Week of November 24, 2025: Gainsight-Salesforce breach widens, CISA flags spyware and OpenPLC flaw

Security leaders spent the week of November 24, 2025 tracking the fallout from the Gainsight-Salesforce compromise and a run of CISA advisories covering a mobile spyware campaign, industrial control systems, and a newly exploited OpenPLC flaw. Hiring news at Mozilla and the City of San Antonio, plus fresh research on exposed developer secrets and a prompt-injection technique against AI browsers, rounded out a week heavy on supply-chain and advisory activity.

CISA publishes seven industrial control systems advisories

CISA released seven Industrial Control Systems advisories on November 25, 2025, covering products from Ashlar-Vellum, Rockwell Automation, Zenitel, Opto 22, Festo, SiRcom, and an updated Mitsubishi Electric FA engineering software advisory. The advisories detailed current security issues, vulnerabilities, and exploits affecting ICS environments used across manufacturing and critical infrastructure settings. CISA encouraged users and administrators to review the advisories for technical details and mitigations applicable to their deployed systems. (CISA)

CISA warns of commercial spyware targeting messaging app users

CISA issued an alert on November 24, 2025 describing multiple cyber threat actors actively using commercial spyware to compromise users of mobile messaging applications. The agency detailed tactics including phishing with malicious device-linking QR codes, zero-click exploits, and impersonation of platforms such as Signal and WhatsApp. Targeting was described as opportunistic but focused on high-ranking government, military, and political figures as well as civil society organizations across the United States, Middle East, and Europe. (CISA)

Salesforce details attack window in widening Gainsight breach

Salesforce released indicators of compromise for the Gainsight-linked breach on November 26, 2025, showing initial reconnaissance and unauthorized access began November 8, with further intrusions between November 16 and 23 from commercial VPNs, Tor, and AWS. Salesforce had disabled Gainsight-published application connections pending investigation by Salesforce, Gainsight, and Mandiant. Gainsight's CEO said the company presently knew of only a handful of customers who had their data affected, even as Shiny Hunters claimed the campaign had run for nearly three months. (Help Net Security)

Researchers find credentials exposed on popular code formatting sites

WatchTowr researchers reported on November 25, 2025 that JSONFormatter and CodeBeautify, widely used free code formatting tools, were exposing credentials, API keys, private keys, and configuration files through predictable shareable URLs. Scraping more than 80,000 saved JSON entries uncovered Active Directory credentials, GitHub tokens, cloud keys, and data from government, finance, healthcare, and telecom organizations. A canary AWS key the researchers planted was tested by an unknown party within 48 hours of being saved on the sites. (Help Net Security)

Cato Networks discloses HashJack prompt-injection flaw in AI browsers

Cato Networks disclosed a new indirect prompt injection technique called HashJack on November 26, 2025, which hides malicious instructions in the URL fragment of an otherwise legitimate webpage to manipulate AI browsers and assistants. Testing showed the technique worked against Perplexity's Comet, Microsoft's Copilot for Edge, and Google's Gemini for Chrome, though not against Anthropic's Claude for Chrome or OpenAI's Atlas. Perplexity and Microsoft issued fixes after disclosure, while Google classified the behavior as intended rather than a vulnerability. (Help Net Security)