SEO spam is getting smarter and louder. AkiraBot launched a massive campaign targeting over hundreds of thousands of websites since last year. Researchers spotted RemoteMonologue - a new attack technique that abuses Windows’ DCOM to trigger NTLM authentication remotely, enabling lateral movement without ever dropping a payload on disk. It didn’t take long. Within hours of going public, a high-severity flaw in the OttoKit WordPress plugin was under active attack. Read on for more.
01
A new spam campaign by AkiraBot has targeted over 400,000 websites, successfully leaving spam content on 80,000 of them, primarily promoting suspicious SEO services like Akira and ServiceWrap.
02
A new lateral movement and credential access technique, RemoteMonologue, has been discovered, which manipulates Windows’ Distributed Component Object Model to coerce remote NTLM authentications without dropping any payload.
03
A WordPress site was compromised by a malicious script that created a fake credit card form, which stole users' credit card data and sent it to a suspicious domain, italicfonts[.]org.
04
The Pakistan-linked SideCopy APT group expanded its targeting beyond traditional sectors, now focusing on critical national infrastructure such as railway, oil & gas, and external affairs ministries in India.
05
Threat actors are using fake websites to deliver SpyNote, an Android malware known for harvesting sensitive data, with the bogus sites disguised as Google Play Store install pages for popular apps.
06
A high-severity vulnerability (CVE-2025-3102) in the OttoKit plugin for WordPress has been actively exploited within hours of its public disclosure.
07
The threat actor Sapphire Werewolf updated its Amethyst stealer with advanced features, including checks for virtualized environments and the use of the Triple DES algorithm for string encryption.
08
Multiple ICS devices from Rockwell Automation, Hitachi Energy, and Inaba Denki Sangyo have critical vulnerabilities with severity ratings up to 9.9 on the CVSS base score.
09
Microsoft has released an urgent patch, KB5002623, for Office 2016 to fix a critical issue causing applications like Word, Excel, and Outlook to crash.
10
The Cyber Security Breaches Survey 2025 revealed that 43% of U.K businesses and 30% of charities experienced a breach or cyberattack in the past year, with phishing remaining the top threat.
