> InfoSec News Nuggets 12/17/2025

SoundCloud Confirms Data Breach After Hackers Exfiltrate User Account Data SoundCloud disclosed that threat actors accessed an ancillary service dashboard and exfiltrated email addresses and profile information for roughly 20 percent of its users. The company says no passwords or financial data were compromised, but the attackers also launched denial of service attacks that temporarily disrupted the platform while SoundCloud brought in third‑party experts and tightened access controls.   Hacking group ‘ShinyHunters’ threatens to expose premium users of sex site Pornhub ShinyHunters claims to have stolen data on Pornhub Premium customers and is demanding a Bitcoin ransom to avoid publishing the information. Reuters was able to partially verify a sample of the leaked data with former customers, while Pornhub points to a recent incident at analytics provider Mixpanel that Mixpanel, in turn, says is unrelated, leaving the exact intrusion path and scope still unclear.   React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors Attackers are actively exploiting the critical React2Shell vulnerability, tracked as CVE‑2025‑55182 (CVSS 10), to deploy Linux backdoors such as KSwapDoor and ZnDoor. Researchers report that KSwapDoor provides stealthy remote access, lateral movement, and encrypted C2, and that multiple threat actors including several China‑nexus groups are using React2Shell to distribute diverse payloads at scale.   BlindEagle Hackers Attacking Organization to Abuse Trust and Bypass Email Security Controls The BlindEagle threat group has been observed targeting a Colombian government agency by compromising an internal email account and sending phishing messages that appear to come from inside the organization. This approach lets the attackers bypass SPF, DKIM, and DMARC, delivering lawsuit‑themed lures with malicious SVG attachments designed to trigger infection while evading common email security controls.   ‘Albiriox’ Attack Lets Hackers Control Your Android Phone And Bank Account Researchers have detailed a new Android malware family, Albiriox, which uses accessibility features to give remote attackers full control of infected devices. Believed to be backed by Russian‑speaking actors and sold as malware‑as‑a‑service, Albiriox targets banking and cryptocurrency apps for on‑device fraud, enabling attackers to conduct transactions in the user’s active session while masking activity behind a fake black screen.   DOJ Charges Former Executive in Criminal Case Alleging Cybersecurity Compliance Fraud The U.S. Department of Justice has indicted former Accenture senior manager Danielle Hillmer, alleging she misrepresented a cloud platform’s compliance with federal cybersecurity standards used by multiple government agencies. The charges, including wire fraud, major government fraud, and obstruction of a federal audit, highlight DOJ’s willingness to treat false cybersecurity compliance claims in government contracting as criminal conduct even in the absence of a confirmed data breach. The post InfoSec News Nuggets 12/17/2025 appeared first on AboutDFIR - The Definitive Compendium Project.