November Roundup of Trending News in Cybersecurity

Read more cybersecurity news in this edition of NetSec News.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

ShadyPanda turns popular browser extensions with 4.3 million installs into spyware

A threat actor known as ShadyPanda has been linked to a seven-year-long browser extension campaign that has amassed over 4.3 million installations over time. Five of these extensions started off as legitimate programs before malicious changes were introduced in mid-2024, according to a report from a security company, attracting 300,000 installs. These extensions have since been taken down. (The Hacker News)

“The ShadyPanda campaign proves that even ‘verified’ browser extensions with millions of installs can silently become spyware. Organizations must lock down corporate devices with MDM and strict ExtensionSettings policies that allow only pre-approved extensions and block everything else.” –Roman Weathermon, CTI Lead at C3 Integrated Solutions

Account takeover fraud caused $262 million in losses in 2025: FBI

Cybercriminals engaging in account takeover (ATO) fraud schemes have caused over $262 million in losses since January 2025, the FBI reports. (SecurityWeek)

Fortinet confirms silent patch for FortiWeb zero-day exploited in attacks

Fortinet has confirmed that it has silently patched a critical zero-day vulnerability in its FortiWeb web application firewall, which is now “massively exploited in the wild.” (BleepingComputer)

WormGPT 4 and KawaiiGPT: new dark LLMs boost cybercrime automation

Malicious LLMs make it easier for less-skilled threat actors to conduct attacks, and cybersecurity researchers have analyzed two recently launched tools: WormGPT 4 and KawaiiGPT. (SecurityWeek)

Google issues security fix for actively exploited Chrome V8 zero-day vulnerability

Google in November released security updates for its Chrome browser to address two security flaws, including one that has come under active exploitation in the wild. The vulnerability in question is CVE-2025-13223 (CVSS score: 8.8), a type confusion vulnerability in the V8 JavaScript and WebAssembly engine that could be exploited to achieve arbitrary code execution or program crashes. (The Hacker News)