Movistar Fined €300,000 for GDPR Violation in Spain On December 22, 2025, Spain’s Data Protection Agency (AEPD) imposed a €300,000 fine on Telefónica Móviles, operating as Movistar, for violating the EU’s General Data Protection Regulation (GDPR). The penalty stems from the unlawful processing of personal data during a mobile phone line transfer, where customer information was mishandled. The AEPD ruled that Movistar failed to comply with GDPR requirements, though the company has one month to appeal the decision. The case highlights ongoing regulatory scrutiny over telecom providers’ data handling practices under EU privacy laws. Full details of the ruling are available in the attached decision (in Spanish).

Google Play Strengthens Security in 2025, Blocking Millions of Malicious Apps and Accounts In 2025, Google removed 1.75 million policy-violating Android apps from the Play Store a decline from 2.36 million in 2024 while banning 80,000 developer accounts, down from 158,000 the previous year. The company also blocked 255,000 apps from accessing excessive user data and conducted 10,000 safety checks on published apps, leveraging generative AI to enhance detection. Google’s Play Protect, now scanning 350 billion apps daily, identified 27 million malicious apps sideloaded outside the Play Store. Its expanded fraud protection covered 2.8 billion devices across 185 markets, blocking 266 million installation attempts from 872,000 high-risk apps. Additionally, Google introduced Scam Detection for phone calls on Pixel devices in 12 countries, including the U.S., U.K., and India, to combat fraudulent activity. --- Multi-Stage Phishing Campaign Bypasses Security Filters with Legitimate Infrastructure A sophisticated phishing-as-a-service (PhaaS) toolkit, dubbed Kratos, was used in an unsuccessful attack impersonating JPMorgan Chase. The campaign employed a multi-chain redirect tactic, leveraging Cisco’s infrastructure and trusted services like Nylas to evade security filters. Attackers implemented a Cloudflare-based "human validation" step to ensure only real users reached the credential-harvesting page. --- Critical Flaws in BMC FootPrints ITSM Enable Pre-Auth Remote Code Execution Four vulnerabilities (CVE-2025-71257–71260) in BMC FootPrints, a widely used IT service management (ITSM) solution, were disclosed in September 2025. The flaws could be chained to achieve pre-authentication remote code execution (RCE). The attack begins with an authentication bypass (CVE-2025-71257), extracting a guest session token to exploit an unsanitized Java deserialization sink (CVE-2025-71260). Attackers could also abuse SSRF flaws (CVE-2025-71258, CVE-2025-71259) to leak internal data. --- SnappyClient: A Stealthy C2 Framework Targeting Cryptocurrency Theft A new C++-based command-and-control (C2) framework, SnappyClient, was discovered in December 2025. Distributed via a fake Telefónica website, it employs evasion techniques like AMSI bypass, Heaven’s Gate, direct system calls, and transacted hollowing. The malware steals data from browsers, extensions, and applications, with suspected ties to HijackLoader based on code similarities. --- LiveChat Abused in Phishing Campaign to Harvest Sensitive Data A phishing campaign leveraged LiveChat’s messaging platform to trick users into entering credentials, credit card details, and MFA codes. Attackers sent refund-themed emails, redirecting victims to a LiveChat-hosted link where they engaged in real-time chat impersonating trusted brands. --- GitHub Sees Surge in Hard-Coded Secrets, Including AI Service Credentials In 2025, 28.65 million new secrets were exposed in public GitHub commits a 34% increase from 2024 and a 152% rise since 2021. AI service secrets surged by 81% year-over-year, reaching 1.28 million. Additionally, 24,088 unique secrets were found in MCP-related configuration files, including 2,117 valid credentials. --- The Gentlemen: A New RaaS Operation with Fabricated Claims A nascent Ransomware-as-a-Service (RaaS) group, The Gentlemen, emerged in mid-2025 following a payment dispute with Qilin ransomware operators. The group, consisting of ~20 members, has targeted 94 organizations but has yet to provide credible proof of successful attacks. Researchers noted fabricated data samples on their leak site. --- WhatsApp Introduces Alphanumeric Passwords to Counter SIM Swap Attacks WhatsApp began testing alphanumeric passwords (6–20 characters, with at least one letter and number) to strengthen account security. The measure aims to prevent unauthorized access even if attackers perform a SIM swap to intercept 2FA codes. --- Malicious Packagist Themes Inject Ads and Redirect Users to Gambling Sites Six trojanized Packagist packages, posing as OphimCMS themes, were found distributing malicious JavaScript disguised as jQuery libraries. The malware exfiltrates URLs, injects ads, and redirects mobile users to gambling and adult content sites operated by Funnull. --- DJI Exposes Device Data via Unauthenticated API Access A security flaw in DJI’s backend allowed attackers to access device data including 7,000 Romo smart vacuums and 3,000 portable power stations by simply providing a serial number. The issue was patched after disclosure. --- Only 1% of 2025 CVEs Were Exploited in the Wild A VulnCheck report found that just 1% of disclosed CVEs in 2025 were actively exploited, with network edge devices accounting for a third of all exploited vulnerabilities. Exploit activity by state-sponsored groups decreased by 13% compared to 2024. --- Teams Phishing Campaigns Impersonate IT Staff for Remote Access Threat actors increasingly abuse Microsoft Teams to impersonate internal IT departments, tricking users into launching Quick Assist for remote access. The goal is to deploy malware, exfiltrate data, or move laterally within networks. --- EU Extends Voluntary CSAM Detection Rules Until 2027 The European Union extended a temporary exemption allowing online platforms to voluntarily detect child sexual abuse material (CSAM) until August 2027, pending a long-term legal framework. --- Emerging Threats: AOT Malware, CursorJack, and HijackLoader’s Evolving Tactics - AOT-compiled malware evades analysis by stripping .NET metadata, forcing reliance on native-level tooling. - CursorJack abuses Model Context Protocol (MCP) deep links for arbitrary command execution. - HijackLoader now delivers an updated ACRStealer variant, spreading via pirated games from PiviGames.

Cybercriminal Dedale Targets BarcelonaTelefónica, Leaks 1M Peruvian Customer Records BarcelonaTelefónica is probing a cyberattack by the threat actor Dedale, who claims to have accessed 22 million customer records—though the breach appears limited in scope. As proof, the attacker leaked a database containing one million records, primarily affecting users in Peru. The compromised data includes multiple entries per customer (e.g., names, ID numbers, addresses), meaning the incident does not equate to 22 million unique individuals being exposed. Telefónica confirmed that Spanish customers remain unaffected, as the breach is tied to its former Peruvian subsidiary. The attack surfaced after HackManac disclosed details on X (formerly Twitter). Notably, Dedale is demanding a $1,500 ransom—a fraction of typical extortion demands—raising questions about the attacker’s motives. The breach coincides with Telefónica’s recent sale of its bankrupt Peruvian operations to Integra Tec International for €900,000, finalized last month. Investigations are ongoing.

A cybercriminal known as Rey, part of the Hellcat ransomware operation, claims to have stolen 106GB of sensitive data from Telefónica in May 2025. The stolen data includes internal communications, purchase orders, logs, customer records, and various employee data. Rey has released a 2.6GB sample and is threatening to release the full batch unless a payment is made. Telefónica has downplayed the incident, stating that the data is old and there was no new breach.

WannaCry: The Ransomware Attack That Reshaped Global Cybersecurity On May 12, 2017, the WannaCry ransomware attack exploited a critical vulnerability in Microsoft Windows’ SMBv1 protocol (CVE-2017-0144, aka EternalBlue), infecting over 200,000 systems across 150 countries within hours. The malware, derived from an NSA-developed exploit leaked by the hacker group Shadow Brokers, spread autonomously as a worm, bypassing traditional phishing methods. Key targets included healthcare systems in the UK, telecommunications networks in Spain, and organizations in the U.S., China, Russia, and beyond. Once inside a system, WannaCry encrypted files and demanded a $300 Bitcoin ransom, escalating over time to pressure victims. Its lateral movement scanning and infecting unpatched systems without user interaction made it uniquely destructive. The attack was temporarily halted when security researcher Marcus Hutchins (MalwareTech) discovered and activated a "kill switch" by registering an unregistered domain hardcoded in the malware. This accidental mitigation slowed the spread but did not eliminate the threat. Investigations later linked WannaCry to North Korea’s Lazarus Group, underscoring how state-developed cyber tools can be repurposed for criminal use. The incident exposed systemic failures, including delayed patch management Microsoft had released a fix (MS17-010) in March 2017 and poor network segmentation, which allowed the worm to propagate unchecked. WannaCry’s legacy persists in modern cybersecurity practices, emphasizing the need for timely patching, network resilience, and international collaboration. Though not the most sophisticated ransomware, its global impact demonstrated the far-reaching consequences of unaddressed vulnerabilities and the risks of stockpiled cyber weapons.