Monthly Cyber Threats Report - December 2025

Editor's note

Our monthly report prepares cybersecurity practitioners to make better tactical, operational and strategic decisions. We have distilled analysis of key events from the previous month which have learning points that can be actioned to improve security.

News

abstract glowing texture on dark background

From clipboard to compromise: Steganographic techniques observed in ClickFix campaign

Attackers are using convincing fake Windows Update screens to trick people into running commands that install passwordstealing malware. The tactic, known as "ClickFix", is a common initial access method, and turns simple social engineering into a multistage, filelight infection chain.

3 mins

News

Sturnus Trojan targets Android users

A new Android malware has emerged, targeting mobile users in Southern and Central Europe. The malware - named "Sturnus "after the Sturnus Vulgaris bird’s rapid and irregular chatter - employs highly sophisticated communication techniques, using a mix of encryption methods to keep its activity hidden when communicating with its command-and-control server, quietly exfiltrating sensitive information from compromised devices.

3 mins

News

ToddyCat targets Outlook email archives and Microsoft 365 access tokens

The ToddyCat advanced persistent threat (APT) group has expanded its operations to focus directly on corporate email data. Active since at least 2020, the group has previously targeted government and technology organisations across Europe and Asia.

3 mins

Subscribe

Never miss a publication by signing up to our mailing list

Monthly Cyber Threats Report - December 2025

From clipboard to compromise: Steganographic techniques observed in ClickFix campaign

Sturnus Trojan targets Android users

ToddyCat targets Outlook email archives and Microsoft 365 access tokens