In today’s cybersecurity news…

FCC to torch rules from Salt Typhoon

The FCC is set to vote on scrapping former cybersecurity rules imposed after the 2024 Salt Typhoon attacks, which required telecoms to implement basic security controls like MFA, role-based access, and patching. The FCC, under the current administration, argues the rules were legally overreaching and ineffective, favoring a collaborative, voluntary approach with industry and federal agencies instead. Salt Typhoon, a China-linked cyberespionage campaign, compromised U.S. government, telecom, and university networks, affecting sensitive data from millions globally. (The Register)

Group claims hits on Danish party websites

Pro-Russian group NoName057(16) briefly knocked several Danish political party sites offline with DDoS attacks ahead of local elections, but officials said voting was unaffected since ballots are counted by hand. Targets included the Conservatives, Moderates, Social Democrats, Red-Green Alliance and The Copenhagen Post. Danish authorities reported a broader spike in nuisance-style DDoS attacks from Russian-aligned groups in the week before the vote, mirroring similar activity seen during elections in Moldova, Poland and Romania. (The Record)

MI5 warns Chinese spies are using LinkedIn

Britain’s domestic intelligence service issued a warning that Chinese operatives are trying to “recruit and cultivate” U.K. lawmakers and policy influencers through LinkedIn, headhunters and front companies tied to China’s Ministry of State Security. The alert names two suspected recruiters and says economists, think-tank staff and government officials have also been approached. It comes as the U.K. faces criticism over a collapsed spying case involving two men accused of aiding China, and follows earlier warnings about Chinese political interference, cyberespionage and theft of tech secrets. (SecurityWeek)

Teams users can report messages wrongly flagged as threats

Microsoft is adding a new option in Teams that lets users report messages that were incorrectly flagged as malicious. The feature, first introduced in September, is rolling out globally by the end of November and will be enabled by default for organizations using Microsoft Defender for Office 365 Plan 2 or Defender XDR. Users on desktop, mobile, and web will be able to flag false positives, and admins can manage the setting in the Teams admin center. It arrives alongside other recent safety updates, including malicious link alerts and screen-capture blocking. (BleepingComputer)

Huge thanks to our episode sponsor, KnowBe4

Npm packages abuse Adspect in crypto scam

Socket researchers found seven malicious npm packages using Adspect cloaking to filter victims from security researchers before redirecting users to crypto-themed scam sites. The packages, uploaded by a threat actor called “dino_reborn,” collect detailed device and browser fingerprints, send them through a proxy to Adspect, and decide whether to show a fake CAPTCHA that leads to a malicious crypto site or a decoy page meant to fool analysts. All packages have been removed from npm, but researchers warn this cloaking-plus–open-source distribution method will likely reappear under new names. (Dark Reading)

Sneaky 2FA phishing kit adds BitB pop-ups

The Sneaky 2FA Phishing-as-a-Service kit now uses Browser-in-the-Browser (BitB) pop-ups to mimic Microsoft login pages, tricking victims into giving credentials and session data. The attacks employ bot protection, conditional loading, and obfuscation to evade detection. Researchers also warn that phishing-resistant methods like passkeys can be bypassed via malicious browser extensions or downgrade attacks. Push Security emphasizes that identity-based attacks remain the leading cause of breaches and urges users and organizations to exercise caution and enforce conditional access policies to prevent account takeovers. (The Hacker News)

Google Chrome bug exploited as a 0-day

Google issued emergency patches for two high-severity Chrome zero-days in the V8 JavaScript engine, a type confusion flaw, actively being exploited in the wild. Both can allow arbitrary code execution and potential full system compromise. The first was discovered by Clément Lecigne of Google TAG, and the second by Google’s Big Sleep tool. Users are urged to update immediately to prevent exploitation. These are the seventh and eighth Chrome zero-days patched in 2025. (The Register)

Pajemploi reports data breach

Pajemploi, France’s social security service for parents and home-based childcare workers, says a breach discovered on November 14th may have exposed data on more than 1.2 million people. The stolen information could include names, birthplaces, postal addresses, social security numbers, banking institutions, and internal Pajemploi identifiers, though no IBANs, emails, phone numbers, or passwords were accessed. Pajemploi warns affected individuals to watch for targeted phishing attempts. (BleepingComputer)