> InfoSec News Nuggets 11/24/2025

Another major airline hacked, customer data exposed Iberia is notifying customers after a supplier breach exposed names, email addresses, and loyalty card IDs, while a separate threat actor claims to be selling 77 GB of Iberia internal data, including technical aircraft and maintenance files. This is a live example of third party compromise plus possible deeper internal intrusion, so DFIR teams should watch for Iberia related phishing, loyalty account abuse, and any overlap with their own travel data or shared vendors.   Cybercriminals Use EtherHiding to Spread Malware and Constantly Shift Payloads Researchers describe a campaign that hides malware payloads in Binance Smart Chain smart contracts, pulled via injected JavaScript on compromised sites and wrapped in fake CAPTCHA prompts that trick users into running commands on Windows and macOS. This blockchain hosted delivery model makes takedown and URL based blocking harder, and the article includes concrete web and endpoint indicators DFIR and detection teams can use to hunt for EtherHiding style activity.    Aerodrome DEX Hit by DNS Hijack, Users Steered to Phishing Sites on Base Aerodrome Finance reports that its centralized domains were hijacked at the DNS level, redirecting users to phishing sites while on chain smart contracts and funds remained intact. For defenders this is a textbook front end compromise where infrastructure, DNS, and browser side telemetry matter more than smart contract monitoring, and it highlights the need for rapid comms, domain integrity checks, and approval revocation guidance when dealing with Web3 incidents.   Google: Hackers Steal 200 Company Data Stored Salesforce Google’s threat intelligence team says a hacking group stole Salesforce hosted data for more than 200 companies by abusing the Gainsight integration, expanding the known blast radius of the earlier Salesforce/Gainsight incident. This reinforces that SaaS to SaaS supply chain links are a material risk surface; DFIR teams should confirm whether their org used the affected apps, review OAuth and app logs, and treat CRM data as in scope when scoping this campaign.    Major US Banking Vendor SitusAMC Confirms Data Breach Real estate finance vendor SitusAMC confirms a cyberattack that exposed corporate data and mortgage related customer information for major US banks including JPMorgan Chase, Citi, and Morgan Stanley; the FBI is investigating. This is a significant upstream vendor breach touching mortgage portfolios, so bank side DFIR and SOC teams need to factor this supplier into third party risk assessments, look for attacker reuse of stolen data, and coordinate with legal and fraud on possible downstream abuse.   Scattered Spider alleged members deny TfL charges Two British teenagers alleged to be members of the Scattered Spider group have pleaded not guilty to Computer Misuse Act charges tied to the 2024 cyberattack on Transport for London, while also facing related US indictments for dozens of intrusions and more than 100 million dollars in ransom payments. The case shows that law enforcement is willing to pursue prolific intrusion and extortion crews across borders, and DFIR teams may see evidence requests or legal holds tied to these campaigns as prosecutions move forward.  The post InfoSec News Nuggets 11/24/2025 appeared first on AboutDFIR - The Definitive Compendium Project.