n8n Workflow Automation Hit by Critical RCE Vulnerability (CVE-2025-68613)n8n Workflow Automation Hit by Critical RCE Vulnerability (CVE-2025-68613)
In December 2025, a critical vulnerability (CVE-2025-68613) was disclosed in the popular open-source workflow automation tool n8n, allowing unauthenticated attackers to execute arbitrary code remotely under specific conditions. The flaw, rated CVSS 9.9, was identified by security researcher Fatih Çelik and reportedly affects thousands of publicly accessible n8n instances globally. By exploiting weak access controls and improper sanitization of user input, threat actors could gain control over affected servers, leading to potential data theft, lateral movement within networks, and disruption of workflow automations.
This incident highlights the persistent risks posed by software supply chain vulnerabilities and the urgent need for organizations to monitor and remediate critical flaws in automation platforms. With workflow automation tools increasingly integrated into business operations, their exploitation represents a growing vector for both targeted and opportunistic cyberattacks.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
DoJ Takes Down Fraud Domain Powering $14.6M Account Takeover Scheme
In December 2025, the U.S. Department of Justice (DoJ), working with international partners, seized the domain web3adspanels[.]org at the heart of a large-scale bank account takeover scheme. The criminal group exploited fraudulent search ads to trick users into accessing spoofed bank login portals, harvesting credentials through malicious site components. These stolen credentials enabled attackers to infiltrate legitimate banking sites, drain victim accounts, and inflict confirmed losses of $14.6 million across 19 U.S. victims, including two companies. The backend database hosted by the seized domain contained thousands of login credentials and operated through November 2025.
This incident is part of a broader surge in credential-based financial fraud, leveraging sophisticated phishing infrastructure and real-time abuse of search advertising. With attackers refining techniques to bypass user suspicion, enforcement agencies are increasing pressure on such online infrastructure in response to rising losses and evolving digital fraud tactics.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
MongoBleed 2025: Critical MongoDB Vulnerability Exposes Data on 87K Servers
In early June 2025, the MongoBleed vulnerability (CVE-2025-14847) was actively exploited against MongoDB servers worldwide, exposing sensitive database secrets and credentials on over 87,000 publicly accessible systems. Attackers exploited a flaw present in multiple MongoDB versions, allowing unauthorized access to in-transit data and internal database secrets without authentication. The exposure occurred as a result of inadequate encryption and misconfiguration, providing an entry point for lateral movement, data exfiltration, and potentially further compromise of enterprise networks. Organizations in finance, healthcare, SaaS, and retail sectors have been especially impacted by this incident, given their widespread MongoDB adoption for critical workloads.
This breach highlights an increasingly common pattern of weaponizing newly disclosed database vulnerabilities at scale by sophisticated threat actors. The incident underscores the urgent need for robust encryption practices, Zero Trust segmentation, and vigilant patch management to protect highly sensitive data and prevent large-scale exposure as regulatory scrutiny and attacker sophistication intensify.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Active Exploitation of Fortinet SSL VPN 2FA Bypass Shows Criticality of Patch Hygiene
In December 2025, Fortinet disclosed ongoing, active exploitation of a previously known vulnerability (CVE-2020-12812) affecting FortiOS SSL VPN devices. The flaw allows attackers to bypass two-factor authentication (2FA) by manipulating the case sensitivity of usernames when certain configurations are in place, specifically when integrating local users with LDAP groups. This misconfiguration enables unauthorized access for administrative and VPN users, as attackers can skip required 2FA checks and authenticate directly via LDAP. The vulnerability, originally patched in 2020, has resurfaced due to a large number of unpatched and exposed Fortinet devices, with over 9,700 instances still vulnerable worldwide as of January 2026.
This incident exemplifies the persistent risk of legacy vulnerabilities, particularly in Internet-facing VPN and perimeter security devices. Attackers are increasingly revisiting older weaknesses to target unpatched infrastructure, elevating the urgency for ongoing patch management and configuration reviews in enterprise environments.
Low impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Critical Vulnerability in LangChain Core Exposes Secrets and Enables Prompt Injection
In December 2025, a critical vulnerability was disclosed in LangChain Core, a widely used Python package within the LangChain open-source ecosystem. Attackers were able to exploit a flaw in the serialization process, resulting in exposure of sensitive secrets and the ability to manipulate large language model (LLM) responses via prompt injection. The underlying vulnerability allowed threat actors to craft malicious payloads, leading to remote code execution in environments where untrusted input could be serialized, posing major risks to organizations relying on LangChain-powered AI workflows. This supply-chain attack path also opened the door for access to credentials and proprietary data.
This incident highlights the expanding threat landscape targeting AI infrastructure and software supply chains. With the surge of enterprise adoption of AI and LLMs, vulnerabilities in core AI frameworks are increasingly attractive to threat actors, underscoring regulatory scrutiny and the need for robust code security practices within open-source dependencies.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Critical MongoDB Flaw Exposes Sensitive Server Memory to Unauthenticated Threats
In December 2025, a critical security flaw (CVE-2025-14847) was publicly disclosed in multiple versions of MongoDB, exposing organizations to the risk of uninitialized memory disclosure by unauthenticated attackers. The flaw stems from improper handling of length parameter inconsistencies within zlib compressed protocol headers, allowing remote, unauthenticated clients to read uninitialized heap memory. Impacted versions span major MongoDB releases 3.6 through 8.2, potentially exposing sensitive data in server memory. MongoDB responded by releasing patches and advised urgent upgrades or the disabling of zlib compression.
This incident gains heightened significance as memory disclosure vulnerabilities enable threat actors to harvest sensitive information without authentication. The vulnerability underscores the increasing importance of rigorous software supply chain security and timely patch management amid a growing landscape of data exposure risks in widely used open-source technologies.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Evasive Panda APT Uses DNS Poisoning for Prolonged Espionage: 2022–2024 Campaign
Between November 2022 and November 2024, the China-linked Evasive Panda APT group conducted a sophisticated cyber espionage campaign targeting entities in Türkiye, China, and India. The attackers leveraged DNS poisoning techniques to redirect requests for popular software updates (such as SohuVA and Tencent QQ) to attacker-controlled infrastructure. Through adversary-in-the-middle attacks, victims received trojanized loaders, which proceeded to fetch and decrypt highly targeted MgBot backdoors. The attack chain involved supply chain and AitM vectors, advanced encryption and obfuscation methods, and allowed persistent compromise and broad data theft, including keylogging and credential exfiltration.
This campaign highlights the growing sophistication of APT operations exploiting core network infrastructure such as DNS to evade perimeter defenses. The increased prevalence of similar DNS-manipulation campaigns and targeted malware delivery emphasizes the urgent need for robust segmentation, encrypted traffic, and thorough network and endpoint visibility.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
2025's Stealth Loader and AI Exploit Wave: How Multi-Vector Attacks Redefined Cybersecurity
In late 2025, a coordinated wave of global cyber attacks leveraged stealthy multi-vector campaigns with commodity loaders, AI-powered exploits, and social engineering. Attackers weaponized legitimate tools like Nezha for post-exploitation, orchestrated large-scale phishing using fake updates and PoC exploits, and targeted both enterprise and consumer platforms. These campaigns saw loaders like Caminho deliver diverse malware such as XWorm, PureLogs, and RATs into manufacturing, government, and IT networks across several regions. Simultaneously, attackers abused vulnerabilities in AI assistants and exploited weaknesses in NFC-enabled Android malware, achieving persistent access, privilege escalation, data exfiltration, and lateral movement—all while skillfully blending malicious traffic with normal system behaviors.
This incident highlights a sharp evolution in attack methods as threat actors increasingly favor low-noise, blended tradecraft over traditional smash-and-grab approaches. With the convergence of signature evasion, AI system manipulation, and commodity loader sharing, defenders must shift toward integrated, threat-aware security architectures. These incidents mark a critical inflection point, signaling a persistent rise in invisible, multi-layered threats fueled by automation and attacker collaboration.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Typosquatted MAS Domain Delivers PowerShell Malware in 2024 Attack
In early 2024, cybersecurity researchers identified a campaign leveraging a typosquatted domain mimicking the legitimate Microsoft Activation Scripts (MAS) tool to distribute the 'Cosmali Loader' malware. Unsuspecting users seeking MAS utilities were tricked into downloading malicious PowerShell scripts, which silently loaded the Cosmali Loader onto Windows machines. The loader subsequently enabled additional payload delivery, providing attackers with persistent access and the ability to deploy further malware or conduct post-infection activities. The incident demonstrates the ongoing risks of social engineering via typosquatting and open-source tool impersonation, with users and organizations inadvertently compromising their systems.
This campaign is particularly relevant as it highlights the resurgence of supply chain threats and the increasing sophistication of threat actors leveraging typosquatted domains to bypass conventional defenses. The incident signals a growing trend targeting both individual users and enterprise environments through deceptive domains and script-based malware.
Low impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Evasive Panda: APT Delivers MgBot via DNS Poisoning in Asia (2022–2024)
Between November 2022 and November 2024, the Evasive Panda APT group executed a sophisticated campaign targeting victims primarily in Türkiye, China, and India. Leveraging adversary-in-the-middle (AitM) techniques and DNS poisoning, the attackers delivered a unique MgBot malware implant through fake software updates and stealthy loaders. The operation employed hybrid encryption, memory injection in signed executables, and evaded traditional defenses to maintain long-term persistence. Multiple new and legacy C2 infrastructures enabled sustained access while attackers tailored payloads based on the victim’s OS.
This incident showcases the ongoing evolution of nation-state threat actors, utilizing advanced evasion, supply chain impersonation, and DNS manipulation to bypass security controls. It reflects a broader surge in attacks exploiting trust in software supply chains and underlines the need for continuously adaptive security strategies as actor sophistication grows.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Nomani Scam Exposes AI Deepfake Threats to Social Media in 2025
In 2025, the Nomani investment scam surged by 62%, leveraging sophisticated AI-based deepfake advertisements across major social media platforms including Facebook and YouTube. The scheme utilized convincing fake endorsements and manipulated video content to lure unsuspecting individuals into fraudulent investment schemes. Security firm ESET recorded over 64,000 unique URLs distributing the fraudulent campaign, indicating an expansion both in scale and reach. The attackers exploited trust in familiar faces, rapidly spreading the scam and leading to substantial financial losses and reputational risks for victims and targeted brands.
This incident highlights the growing threat of AI-enabled social engineering, with deepfakes enabling unprecedented scale and believability. As identity manipulation technologies proliferate, organizations and regulators face increased pressure to combat fraud, educate users, and adapt security controls to counter the evolving landscape of digital deception.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
How Phantom Shuttle Chrome Extensions Undermined Enterprise Security with Man-in-the-Middle Attacks
In December 2025, cybersecurity researchers discovered two versions of a Google Chrome extension named 'Phantom Shuttle' that secretly intercepted network traffic and stole user credentials from over 170 targeted domains. Masquerading as a legitimate VPN and speed test tool, these browser add-ons leveraged proxy permissions and malicious JavaScript code to inject authentication credentials and enable man-in-the-middle attacks. Users paid for subscriptions believing they were purchasing a secure service, while in reality, their web traffic, including passwords, authentication cookies, credit card information, API keys, and browsing histories, was exfiltrated continuously to a threat actor-controlled command-and-control server. The operation leveraged a subscription model and payment integrations via Alipay and WeChat, while traffic was routed through threat actor proxies managed via PAC scripts.
This incident highlights a growing trend of browser extension abuse, with attackers monetizing malicious add-ons under the guise of productivity or security tools. With enterprise users increasingly utilizing browser extensions for business workflows, unmanaged browser risk is rapidly becoming a critical threat to organizational data security and compliance.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
