Malware

The Askul cyberattack, attributed to the RansomHouse extortion group, forced the company to suspend nearly all online services and halt order intake and shipping operations across its ASKUL, Soloel Arena, and LOHACO platforms.

Advanced capabilities have been touted by the newly emergent Cellix Android malware-as-a-service offering, which could be integrated into any app on the Google Play Store while allegedly evading Play Protect defenses, according to BleepingComputer.

BleepingComputer reports that malicious JavaScript code has been covertly embedded in the icons of 17 Firefox extensions to facilitate browser activity tracking and backdoor deployment as part of the new GhostPoster campaign.

The attack, detected on Nov. 2, 2025, by Amazon's GuardDuty, utilizes novel persistence techniques to evade detection and hinder response efforts.

The package, named "Tracer.Fody.NLog," was published in February 2020 and remained on the repository with over 2,000 downloads.

Official Turkish government apps have been spoofed to deliver the new Frogblight Android banking trojan, which merges banking credential exfiltration and spyware capabilities, to mobile users across the country, GBHackers News reports.

The campaign, active since November 2025, targets Chinese-speaking users, including those in Western companies operating in China.

Cybersecurity researcher Saurabh identified suspicious code within the React2shell-scanner script, revealing a hidden payload designed to execute mshta.exe and download a secondary malware stage from py-installer.cc.