FTC orders crypto company to pay
The Federal Trade Commission (FTC) says crypto bridge operator Nomad must repay users for funds lost in a 2022 breach that drained roughly USD 186 million. According to the FTC, the company pushed inadequately tested code that introduced a critical vulnerability, despite marketing the platform as “security-first,” leaving customers out nearly USD 100 million after partial recoveries. Under a proposed settlement, Nomad would be required to repay about USD 37.5 million, implement a comprehensive security program, and stop misrepresenting the security of its products.
New exploit of React2Shell
A ransomware gang has been observed exploiting the critical React2Shell vulnerability (CVE-2025-55182) to gain initial access and deploy ransomware in under a minute, a quick pivot from the espionage and crypto-mining activity reported when the flaw first emerged. According to researchers, attackers used the bug to remotely execute JavaScript on a vulnerable React Server Components endpoint before dropping the Weaxor ransomware strain. The attackers quickly disabled Windows Defender, deployed Cobalt Strike for command-and-control, encrypted files, wiped shadow copies, and cleared logs, all without moving laterally. Researchers also warn that patching alone isn’t enough
Ukraine-based fraud ring taken down
European law enforcement has dismantled a network of fraudulent call centers operating out of Ukraine that scammed hundreds of victims out of more than USD 11.7 million. According to Eurojust, the group posed as police officers and bank employees, pressuring victims into transferring funds to so-called “safe” accounts or installing remote-access software to take over their banking apps. Authorities believe roughly 100 people were involved and the true financial impact is likely far higher than currently known.
French interior ministry confirms breach
France’s Interior Ministry is investigating a cyber intrusion that gave an attacker access to several internal email accounts and dozens of confidential files, including records tied to judicial cases and wanted individuals. According to the ministry, the intruder remained in the network for several days, though officials say no ransom demand was made and there’s no indication the breach put lives at risk.
Huge thanks to our sponsor, Adaptive Security
Malicious Firefox extensions hit malware in plain sight
Researchers at Koi Security uncovered a malicious Firefox campaign dubbed GhostPoster, where malware was hidden inside the browser extensions logo images. The extensions, posing as VPNs, ad blockers, translation tools, and weather apps, were installed more than 50,000 times and quietly deployed a delayed, multi-stage payload that tracked users, stripped browser security protections, enabled remote code execution, hijacked affiliate links, and injected tracking code. Mozilla has since removed the affected add-ons from its marketplace.
Microsoft update breaks MSMQ
Microsoft’s December 2025 security update is breaking Message Queuing (MSMQ) on older Windows 10 and Server systems. Queues fail, apps can’t write messages, and IIS throws misleading “insufficient resources” errors, all thanks to stricter folder permissions. Uninstalling the update can fix it, but at the cost of losing security patches.
ISACA takes over CMMC credentialing
The US Department of Defense has appointed ISACA as the exclusive organization to train, certify, and credential professionals under the Cybersecurity Maturity Model Certification (CMMC) program. Starting now, all DoD contractors handling sensitive data must meet CMMC standards, with a full rollout expected by 2028. Over 200,000 organizations (including European suppliers) will need certification, as ISACA takes over from The Cyber AB.
Privacy concerns surround Meta AI
Privacy experts are warning about a new Meta policy that uses AI chat interactions to tailor ads. The change, rolled out Tuesday, automatically affects users of Meta AI across Facebook, Instagram, WhatsApp, and Messenger—there’s no opt-out. What’s this got to do with cybersecurity? Well, AI chats often include sensitive personal information—health, religion, finances, mental health—and feeding that into ad targeting could expose users to profiling, scams, or other exploitation. Even if Meta filters some topics, “proxy signals” could still reveal private details.