Privacy Roundup: Week 1 of Year 2025

**Executive Summary:** This privacy news roundup reports several active consumer-facing security issues — the Four-Faith router command-injection (CVE-2024-12856) being exploited for reverse shells, ongoing botnet campaigns (Ficora and Capsaicin) abusing multiple D-Link vulnerabilities in outdated/EOL routers, and a phishing-driven campaign that hijacked 35 Chrome extensions to push data-stealing updates (targeting Facebook business accounts and tokens) — alongside privacy news about DivestOS and other projects reaching EOL, Apple privacy changes and a Siri settlement, and proposed U.S. rules to strengthen healthcare data security.