Cyber Briefing: 2025.12.18
SantaStealer malware, China-linked espionage, AWS IAM abuse, major SSN breaches, mass password leaks, and state cyber interference dominated.
👉 What’s trending in cybersecurity today?
Welcome to Cyber Briefing, the newsletter that informs you about the latest cybersecurity advisories, alerts, incidents and news every weekday.
First time seeing this? Please Subscribe
🚨 Cyber Alerts
1. New SantaStealer Malware Targets Data
SantaStealer is a recently identified malware-as-a-service information stealer that is being marketed on Telegram and hacking forums as an undetectable, memory-resident threat. Despite being advertised as a high-end tool for data theft, security researchers have determined it is a rebranding of an older project and currently lacks the sophisticated evasion techniques its developer claims.
2. China Group Hacks Governments With Malware
The threat actor known as Jewelbug or Ink Dragon has expanded its cyber espionage operations to target European government entities while maintaining its presence in Southeast Asia and South America. Active since 2023, the group utilizes a sophisticated mix of custom backdoors and legitimate system tools to conduct stealthy, long-term intrusions across global telecommunications and government sectors.
3. Stolen IAM Drives AWS Crypto Mining
A sophisticated cyber attack is targeting AWS users by exploiting stolen IAM credentials to deploy high-scale cryptocurrency mining operations across ECS and EC2 services. The campaign is notable for its speed and evasion tactics, as attackers use dry-run commands to verify permissions and create massive clusters that can scale to hundreds of instances within minutes.
For more alerts click here!
💥 Cyber Incidents
4. LKQ Breach Exposes 9,070 SSNs
LKQ Corporation recently reported a cybersecurity breach involving a ransomware attack that compromised the personal information of over 9,000 individuals across the United States. The incident originated from a zero-day vulnerability in Oracle software and led to the exposure of sensitive data including Social Security numbers and Employer Identification Numbers.
5. 20 Million Hit By Prosper Data Breach
A recent security breach at the San Francisco fintech firm Prosper Marketplace has compromised the personal data of approximately 13.1 million individuals. While the company stated that customer funds and accounts remain secure, the stolen information includes highly sensitive details such as Social Security numbers, bank account data, and government-issued identification.
6. Jaguar Land Rover Payroll Data Stolen
Hackers recently targeted Jaguar Land Rover in a cyber attack that resulted in the theft of sensitive payroll and personal data belonging to current and former employees. The breach, considered the most expensive in UK history, forced the company to halt production for weeks and has prompted warnings of potential identity fraud for those affected.
For more incidents click here!
📢 Cyber News
7. UK Pushes iPhone Age Verification
The UK government is reportedly planning to ask Apple and Google to implement device-level age verification to block explicit images on smartphones. This initiative builds on existing adult website restrictions and forms a key part of the Online Safety Act’s strategy to reduce violence against women and children.
8. FBI Confirms 630 Million Stolen Passwords
The FBI recently uncovered a database containing 630 million compromised passwords following the seizure of devices from a single hacker. This discovery comes alongside reports of significant security failures at LastPass and a confirmed no-password attack targeting Google accounts.
9. France Probes Foreign Interference On Ferry
French counterespionage officials are investigating a Latvian crew member following a suspected cyberattack plot against an international passenger ferry docked in Sete. Authorities believe the vessel’s systems were compromised with remote access software, a move Interior Minister Laurent Nunez suggested is part of a pattern of interference from a specific foreign power.
For more news click here!
📈Cyber Stocks
On Thursday, 18th December, cybersecurity stocks broadly traded lower as broader market volatility and sector rotation weighed on defensive tech names. Despite ongoing enterprise demand for cloud, identity and perimeter security, profit-taking and macro caution limited upside across most pure-play cybersecurity equities.
Palo Alto Networks closed at 183.44 dollars and declined as broader tech weakness outweighed continued confidence in its AI-driven platform strategy and enterprise security demand.
Fortinet closed at 79.38 dollars and fell sharply, pressured in part by broader tech sell-offs and ongoing concerns about near-term product cycles despite steady interest in zero-trust and network-security solutions.
Zscaler closed at 226.43 dollars and dipped notably, reflecting sector-wide profit-taking even as its cloud-delivered security and zero-trust offerings remain key enablers of enterprise security transformation.
Check Point Software Technologies closed at 187.34 dollars and moved lower, with mixed sentiment in defensive names tempering gains even though demand for firewall and perimeter defenses remains elevated.
Okta closed at 88.42 dollars and eased, as identity-security spending held up but broader market pressure and rotation kept the stock from extending recent strength.
💡 Cyber Tip
🎅 New SantaStealer Malware Targets User Data
SantaStealer is a newly promoted malware-as-a-service stealer being sold on Telegram and hacking forums. Marketed as an undetectable, memory-only threat, it is actually a rebranded version of an older stealer and currently lacks the advanced evasion features claimed by its developer. Despite this, it can still steal sensitive user data and is easily accessible to low-skill attackers through a paid subscription model.
🔐 What You Should Do
Use reputable endpoint security with behavior-based detection
Monitor for unusual credential access or data exfiltration activity
Avoid downloading software or files from untrusted sources
Educate users about info-stealers spread via cracked software and phishing
Keep systems and browsers fully updated
⚠️ Why This Matters
Even poorly built malware can cause serious damage when it is cheap and widely available. Tools like SantaStealer lower the barrier to entry for cybercrime, increasing the volume of credential theft and account compromise attempts.
📚 Cyber Book
Cybersecurity Career Manual by Winston Knowles
That concludes today’s briefing. You can check the top headlines here!
Copyright © 2025CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium
Solid briefing format. The AWS IAM credential abuse case is particularly nasty becuase of how fast attackers can spin up those ECS clusters once they have keys. The dry-run tactic to verify permissions before going all-in shows real sophistication. I've been tracking similar patterns where threat actors test environemnts methodically before deploying payloads at scale, and honestly the speed here is alarming.