It takes two: The 2025 Sophos Active Adversary Report
The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you
Similar Posts
WhatsApp Worm Targets Brazilian Banking Customers
Bys sCounter Threat Unit™ (CTU) researchers are investigating multiple incidents in an ongoing campaign targeting users of the WhatsApp messaging platform. The campaign, which started on September 29, 2025, is focused on Brazil and seeks to trick users into executing a malicious file attached to a self-spreading message received from a previously infected WhatsApp web session….
Ransomwared NHS software supplier nabs £3M discount from ICO for good behavior
Bys sConnor Jones reports the latest update on the ransomware attack affecting Advanced Computer Software: The UK’s data protection watchdog is dishing out a £3.07 million ($3.95 million) fine to Advanced Computer Software Group, whose subsidiary’s security failings led to a ransomware attack affecting NHS care. This is nearly half the fine the Information Commissioner’s Office provisionally floated…
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
Bys sAn intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode’s optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key…
TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
Bys sMicrosoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. “While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood…
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Bys sRatHat’s operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from…
Cyberattack leaves drivers with required breathalyzer test systems in 46 states unable to start vehicles
Bys sBrad Rogers reports: A cyberattack has shut down a nationwide breathalyzer test system found in vehicles of OUI offenders, impacting thousands of drivers in Maine and 45 other states. Intoxalock is the company targeted by the attack. Once the device is installed, drivers have to pass a breathalyzer test before they can start their vehicle…….