Cyber Briefing: 2025.12.19
Fake Play Store malware, Fortinet auth bypasses, China-linked espionage, ferry cyber probes, AI startup leaks, health data breaches, crypto seizures, and zero-days dominated.
👉 What’s trending in cybersecurity today?
Welcome to Cyber Briefing, the newsletter that informs you about the latest cybersecurity advisories, alerts, incidents and news every weekday.
First time seeing this? Please Subscribe
🚨 Cyber Alerts
1. Cellik Android Malware Fakes Play Apps
A new Android malware service called Cellik has emerged on cybercrime forums, allowing attackers to create malicious versions of legitimate Google Play Store apps that retain their original look and functionality. Security researchers discovered the tool being sold for a subscription fee, noting its ability to embed payloads within trusted software to potentially bypass standard security detections.
2. Hackers Exploit Fortinet Auth Bypass
Cybersecurity attackers are currently exploiting two critical-severity vulnerabilities in Fortinet products to bypass authentication and gain administrative control. By leveraging flaws in how these systems verify login signatures, hackers are stealing sensitive configuration files that could facilitate more extensive network intrusions.
3. China Group Abuses Windows Policy
A newly identified China-linked cyber espionage group known as LongNosedGoblin has been launching targeted attacks against government organizations in Japan and Southeast Asia since late 2023. These operations leverage Windows Group Policy for malware distribution and utilize popular cloud storage services like OneDrive and Google Drive to manage stolen data and issue commands.
For more alerts click here!
💥 Cyber Incidents
4. GNV Ferry Cyberattack Hijack Probe
French prosecutors have launched an investigation into a suspected cyberattack targeting the GNV ferry Fantastic following reports of a potential attempt to compromise the vessel’s IT systems. Authorities are currently examining whether the incident involved an effort by foreign agents to gain unauthorized access or interfere with the ship’s navigation equipment.
5. Hacker Exposes AI Influencer Startup
Doublespeed, an AI startup backed by Andreessen Horowitz, has reportedly suffered a massive backend breach that reveals how the company uses phone farms to manage hundreds of automated social media accounts. Data leaked by the hacker shows these AI-generated personas are being used to flood TikTok with undisclosed advertisements and promotional content in violation of platform rules and federal regulations.
6. Virginia Mental Health Data Breach
The Richmond Behavioral Health Authority recently reported a ransomware attack that compromised the personal data of over 113,000 individuals. Although the agency found no direct evidence of data misuse, they confirmed that sensitive information including Social Security numbers and health records may have been accessed.
For more incidents click here!
📢 Cyber News
7. US Seizes E Note Crypto Exchange
Authorities have dismantled the E-Note cryptocurrency exchange and confiscated its domains after linking the platform to the laundering of over $70 million for cybercriminals. The operation, which involved seizing servers and transaction records, targeted a network used to wash funds stolen through ransomware and account takeover schemes.
8. Zeroday Cloud Awards Big Bug Bounty
The Zeroday Cloud hacking competition in London concluded with researchers earning $320,000 for uncovering critical remote code execution vulnerabilities within essential cloud infrastructure. Hosted by Wiz Research alongside major providers like AWS, Microsoft, and Google, the event highlighted significant security gaps by successfully demonstrating eleven previously unknown zero-day exploits.
9. Exein Raises 100 Million Euros
Exein, an Italian IoT security specialist, has secured 100 million euros in new funding led by Blue Cloud Ventures to drive its global expansion and product development. This latest investment brings the firm’s total capital raised in 2025 to 170 million euros as it aims to scale its embedded firmware protection across international markets.
For more news click here!
📈Cyber Stocks
On Friday, 19th December, cybersecurity stocks showed modest strength as defensive demand for cloud, identity and perimeter security helped support the sector amid broader market volatility. Continued enterprise focus on AI-driven threat detection, zero-trust architectures and compliance spending provided underlying support, even as profit-taking appeared in parts of the broader tech space.
Palo Alto Networks closed at 185.88 dollars and moved higher, reflecting steady confidence in its unified AI-driven security platform and resilient enterprise demand.
Fortinet closed at 79.75 dollars and inched up, supported by ongoing interest in zero-trust and network-security solutions even as broader market caution limited upside.
Zscaler closed at 231.09 dollars and posted a solid gain, buoyed by continued enterprise adoption of cloud-delivered security and zero-trust protections.
Check Point Software Technologies closed at 188.00 dollars and edged higher, with steady demand for perimeter and firewall defenses helping anchor the stock amid mixed market sentiment.
Okta closed at 90.23 dollars and moved higher, buoyed by sustained enterprise investment in identity and access management as organisations prioritise defence against identity-centric threats.
💡 Cyber Tip
📱 Cellik Android Malware Fakes Trusted Apps
A new malware service called Cellik allows attackers to clone legitimate Google Play apps and quietly embed malicious code while keeping the app’s normal look and functionality. Once installed, the trojanized app can stream the screen, steal files and notifications, hijack browser sessions, and overlay fake login screens on banking and social apps.
🔐 What You Should Do
Install apps only from the official Play Store and avoid sideloaded APKs
Be cautious of app updates or installs coming from links or third party sites
Review app permissions regularly and revoke anything excessive
Watch for signs like unusual data usage or battery drain
Keep Play Protect enabled and your device fully updated
⚠️ Why This Matters
By hiding inside trusted apps, malware like Cellik can stay active for long periods without raising suspicion. This makes credential theft and account takeovers far harder to detect, even for security aware users.
📚 Cyber Book
Cybersecurity for Beginners Made Easy By Raiden Tekk
That concludes today’s briefing. You can check the top headlines here!
Copyright © 2025CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium