In today’s cybersecurity news…

CISA warns of app break-ins

CISA says state-backed hackers and cyber-mercenaries are breaking into Signal and WhatsApp accounts using spoofed apps, phishing, malicious QR codes, and zero-click exploits to hijack devices belonging to “high-value” users across the US, Europe, and the Middle East. Recent campaigns include Russia-aligned crews abusing Signal’s linked-device feature, and a WhatsApp zero-click exploit on Samsung phones, along with spyware that impersonates popular apps. (The Register)

StealC V2 spread through blender files

Morphisec researchers say Russian threat actors are spreading the StealC V2 infostealer through weaponized Blender files uploaded to 3D model sites like CGTrader. The files contain embedded Python that executes when Blender’s Auto Run feature is enabled, pulling down a PowerShell loader that installs StealC and a secondary Python stealer. The newest variant can steal data from more than 23 browsers, more than 100 crypto-wallet extensions, 15 wallet apps, and multiple messaging and VPN clients, and many samples evade antivirus detection. (Security Affairs)

Russia arrests cybersecurity entrepreneur for treason

Russian cybersecurity founder Timur Kilin has been arrested on treason charges, with Russian outlets reporting he may have drawn government attention after publicly attacking Max, the state-backed messaging app set to ship pre-installed on all Russian smartphones next year. Kilin said Max was insecure and ignored major vulnerabilities, and proposed an anti-cyberfraud law that would criminalize disclosing security flaws. (The Record)

HashJack attack fools AI browsers

Cato Networks says a new indirect prompt-injection method called “HashJack” hides malicious instructions after a “#” in legitimate URLs. AI browser assistants like Copilot in Edge, Gemini in Chrome, and Perplexity’s Comet read those hidden fragments even though they never leave the client, letting attackers turn trusted sites into vectors for data exfiltration, phishing, misinformation, or harmful guidance. Google categorized the issue as low severity and “intended behavior.” Microsoft and Perplexity applied fixes. (The Register)

Huge thanks to our episode sponsor, KnowBe4

Millions stolen in fraud schemes

The FBI says cybercriminals have stolen more than $262 million through account takeover fraud this year, with over 5,100 complaints since January. Attackers impersonate banks and payment platforms through texts, emails, calls, spoofed links, and SEO-poisoned ads, tricking victims into handing over credentials before draining accounts and moving funds to crypto wallets. Scams also use holiday-themed domains designed to trap online shoppers. (The Record)

Russian hackers target Ukrainian sister city US firm

U.S. cybersecurity firm Arctic Wolf says Russian attackers targeted a U.S. engineering firm this fall because it had worked with a municipality linked to a Ukrainian sister city. The attack was identified in September. Arctic Wolf declined to name the US firm, but said the attack was carried out by the Russia-aligned group RomCom, known for hitting organizations supporting Ukraine. (SecurityWeek)

Cyberattack disrupts emergency alert systems

The OnSolve CodeRED emergency alert platform suffered a cyberattack that disrupted notifications for U.S. state and local governments, police, and fire agencies. Crisis24, which operates CodeRED, confirmed that data on names, emails, phone numbers, and passwords was stolen. The INC Ransomware gang claimed responsibility, posting screenshots of clear-text passwords and offering the data for sale. The attack forced Crisis24 to rebuild the system from a backup from March, leaving some accounts missing. (BleepingComputer)

Corporate takeovers meet SonicWall firewalls

ReliaQuest reports that Akira ransomware affiliates exploited compromised SonicWall SSL VPN appliances in companies acquired through mergers and acquisitions. Attackers gained access to the acquiring firms’ networks via inherited devices, then searched for privileged legacy credentials, unprotected hosts, and predictable server names. Once inside, lateral movement to domain controllers took an average of 9.3 hours, and ransomware deployment averaged under an hour. (The Register)