Malware

NBC News reports that Google has filed a lawsuit seeking a temporary restraining order against Chinese-speaking cybercriminal operation Darcula, which has offered the Magic Cat software to facilitate widespread phishing scams spoofing the Internal Revenue Service and the U.S. Postal Service.

The campaign begins with emails impersonating eLibrary, a Russian scientific electronic library, using a domain registered six months prior to avoid detection.

The Askul cyberattack, attributed to the RansomHouse extortion group, forced the company to suspend nearly all online services and halt order intake and shipping operations across its ASKUL, Soloel Arena, and LOHACO platforms.

Advanced capabilities have been touted by the newly emergent Cellix Android malware-as-a-service offering, which could be integrated into any app on the Google Play Store while allegedly evading Play Protect defenses, according to BleepingComputer.

BleepingComputer reports that malicious JavaScript code has been covertly embedded in the icons of 17 Firefox extensions to facilitate browser activity tracking and backdoor deployment as part of the new GhostPoster campaign.

The attack, detected on Nov. 2, 2025, by Amazon's GuardDuty, utilizes novel persistence techniques to evade detection and hinder response efforts.

The package, named "Tracer.Fody.NLog," was published in February 2020 and remained on the repository with over 2,000 downloads.

Official Turkish government apps have been spoofed to deliver the new Frogblight Android banking trojan, which merges banking credential exfiltration and spyware capabilities, to mobile users across the country, GBHackers News reports.