Android Trojan Is Typing Like You

From: Cybersecurity Insider Newsletter

Date: October 31, 2025

Oct 31, 2025

Read in Browser

The cyber underground’s been busy, Digital Defenders.

Old flaws are rising from the grave, AI’s learning new tricks, and malware’s getting eerily human.

From stealthy Windows hijacks to reanimated Magento exploits, this week’s threats prove one thing: what’s old isn’t gone. It’s just waiting to strike again.

Here’s what you need to know:

Zero-Day Download

Trusted Windows Feature Abused for Stealthy DLL Attacks

TrustedSec researchers have uncovered a persistence technique that revives a decade-old Windows flaw.

A DLL hijack in Windows Narrator (affecting Windows 10 and 11) allows attackers with local admin rights to gain stealthy SYSTEM-level persistence and lateral movement — even across RDP — because Narrator can launch before user logon.

Trusted Windows Feature Abused for Stealthy DLL Attacks

Source: Simon Rayl/Unsplash

The researchers have not reported the attack being used in the wild.

Enforce least privilege, restrict and monitor write access to critical DLL and registry paths, apply allowlisting, harden remote administration, and deploy host-level detection for injection or thread-suspension activity.

SessionReaper Strikes: Old Magento Bug Fuels New Attacks

Akamai researchers have confirmed active exploitation of a critical Adobe Commerce (formerly Magento) vulnerability known as SessionReaper.

Tracked as CVE-2025-54236, the flaw lets attackers hijack sessions and run remote code. Within days of the PoC’s release, 300+ attacks targeted 130+ hosts, enabling web shell implants for full server takeover and data theft.

Adobe has already released a patch for the vulnerability.

Patch, harden servers, restrict admin access, monitor for web shells, and maintain layered defenses with WAFs and regular scans.

BlueNoroff Wields AI to Target Global Executives

Researchers at Kaspersky uncovered new details about BlueNoroff, a Lazarus Group offshoot that uses AI-driven GhostCall and GhostHire attacks.

Active since April 2025, these campaigns target crypto, blockchain, and tech professionals worldwide. GhostCall uses fake video meetings and GhostHire involves fake recruiters.

Both campaigns are still active in the wild.

Verify unsolicited contacts, use secure communication tools, limit admin access, deploy EDR, keep systems patched, and train employees to spot social engineering attempts.

Share this newsletter!

Pulse Check

How ready is your team for relic exploits?

🛡️ We’re ahead — We track legacy CVEs and patch/mitigate proactively.

🔧 Patch-driven — We patch when vendors push fixes, gaps exist.

⏳ Reactive — We only respond after adversaries exploit it in the wild.

Yesterday's Pulse Check Results

AI Oversight Reality Check: Who’s really watching your robots?

Security Tools You Can Use

Don’t wait for trouble… find, fix, and patch faster with leading vulnerability tools.
Stay one step ahead with top cybersecurity tools that stop breaches before they start.
Level up your skills with the 2025 Cybersecurity Mastermind Bundle — 86% off Red Team and bug bounty training.

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Herodotus Trojan Tricks Banks by Typing Like You

ThreatFabric researchers discovered Herodotus, an Android banking Trojan that mimics human behavior to evade anti-fraud and biometric defenses.

Unlike typical malware, Herodotus types with human-like pauses to mimic real users, enabling convincing fraud while stealing credentials, intercepting 2FA codes, and taking remote control.

Herodotus Trojan Tricks Banks by Typing Like You

Source: Giphy

The malware is active in Italy and Brazil and blends behavioral mimicry with MaaS distribution, signaling a new wave of mobile threats that defeat behavior-based fraud detection.

Use MDM and EDR tools, monitor behavior and device telemetry, secure apps, educate users on safe practices, track threat intelligence, and adopt adaptive authentication for stronger mobile defense.

Privilege Escalation Bug Hits Ubuntu Kernel

A critical Ubuntu kernel vulnerability exposes version 24.04.2 (kernel 6.8.0-60) to full privilege escalation.

Incomplete patching in af_unix.c and garbage.c created a use-after-free flaw that was exploited for root access. Such kernel bugs are severe, letting attackers bypass isolation, steal data, and disable security controls with minimal patch gaps.

Ubuntu has already released a patch for the vulnerability.

Patch immediately, enable Secure Boot and lockdown mode, restrict kernel access, monitor for anomalies, and enforce AppArmor or SELinux for containment.

FROM OUR PARTNERS:

Is your AI security ready for 2026?

AI vulnerabilities are multiplying, and defenses are struggling to keep up. 2026 will demand bold, proactive strategies. Are your systems ready? Join Uncharted: The AI Safety & Security Summit for exclusive insights, proven tactics and actionable plans to safeguard your organization. Don’t wait until it’s too late.

Security Tip of the Day

When Was the Last Time You Hardened Your Linux Systems?

As Linux drives enterprise servers, cloud workloads, and containers, it’s a prime target for misconfigurations and unpatched flaws — making hardening essential to protect against privilege escalation, lateral movement, and data theft.

Source: Gabriel Heinzer/Unsplash

How to harden your Linux systems against attacks:

Access and authentication: Enforce least privilege, use strong authentication methods, and disable unnecessary accounts or services to minimize entry points for attackers.
Secure configurations and patching: Regularly update systems, apply security patches, follow hardened configuration baselines to reduce exposure to known vulnerabilities, and automate where you can to reduce misconfigurations.
Continuously monitor: Implement comprehensive logging, network and system monitoring, and intrusion detection to quickly identify and respond to suspicious activity.

Consistent Linux hardening strengthens cyber resilience against both automated and targeted attacks by tightening access, maintaining visibility, and keeping systems up to date.

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.