> InfoSec News Nuggets 12/16/2025

Fake Government Portals Used in New Android Malware Campaign to Steal SMS and Device Data Researchers describe a new Android banking trojan named Frogblight that targets users in Turkey by disguising itself as official government apps and later as a generic Chrome browser app. The malware abuses legitimate government portals as intermediaries to steal banking credentials and requests broad permissions, including access to SMS, storage, and device information.   U.S. fintech and data services firm 700Credit suffered a data breach impacting at least 5.6 million people 700Credit disclosed that threat actors accessed personal data collected via auto and related dealerships, exposing names, addresses, dates of birth, and Social Security numbers for at least 5.6 million individuals. The company says the incident was limited to the application layer, has notified federal agencies and regulators, and is offering credit monitoring while continuing to investigate.   SafePay Ransomware Attack on InTTrust S.A The SafePay ransomware group has claimed responsibility for an attack on InTTrust S.A, a Greek IT consulting firm, and posted an extortion notice threatening to leak data if the company does not engage in negotiations. The report summarizes key incident details, including the target, timeline, and attacker statement, and frames the case within broader trends in ransomware targeting service providers.   China’s Cybersecurity Incident Reporting Measures Come into Effect A new set of Cybersecurity Incident Reporting Measures issued by China’s Cyberspace Administration took effect on 1 November 2025, creating a more structured framework for how network operators and critical information infrastructure operators classify and report incidents. The rules refine risk levels, timelines, and content of incident reports and are presented as clarifying and standardizing requirements that sit on top of existing cybersecurity and data protection laws.   What AWS Security learned from responding to recent npm supply chain threat campaigns AWS describes its response to recent npm supply chain campaigns, including one that involved 150,000 compromised packages and a newer “elf” wave of nearly 1,000 suspicious packages engineered to steal system data and credentials. The post highlights how automated detections, quick reporting to the OpenSSF malicious package registry, and iterative incident response helped limit impact and offers recommendations for organizations that rely on public package registries.   Venezuela’s PDVSA suffers cyberattack, tankers make u-turns amid tensions with US Venezuela’s state oil company PDVSA disclosed it was hit by a ransomware cyberattack that disrupted its administrative systems, leading to suspended oil cargo deliveries and forcing staff to keep manual records, even as officials publicly stated operations were unaffected. The government blamed foreign interests, particularly the United States, for the incident, which comes amid a broader standoff over oil exports, tanker seizures, and regional military tensions. The post InfoSec News Nuggets 12/16/2025 appeared first on AboutDFIR - The Definitive Compendium Project.