- Mycomputerspot Security Newsletter
- Posts
- Market & Momentum - 11/10/2025
Market & Momentum - 11/10/2025
Samsung phones exploited zero-click, Cisco firewalls under a new attack variant, and VSCode marketplace hosts ransomware-style extension. Fast patching and code-supply control are essential this week.
J.W. Croley
November 10, 2025
In partnership with
Will A Book Grow Your Business?
No one buys a beach house from selling a book. They buy the beach house from the opportunities the book gets them.
Author.Inc helps experts, executives, and entrepreneurs turn expertise into world‑class books that build revenue, reputation, and reach.
Their team—behind projects with Tim Ferriss and Codie Sanchez—cuts through uncertainty to show whether your book can realistically hit those targets.
Schedule a complimentary 15‑minute call with Author.Inc’s co‑founder to quantify potential ROI from your offers, speaking engagements, royalties, and more.
This isn’t writing advice. It’s a strategic consultation to decide whether now is the right time to put pen to paper.
If it’s a go, they’ll show you how to write and publish it at a world-class level. If it’s a wait, you just avoided wasting time and money.
In the last 72 hours, researchers revealed that Samsung Galaxy devices were hit by a zero-click exploit delivering the LANDFALL spyware (CVE-2025-21042), Cisco flagged a new overload/DoS attack variant against unpatched firewalls, and a malicious Visual Studio Code extension slipped into the marketplace carrying file-encrypting behavior. The risk horizon is drifting from legacy servers to edge devices, developer tooling, and trusted code channels.
Trend (macro) | Likelihood | Direction | Commentary |
|---|---|---|---|
Mobile zero-click spyware on flagship devices | 69% | 🔺 Rising | Samsung patch revealed active threat (LANDFALL) on Galaxy hardware—mobile is now a frontline. (turn0search4) |
Network/firewall overload & exploit variants (Cisco gear) | 63% | 🔺 Rising | Cisco reports new attacks targeting unpatched firewalls, increasing edge-risk. |
Developer-tool ecosystem abuse (code extensions/VSCode) | 58% | 🔺 Rising | Malicious extension appearing in marketplace with ransomware style behavior signals supply-chain risk. |
Credential reuse/phishing from leaked PII datasets | 52% | ➡ Stable | While not new, shifting toolsets and mobile targets keep this trend persistent. |
Patch-management overload and missed change events | 47% | 🔺 Rising | Multiple high-priority advisories across platforms raise odds of scheduling/segmentation errors. |
Samsung Galaxy zero-click exploit (CVE-2025-21042) — Deployed via malformed DNG image files delivered through messaging platforms, enabling “no user interaction” spyware installation (LANDFALL).
Cisco detects new attack variant targeting firewalls — Unpatched Cisco devices subject to overload/DoS under variant named “ARCANEDOOR”; mitigation urgency flagged.
VSCode extension hides ransomware-style behavior — Extension named “Suspicious publisher” entered Microsoft Marketplace with file encryption and data theft capabilities; developer ecosystem under fire.
Cyber press: LG-style malware campaign reveals code-supply chain gap — Analysis shows the LANDFALL chain exploited image-processing library on Android—growth of supply-chain risk beyond binaries.
CVE-2025-41244 on VMware Tools/Aria — Privilege elevation zero-day in VMware ecosystem added to weekly bulletin; highlights enterprise admin tool exposure.
Free email without sacrificing your privacy
Gmail tracks you. Proton doesn’t. Get private email that puts your data — and your privacy — first.
Mobile device = new perimeter: Zero-click spyware on flagship devices shows enterprise mobility must be treated like servers.
Edge network gear under renewed stress: Firewalls and appliances are being targeted for overload or bypass rather than pure RCE—indicates availability weaponization.
Developer tooling & marketplace abuse: Malicious extensions show that trusted platforms (VSCode, npm, etc.) are fertile ground for attackers.
Supply-chain risk now multi-platform: From mobile libraries to code extensions, attacker vectors are expanding across trust chains.
Ops/patch burden intensifies: With three high-stakes attack surfaces (mobile, network, tooling) requiring rapid remediation, scheduling fatigue becomes a risk.
Mobile fleet (Samsung): Require immediate patch to cover CVE-2025-21042; enforce device-profile lockdown on Galaxy models; enable IMEI/UDID monitoring for “silent” install events.
Network/Firewall appliances (Cisco): Audit all firewall devices for latest firmware; disable unused services; apply mitigation steps for ARCANEDOOR variant; schedule emergency maintenance window.
Developer toolchains (VSCode): Scan all org-approved extensions; remove “Suspicious publisher” ecosystem entries; enforce internal policy for extension validation and marketplace vetting.
Code-supply chain hygiene: Rotate tokens, verify manifests, implement hash-pinning and Yara rules for “malicious VSX/VSCode” style patterns.
Patch/change management triage: Use the forecast percentages to schedule highest-risk assets first; log and monitor deferred patches with acceptance documentation.
When zero-click attacks hit mobile, firewalls get variant DoS attacks, and dev-tool ecosystems allow ransomware-style code, all in the same week, it clarifies where defenders must act fastest.
Use the signal density.
Trust nothing by default… patch everything that matters most first.
J.W.
(P.S. Forward to your CISO / Add to Board Briefing!)
Will A Book Grow Your Business?
No one buys a beach house from book sales—they buy it from what the book makes possible.
Author.Inc helps founders turn ideas into world-class books that build revenue, reputation, and reach.
Book a free 15-minute ROI call to see if your book is a go—or a smart wait.