is under threat, noting a rise in authoritarian practices. Despite risks to himself and his team, the lab’s work continues to influence global human rights and cybersecurity discussions, including laying groundwork for sanctions against spyware vendors. Deibert emphasizes the importance of their mission, especially as similar research faces challenges in the U.S.

https://www.technologyreview.com/2025/12/24/1129294/ronald-deibert-citizen-lab-digital-threats-spies-cybersecurity/

Scroll to Top