Daily Briefing for 11.25.25

Top stories.

• Real estate finance firm SitusAMC investigates breach.
• Infostealer campaign spreads via malicious Blender files.
• CISA warns of spyware targeting messaging apps.
• Dartmouth College discloses Oracle EBS breach.

Real estate finance firm SitusAMC investigates breach.

Real estate finance technology vendor SitusAMC has confirmed that it discovered a breach on November 12th that resulted in the theft of client information, the Register reports. The company said in a statement, "Corporate data associated with certain of our clients’ relationships with SitusAMC, such as accounting records and legal agreements, has been impacted. Certain data relating to some of our clients’ customers may also have been impacted. The scope, nature, and extent of such impact remain under investigation by the Company and its third-party advisors."

The New York Times cites sources as saying the company has notified JPMorgan Chase, Citi, and Morgan Stanley that their client data may have been affected. The FBI is investigating the breach.

Infostealer campaign spreads via malicious Blender files.

Morphisec has published a report on a Russia-linked malware operation targeting users of the free 3D modeling suite Blender with malicious .blend files. The threat actor distributes the files on popular marketplaces for 3D models, such as CGTrader. The files are designed to install the StealC V2 infostealer.

The researchers note, "A key feature enabling abuse is the ability to embed Python scripts in .blend file in bpy[.]data[.]texts field. Scripts like Rig_Ui[.]py generate user interfaces for character rigs (e.g., facial controls or clothing systems). When Blender’s Preferences -> File Paths -> Auto Run Python Scripts is enabled, these scripts execute automatically upon file open."

CISA warns of spyware targeting messaging apps.

The US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory yesterday warning of "multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications." The spyware is delivered via phishing, zero-click exploits, and app impersonation. CISA notes that "[w]hile current targeting remains opportunistic, evidence suggests these cyber actors focus on high-value individuals, such as current and former high-ranking government, military, and political officials, as well as civil society organizations (CSOs) and individuals across the United States, the Middle East, and Europe."

Dartmouth College discloses Oracle EBS breach.

Dartmouth College has disclosed that it was among the victims of a wave of zero-day attacks targeting Oracle E-Business Suite (EBS) instances, BleepingComputer reports. The university hasn't disclosed the total number of impacted individuals, but said in a breach notification with the Maine Attorney General's Office that just under 1,500 Maine residents were affected. The breach occurred in August 2025, and involved names and Social Security numbers. The Clop ransomware gang has posted the alleged stolen data to its leak site.

Other confirmed victims of Clop's Oracle EBS campaign include Logitech, Harvard University, the Washington Post, Envoy Air, and Mazda. John Hultquist, Chief Analyst at Google's Threat Intelligence Group, told BleepingComputer that dozens of additional organizations were likely breached.