- Mycomputerspot Security Newsletter
- Posts
- Market & Momentum - 12/01/2025
Market & Momentum - 12/01/2025
Crypto libraries, civic alert systems, fake Windows updates, and ICS controllers all took hits this weekend—your “edge” now includes dev tooling, SaaS, and industrial gear.
J.W. Croley
December 01, 2025
In partnership with
Introducing the first AI-native CRM
Connect your email, and you’ll instantly get a CRM with enriched customer insights and a platform that grows with your business.
With AI at the core, Attio lets you:
Prospect and route leads with research agents
Get real-time insights during customer calls
Build powerful automations for your complex workflows
Join industry leaders like Granola, Taskrabbit, Flatfile and more.
In the last 72 hours, a critical remote-DoS flaw in the Apache bRPC Framework (CVE-2025-59789) went public, registries and npm ecosystems saw fresh supply-chain contamination, there are warnings over a new Android malware-as-a-service targeting over 400 banking & payment apps, and classic patch cycles continue to pile. The margin for error shrank; defense speed and visibility matter more than ever.
Trend (macro) | Global Likelihood | Direction | Why it matters |
|---|---|---|---|
Dev crypto & supply-chain abuse (node-forge & friends) | 72% | 🔺 Rising | A critical node-forge vuln in a widely used crypto lib means a lot of apps just inherited signature/identity risk. (TechRadar) |
Public-safety / civic SaaS compromise (CodeRED-style) | 66% | 🔺 Rising | Ransomware against emergency alert SaaS shows civic and regional services are soft but high-impact targets. (Malwarebytes) |
Fake-update malware & steganography (ClickFix) | 63% | 🔺 Rising | Stego-based loaders inside fake Windows Update pages bypass user suspicion and many basic controls. (TechRadar) |
Customer-support platform phishing (Zendesk SSO clones) | 59% | 🔺 Rising | Typosquatted SSO portals + fraud tickets = a clean path to customer and support staff credentials. (IT Pro) |
ICS/OT exploitation (OpenPLC ScadaBR KEV) | 55% | 🔺 Rising | CISA only adds to KEV when exploitation is real—OT shops should assume scanning is already underway. (The Hacker News) |
node-forge crypto library vulnerability (CVE-2025-12816) – A flaw in the ASN.1 handling of node-forge can let attackers forge signatures or certificates, potentially bypassing authentication and integrity checks in Node.js web apps.
Ransomware attack and data breach at CodeRED emergency alert system – The INC Ransom group claims responsibility for an attack that disrupted CodeRED alerts and exposed emails and clear-text passwords for residents opted into the service.
“ClickFix” fake Windows Update malware using steganography – Huntress reports campaigns presenting full-screen fake Windows update prompts; payloads (LummaC2, Rhadamanthys) are hidden inside PNGs and decoded in memory via Stego Loader.
Scattered Lapsus$ Hunters phishing Zendesk customers – Over 40 typosquatted domains mimic Zendesk SSO/login pages, combined with fraudulent support tickets used to push RATs and steal credentials.
CISA adds OpenPLC ScadaBR XSS flaw (CVE-2021-26829) to KEV – XSS in OpenPLC ScadaBR is now confirmed as actively exploited in the wild, and U.S. federal agencies are under KEV deadlines to remediate.
Don't get SaaD. Get Rippling.
Software sprawl is draining your team’s time, money, and sanity. Our SaaD Audit sheet helps you analyze the true cost of “Software as a Disservice” and shows you how to get that time, money, and sanity back.
Libraries are the new perimeter: node-forge is pulled by millions of downloads a week; a single crypto lib bug can silently undermine authentication across dozens of internal apps.
Civic and “non-critical” SaaS are actually critical: The CodeRED hit shows that third-party alert platforms can cause real-world harm when taken offline or popped for credentials.
Attackers are done with obvious EXEs: ClickFix-style campaigns prove adversaries are comfortable hiding payloads in PNGs, abusing browser prompts and PowerShell instead of .exe droppers.
Support desks are a gold mine: Zendesk phishing chains combine SSO look-alikes and social engineering… If your support tooling isn’t under the same security lens as email, it should be.
OT is always in season: The OpenPLC/ScadaBR KEV entry is yet another reminder that ICS/OT vulnerabilities aren’t theoretical… They’re being used, and they bypass a lot of “classic IT” controls.
Tie actions directly to the risks above and keep them executable by your team this week:
For node-forge / dev crypto stack
Inventory where node-forge is used (direct or transitive).
Upgrade to the patched version (1.3.2 or later) in all services.
Re-issue any sensitive keys/certs where forged-signature risk would be catastrophic (SSO, high-value APIs).
For CodeRED-style civic SaaS exposure
If your org uses CodeRED or similar alert platforms, assume notification credentials are compromised.
Force password resets and enable MFA where possible.
Treat any “emergency alert” messages as potential phish until verified through a secondary channel.
For ClickFix fake Windows Update campaigns
Train users to treat full-screen “update” prompts in the browser as suspicious by default.
Disable or restrict the use of
powershell.exeand script interpreters for non-admin users where feasible.Add detections for Stego Loader-style behaviors: suspicious
curl/Invoke-WebRequest+ PNG + .NET reflectively loading code in memory.
For Zendesk / support platform phishing
Enforce SSO for all Zendesk access and bookmark official URLs. Tell users never to click login links from tickets.
Monitor for typosquatted domains that resemble your branded support URLs.
Audit API tokens and support-agent accounts for suspicious access after November 1.
For ICS/OT (OpenPLC ScadaBR)
Identify any use of OpenPLC/ScadaBR in your environment or vendor stack.
Apply vendor mitigations or isolate affected systems behind strict network segmentation and jump hosts.
Add the CVE-2021-26829 KEV entry to your “must-patch” list with an owner and due date, not a vague “track this.”
This week’s theme: stuff you didn’t think was “core” actually is!
Your crypto helper library, your emergency alert SaaS, your helpdesk, that dusty ICS web UI.
When attackers are willing to hide C2 in images, phish through support tickets, and ransom civic alert systems, the game isn’t “what’s important?” anymore. It’s “what do we actually depend on that we’ve been ignoring?”
Your perimeter is wherever someone can click, sign, or ignore a patch calendar. Secure those places first.
J.W.
(P.S. Drop this into your exec briefing pack and highlight the three items that actually apply to your stack this week!)
Your readers want great content. You want growth and revenue. beehiiv gives you both. With stunning posts, a website that actually converts, and every monetization tool already baked in, beehiiv is the all-in-one platform for builders. Get started for free, no credit card required.