MSP cybersecurity news digest November 10, 2025

This briefing summarizes several active threats: GlassWorm resurfaced in the OpenVSX/VSCode ecosystem stealing developer credentials and deploying hidden SOCKS proxies to create persistent relay nodes; ClickFix expanded into multi-OS social-engineering with guided video tutorials and automatic command-copying; Gootloader returned delivering the 'Supper' SOCKS5 backdoor linked to ransomware affiliates; Google warns of generative-AI-assisted malware that mutates behavior; and Swedish supplier Miljödata suffered a breach exposing ~1.5 million individuals, underscoring supply-chain and developer-tooling risks.