The Hacker News

🛑 Two Chrome extensions were caught intercepting browser traffic and stealing credentials from 170+ sites. They pose as VPN tools, charge subscriptions, then silently proxy traffic and exfiltrate credentials in plaintext. One has been active since 2017, the other since 2023. 🔗 Details → https://thehackernews.com/2025/12/two-chrome-extensions-caught-secretly.html

Watch how Passwd handles shared passwords, API keys, and system access for Google Workspace teams. Centralized admin control with audit trails replaces informal sharing without introducing a new login layer or tool sprawl. 🔗 Learn more → https://thehackernews.com/2025/12/passwd-walkthrough-of-google-workspace.html

What happens when your security vendor is too distracted by a merger to help you fix a vulnerability? New insights from JFrog explore the risks of vendor instability in a consolidating market. Don't let your AppSec stack become a liability. Read the analysis: https://thn.news/sec-vendor-risks-x

INTERPOL led a cybercrime sweep across Africa. 574 arrests and $3M recovered after targeting BEC, extortion, and ransomware in 19 countries. Separately, a Ukrainian Nefilim ransomware affiliate pleaded guilty in the U.S. 🔗 Details from both cases → https://thehackernews.com/2025/12/interpol-arrests-574-in-africa.html

Purdue University tested deepfake detectors where they actually break: real, compressed social media video. Not clean demos. Not lab data. The benchmark shows why false-acceptance rate matters more than accuracy when camera feeds drive access and trust. 🔗 What the benchmark reveals → https://thehackernews.com/expert-insights/2025/12/purdue-universitys-real-world-deepfake.html

💪 The U.S. Justice Department seized fraud infrastructure used to steal bank logins at scale. Criminals ran fake bank ads on Google and Bing, captured credentials, and drained real accounts. $14.6M in confirmed losses so far. 🔗 Read details here → https://thehackernews.com/2025/12/us-doj-seizes-fraud-domain-behind-146.html

⚠️ ALERT — A critical RCE flaw (CVSS 9.9) was found in the n8n workflow automation platform. CVE-2025-68613 lets authenticated users execute arbitrary code, enabling full instance takeover, data access, and system-level actions. More than 103k exposed instances are observed globally. 🔗 Details → https://thehackernews.com/2025/12/critical-n8n-flaw-cvss-99-enables.html

FCC added foreign-made drones and critical components to its Covered List, blocking new U.S. approvals and imports under a national-security finding. New DJI, Autel and other foreign models won’t enter the market unless DoD or DHS approves. 🔗 Read → https://thehackernews.com/2025/12/fcc-bans-foreign-made-drones-and-key.html

Most people don’t link web browsing to energy use. But browsers run all day, loading ads, trackers, and background tasks that quietly add to infrastructure demand. Wave Browser focuses on cutting unnecessary digital load without changing how you browse. 🔗 Learn what eco-friendly browsing actually means → https://thehackernews.com/2025/12/how-to-browse-sustainably-with-a-green-browser.html

🛑 WARNING - A malicious WhatsApp API package on npm quietly hands attackers full account access. 56,000+ downloads later, “lotusbail” is intercepting every message and secretly linking attacker devices during login. 🔗 Read → https://thehackernews.com/2025/12/fake-whatsapp-api-package-on-npm-steals.html

🔥 Read this week’s The Hacker News Cybersecurity Recap for the latest exploits, attack campaigns, new tactics, and zero-days shaping the threat landscape — before they shape your defenses. https://thehackernews.com/2025/12/weekly-recap-firewall-exploits-ai-data.html

Android mobile malware campaigns are converging on the same playbook. Wonderland in Uzbekistan, plus Cellik, Frogblight, and NexusRoute elsewhere, all use fake legit apps, droppers, and phishing to steal OTPs, bank data, and accounts. This marks a shift to scalable, MaaS-style fraud, not isolated scams. 🔗 Read details here → https://thehackernews.com/2025/12/android-malware-operations-merge.html