Cybersecurity Brief – 2025-07-21

Mon, 21 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Over 75 company servers have been breached via active, large-scale exploitation of a critical Microsoft SharePoint zero-day vulnerability (CVE-2025-53770, CVSS 9.8). At least 85 organisations are confirmed affected, with exploitation ongoing since at least July 18th.
Over 3,500 websites have been compromised to host stealth JavaScript-based cryptocurrency miners using advanced obfuscation and WebSocket communication to evade detection.
Five npm packages were injected with malware following a phishing campaign that resulted in the theft of maintainer tokens, constituting a significant software supply chain attack.

Microsoft SharePoint is affected by two zero-day remote code execution vulnerabilities (CVE-2025-53770 and CVE-2025-53771), both actively exploited in the wild. Emergency patches have been released for some flaws, but at least one remains unpatched. Microsoft recommends applying mitigations and commencing threat hunting.
CrushFTP has a critical vulnerability (CVE-2025-54309, CVSS 9.0) under active exploitation, allowing attackers to gain administrative access on unpatched servers.
Hewlett-Packard Enterprise (HPE) Aruba Instant On Access Points contain hardcoded credentials, enabling attackers to bypass authentication and access the web interface. Security updates have been released to address the issue.

The PoisonSeed threat group is bypassing FIDO key protections by exploiting QR code phishing and abusing cross-device sign-in features to deceive users into approving malicious authentication requests.
EncryptHub (aka LARVA-208/Water Gamayun) is targeting Web3 developers with phishing campaigns using fake AI platforms to distribute the Fickle Stealer information-stealing malware.

Attackers are reviving browser-based cryptojacking, compromising thousands of sites with stealthy JavaScript miners that leverage WebSockets for covert communication.
A new toolkit, CredMaster, facilitates anonymous password spraying attacks by routing traffic through AWS proxies with rotating IPs to evade detection and throttling.
Supply chain attacks on open-source repositories continue, with phishing campaigns targeting package maintainers to steal credentials and inject malicious code.

Microsoft has issued emergency security guidance and patches for SharePoint zero-days, urging organisations to apply mitigations and conduct compromise assessments due to ongoing exploitation.

Sun, 20 Jul 2025 00:00:00 +0000

Salt Typhoon, a Chinese state-linked threat actor, maintained unauthorised access to US National Guard systems for nearly a year, according to new reporting.
A study has found that at least 750 US hospitals experienced disruptions during last year’s CrowdStrike outage, with over 200 hospitals suffering outages that affected patient care.

A 20-year-old vulnerability in train braking systems has been publicly disclosed, making these systems susceptible to remote attacks.

Threat actors associated with the PoisonSeed phishing campaign are actively bypassing FIDO2 multi-factor authentication by exploiting the cross-device sign-in feature in WebAuthn, tricking users into approving fraudulent authentication requests.
Attackers hijacked popular npm linter packages (eslint-config-prettier and eslint-plugin-prettier) through targeted phishing of maintainers, turning the packages into malware droppers in a software supply chain attack.

The PoisonSeed phishing campaign demonstrates a technique of downgrading MFA security by leveraging WebAuthn’s cross-device sign-in, undermining FIDO2 protections.
Recent npm package hijackings highlight continued targeting of open-source software supply chains through phishing and subsequent malware injection.