CVE-2025-8088 on DanSec Daily

Cybersecurity Brief – 2026-06-10

Wed, 10 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Microsoft confirmed that 73 of its open-source GitHub repositories were compromised to inject password-stealing malware as part of a supply chain attack linked to the Miasma worm. Some repositories remain offline as the investigation continues, and the incident disrupted continuous integration pipelines for several Microsoft projects ^[11]^[27]^[31].
ServiceNow disclosed a security incident where attackers exploited an unauthenticated API flaw, enabling unauthorized access to customer data. The vulnerability had reportedly been known since April and has since been patched ^[6]^[20]^[43].
Two Russia-aligned threat actor campaigns continue to exploit a WinRAR vulnerability (CVE-2025-8088), patched last July, to deploy information stealers and conduct cyberespionage against Ukrainian government and military organizations ^[12]^[32].

Newly Discovered Vulnerabilities

Microsoft released a record 206 security fixes during the June 2026 Patch Tuesday, including three zero-day vulnerabilities. Notable among these are privilege escalation flaws in Microsoft Defender (“RoguePlanet”), YellowKey, GreenPlasma, and MiniPlasma, as well as critical remote code execution vulnerabilities across its software portfolio ^[4]^[7]^[16]^[19]^[24]^[29]^[38]^[41]^[47].
Google released patches for 74 Chrome vulnerabilities, including a high-severity V8 zero-day (CVE-2026-11645) that is being actively exploited in the wild ^[14].
Veeam patched a critical remote code execution flaw (CVE-2026-44963) in its Backup & Replication software, which allowed authenticated domain users to execute code remotely on affected servers ^[10]^[28].
Ivanti fixed two critical vulnerabilities in its Sentry secure mobile gateway, including a maximum-severity flaw enabling remote code execution as root, and Fortinet patched remotely exploitable OS command injection vulnerabilities ^[17]^[44].
SAP addressed 15 vulnerabilities in its June patch release, including four critical-severity flaws in NetWeaver and Commerce Cloud ^[22].
Adobe patched 123 vulnerabilities, nearly half of which could allow arbitrary code execution, primarily affecting Experience Manager ^[48].
OpenSSL addressed 18 vulnerabilities in its latest release, including high-severity issues, several of which were potentially discovered through AI-assisted analysis ^[50].
Six vulnerabilities were disclosed in protobuf.js, exposing Node.js applications to remote code execution and denial of service ^[8].
Microsoft Exchange was found vulnerable to email spoofing via the “Ghost-Sender” attack in hybrid environments using third-party mail servers or spam filters ^[30].

Notable Threat Actor Activity

Russia-aligned groups are actively exploiting a WinRAR vulnerability to deliver stealers and conduct espionage against Ukrainian targets, leveraging a flaw that has been patched for nearly a year ^[12]^[32].

Trends, Tools, or Tactics of Interest

The use of AI in cybersecurity is accelerating both vulnerability discovery and exploit development, contributing to the record number of vulnerabilities patched this month. AI-driven models such as Claude Mythos have demonstrated the ability to rapidly create working exploits for recently disclosed vulnerabilities, potentially shortening the window between disclosure and exploitation ^[29]^[37]^[49]^[51].
Anthropic released two versions of its new AI model: Claude Mythos 5, available to trusted cybersecurity partners with fewer restrictions, and Claude Fable 5, a public release with built-in cyberattack safeguards ^[5]^[18]^[37]^[49].
University of Toronto researchers demonstrated a proof-of-concept self-replicating AI worm using locally hosted open-weight LLMs to autonomously propagate and conduct network attacks ^[13].
Automated pentesting tools may miss critical vulnerabilities over time, highlighting the need for expert-driven assessments to supplement automation ^[3].
Phishing campaigns are increasingly leveraging real hotel reservation details to target travelers, indicating an evolution in social engineering tactics ^[2].
Simulation testing revealed that the OpenClaw AI email agent is susceptible to phishing attacks, leaking user data under conditions that commonly compromise human users ^[21].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft released extended security updates for Windows 10 (KB5094127) and cumulative updates for Windows 11 (KB5094126, KB5093998), addressing vulnerabilities and adding new security features ^[23]^[25].
Organizations are advised to apply vendor-supplied mitigations or discontinue use of vulnerable Arista EOS devices, as no patch will be issued for an exploited vulnerability ^[46].

Sources

Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues - thehackernews.com
GitHub disables Microsoft repos pushing password-stealing malware - bleepingcomputer.com
Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories - darkreading.com
ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances - thehackernews.com
ServiceNow discloses security incident exposing customer data - bleepingcomputer.com
ServiceNow Patches Vulnerability Exploited Against Some Customers - securityweek.com
WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine - thehackernews.com
Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs - darkreading.com
Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs - thehackernews.com
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows - thehackernews.com
Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days - bleepingcomputer.com
Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges - bleepingcomputer.com
Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws - bleepingcomputer.com
Blame AI: Patch Tuesday Hits Record 206 CVEs - darkreading.com
A Record-Breaking Patch Tuesday for June 2026 - krebsonsecurity.com
Microsoft June 2026 Patch Tuesday, (Tue, Jun 9th) - isc.sans.edu
Microsoft Patches 200 Vulnerabilities - securityweek.com
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now - thehackernews.com
Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code - thehackernews.com
New Veeam vulnerability exposes backup servers to RCE attacks - bleepingcomputer.com
Ivanti: Max severity Sentry flaw allows code execution as root - bleepingcomputer.com
Critical Vulnerabilities Patched in Fortinet, Ivanti Products - securityweek.com
SAP fixes critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
Adobe Patches 123 Vulnerabilities - securityweek.com
OpenSSL Patches High-Severity Vulnerability Found With AI - securityweek.com
Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS - thehackernews.com
Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address - darkreading.com
Anthropic Offers Mythos Upgrade for Cyber Partners and a ‘Safe’ Version for the Rest of You - wired.com
Anthropic Launches Claude Fable 5: Mythos-Class AI With Cybersecurity Guardrails - securityweek.com
Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation - securityweek.com
Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards - thehackernews.com
Anthropic rolls out Claude Fable 5, but it's available for a limited time - bleepingcomputer.com
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models - thehackernews.com
Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar - thehackernews.com
CyberheistNews Vol 16 #23 Now Phishing Attacks Use Real Hotel Reservations to Target Travelers - blog.knowbe4.com
OpenClaw AI agent found falling for phishing attacks, spills user data - bleepingcomputer.com
Microsoft releases Windows 10 KB5094127 extended security update - bleepingcomputer.com
Windows 11 KB5094126 & KB5093998 cumulative updates released - bleepingcomputer.com
No Patch Planned for Exploited Arista EOS Vulnerability - securityweek.com

Cybersecurity Brief – 2026-02-05

Thu, 05 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

A hacktivist group claims to have breached the Mexican government, allegedly leaking 2.3 terabytes of data affecting 36 million citizens. The government disputes the sensitivity of the leaked data.
Notepad++ update infrastructure was compromised by suspected Chinese state-backed hackers, resulting in the distribution of a backdoored version of the application.
Ongoing web traffic hijacking campaigns are targeting NGINX servers and management panels such as Baota (BT), redirecting user traffic through attacker-controlled infrastructure.
The DEAD#VAX malware campaign is deploying AsyncRAT via IPFS-hosted VHD phishing files, using advanced evasion techniques to bypass traditional security controls.
Iranian threat actors continue credential theft operations targeting expatriates, Syrians, and Israelis using spear-phishing and social engineering.
Attackers are leveraging Windows .scr screensaver files to deliver malware and remote management tools, exploiting the fact that these executables often evade standard controls.

Newly Discovered Vulnerabilities

Multiple critical vulnerabilities (including CVE-2026-25049) have been disclosed in the n8n workflow automation platform, allowing arbitrary system command execution and full host compromise. Public exploits are available.
A critical vulnerability in DockerDash, the AI assistant for Docker, allows remote code execution and data theft due to insufficient instruction validation in the MCP Gateway architecture.
VMware ESXi is affected by a high-severity sandbox escape vulnerability now exploited in ransomware attacks, as confirmed by CISA.
A five-year-old GitLab vulnerability is being actively exploited, prompting CISA to order urgent patching by US government agencies.
Google Looker contained vulnerabilities (dubbed LookOut) that allowed cross-tenant remote code execution and data exfiltration, putting multiple GCP environments at risk.
A fresh critical vulnerability in SolarWinds Web Help Desk is being exploited in the wild, allowing unauthenticated remote code execution.
Malicious NGINX configurations are being used to facilitate large-scale web traffic hijacking and exploitation via React2Shell, with attackers deploying cryptominers and reverse shells.
The EnCase forensic software kernel driver, though long-revoked, is being abused by attackers in an EDR killer tool to disable 59 security products.

Notable Threat Actor Activity

The Amaranth-Dragon group, linked to Chinese state-sponsored APT41, is exploiting the WinRAR CVE-2025-8088 vulnerability in espionage campaigns targeting government and law enforcement agencies across Southeast Asia.
Chinese threat actors hijacked Notepad++’s update infrastructure to distribute backdoored software.
Iranian state actors are conducting ongoing credential theft campaigns across the Middle East.
Ransomware group DragonForce is promoting a cartel model, increasing coordination among ransomware gangs.
Hackers are abusing legitimate but revoked drivers to disable endpoint detection and response (EDR) solutions.

Trends, Tools, or Tactics of Interest

AI-driven phishing attacks are increasing in sophistication, with attackers combining technical exploits and identity-based attacks to bypass email security solutions.
Leaked non-human identities, such as API keys and tokens, are becoming significant breach drivers in cloud environments, providing attackers with persistent access.
Attackers are increasingly abusing less-monitored file types (e.g., .scr screensaver files) and legitimate system features to evade detection.
Microsoft has developed a lightweight scanner for detecting backdoors in open-weight large language models (LLMs).
Microsoft is rolling out built-in Sysmon security monitoring in Windows 11 Insider builds, enhancing native endpoint visibility.
Orchid Security has introduced continuous identity observability for enterprise applications, addressing identity management beyond traditional IAM controls.
Prompt injection and data leakage risks have been identified in AI agent networks such as Moltbook.
Early incident response failures are often due to decision-making in the first moments after detection, not technical shortcomings.

Regulatory or Policy Developments Affecting the Security Industry

CISA has made unpublicized updates to its Known Exploited Vulnerabilities (KEV) catalog, highlighting ransomware operators’ focus on network edge device vulnerabilities.
CISA has mandated the patching of actively exploited legacy vulnerabilities in products such as GitLab.
Mozilla Firefox is introducing an AI feature opt-out, reflecting a trend toward increased user control over AI-driven browser functions.

Industry and Market Developments

Blockchain intelligence firm TRM Labs raised $70 million in Series C funding to expand AI-driven disruption of criminal networks.
Varonis acquired AllTrue.ai for $150 million to enhance AI trust, risk, and security management capabilities.
Orion raised $32 million for data security product development and market expansion.

Cybersecurity Brief – 2026-01-29

Thu, 29 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Polish energy grid suffered a coordinated cyberattack in December 2025, impacting around 30 distributed energy resource sites, including combined heat and power facilities and wind farms. The incident has been attributed to the Russian state-sponsored group ELECTRUM.
eScan antivirus vendor MicroWorld Technologies confirmed its update server was breached and used to distribute a malicious update.
The FBI seized the RAMP cybercrime forum, a major platform for ransomware gangs and malware advertisements.
Google, in collaboration with partners, disrupted IPIDEA, one of the world’s largest residential proxy networks.
A malicious campaign, dubbed “Bizarre Bazaar,” is actively targeting exposed Large Language Model (LLM) service endpoints to commercialise unauthorised access to AI infrastructure.
Researchers found 16 malicious Chrome extensions capable of hijacking ChatGPT sessions and exfiltrating user data.
Two malicious Python packages masquerading as spellcheckers were discovered on PyPI, delivering remote access trojans.

Newly Discovered Vulnerabilities

Two high-severity vulnerabilities were disclosed in the n8n workflow automation platform, allowing authenticated remote code execution and potential compromise of affected instances.
A critical sandbox escape vulnerability was identified in the vm2 Node.js library, enabling arbitrary code execution on the host system.
SolarWinds released patches for critical vulnerabilities in its Web Help Desk software, addressing authentication bypass and remote command execution issues.
Fortinet patched a zero-day (CVE-2026-24858) in FortiCloud SSO authentication, which allowed attackers to log into devices registered to other accounts; the company temporarily disabled SSO authentication to mitigate ongoing attacks.
Oracle WebLogic vulnerability CVE-2026-21962 has been recently patched, with evidence of exploit attempts being observed.

Notable Threat Actor Activity

Russian state-sponsored group ELECTRUM was attributed with medium confidence to the December 2025 cyberattack on Poland’s power grid.
Chinese-linked Mustang Panda deployed an updated COOLCLIENT backdoor in cyber espionage attacks against government entities, facilitating extensive data theft.
China-backed threat actor “PeckBirdy” used the JScript C2 framework in cross-platform campaigns targeting Chinese gambling websites and Asian government entities with new backdoors.
Multiple threat actors, including Russian and Chinese state-sponsored groups, are actively exploiting the WinRAR vulnerability CVE-2025-8088 for initial access and data theft, despite the availability of a patch since July 2025.
Initial access broker TA584 is now leveraging the Tsundere Bot and XWorm RAT to gain network access, leading to ransomware attacks.
Fake dating apps are being used as lures in Android spyware campaigns in Pakistan, linked to broader espionage operations.

Trends, Tools, or Tactics of Interest

A surge in attacks targeting Latin America, including data-leak extortion, credential theft, edge-device exploitation, and attacker adoption of AI-driven tactics, has made it the riskiest region for cyberattacks.
Threat actors are increasingly exploiting exposed AI/LLM endpoints and insecure deployments, leading to unauthorised access and data leakage in enterprise environments.
Malicious VS Code extensions (e.g., fake Moltbot) are being distributed via the official marketplace, dropping malware and exposing sensitive data such as API keys and OAuth tokens.
Password reuse and risky credential workarounds remain prevalent attack vectors, often overlooked by security teams.
AI-driven security operations (AI SOC agents) are accelerating triage and threat hunting, but concerns remain about over-reliance on automation.
Malicious browser extensions continue to target high-profile services like ChatGPT to exfiltrate user data.

Regulatory or Policy Developments Affecting the Security Industry

WhatsApp has rolled out new lockdown-style security features, including Strict Account Settings, to protect high-risk users (journalists, public figures) from advanced exploits and spyware. These features block risky attachments, media, and calls from unknown sources.
AI is increasingly being used for compliance controls and regulated actions, prompting CISOs to reconsider identity, access, and auditability frameworks.
ICE in the US is using Palantir’s AI tools to process and summarise tips, highlighting increased adoption of AI in law enforcement and government operations.

Cybersecurity Brief – 2026-01-28

Wed, 28 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Nike is investigating a potential data breach after the World Leaks ransomware/extortion group published 1.4 TB of allegedly stolen corporate files, including 188,347 highly sensitive documents.
SoundCloud has suffered a data breach impacting 29.8 million accounts, with hackers stealing personal and contact information.
Over 100 organizations have been targeted in a phishing campaign attributed to ShinyHunters, with domains set up to impersonate brands such as Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
Over 6,000 SmarterMail servers are exposed online and likely vulnerable to automated hijacking attacks exploiting a critical authentication bypass vulnerability.
Multiple threat actors, including state-sponsored and financially motivated groups, continue to exploit the CVE-2025-8088 WinRAR path traversal vulnerability for initial access and malware delivery.
Chrome and Edge browser extensions marketed as ChatGPT enhancement tools have been found stealing ChatGPT session data, granting threat actors access to user information.

Newly Discovered Vulnerabilities

Microsoft released emergency out-of-band patches for Office zero-day vulnerability CVE-2026-21509, which is actively exploited to bypass security features through malicious Office files.
Fortinet patched a critical authentication bypass vulnerability in FortiOS/FortiCloud SSO (CVE-2026-24858) after reports of active exploitation in the wild.
A critical remote code execution vulnerability has been disclosed in Grist-Core, an open-source spreadsheet-database platform, exploitable via spreadsheet formulas.
A critical sandbox escape flaw (CVE-2026-22709) was found in the vm2 Node.js library, allowing arbitrary code execution on host systems.
OpenSSL patched 12 vulnerabilities, including a high-severity remote code execution flaw.
‘PackageGate’ vulnerabilities in the JavaScript ecosystem allow bypassing NPM supply chain attack protections, leading to arbitrary code execution.
A critical Telnet server flaw exposes legacy and IoT systems to unauthenticated remote access and shell control.
Linux vulnerabilities are being actively exploited, enabling attackers to obtain root privileges or bypass authentication via Telnet.

Notable Threat Actor Activity

The HoneyMyte (aka Mustang Panda/Bronze President) APT group has updated its CoolClient backdoor and is deploying multiple infostealers, including three browser data stealer variants and clipboard monitoring tools, in recent campaigns.
China-aligned APT actors have been using a JScript-based command-and-control (C2) framework called PeckBirdy since 2023 to target multiple environments.
Pakistan-linked threat actors have conducted two cyber campaigns against Indian government entities using previously undocumented techniques.
The ShinyHunters group is running a large-scale phishing campaign targeting over 100 organizations with credential harvesting domains.
The World Leaks ransomware/extortion group claims responsibility for the Nike data breach and has published stolen data to pressure the victim.
Multiple threat actors continue to exploit the WinRAR CVE-2025-8088 vulnerability for initial access and malware deployment.
The ‘Stanley’ malware-as-a-service toolkit enables malicious Chrome extensions to overlay phishing content on legitimate websites without altering the visible URL.
A new ransomware strain, ‘Sicarii’, has emerged, featuring poor code quality and a possible false-flag Hebrew identity, and currently cannot be decrypted.

Trends, Tools, or Tactics of Interest

Attackers are increasingly weaponizing trusted Remote Monitoring and Management (RMM) tools to establish persistent backdoor access in victim networks.
Recent phishing campaigns are leveraging fake CAPTCHAs, Microsoft App-V scripts, and trusted web services to distribute infostealers (ClickFix-style attacks).
Modern ransomware operations are shifting from pure encryption to psychological extortion, leveraging stolen data and exposure threats to increase pressure on victims.
AI-generated data degradation (“model collapse”) is raising concerns about accuracy, malicious activity propagation, and PII protection in zero-trust environments.
Browser extensions are being used as undetectable phishing vectors, with malicious overlays on legitimate sites while maintaining the original URL.
Supply chain vulnerabilities in JavaScript/NPM environments remain a critical risk, with new bypass techniques emerging.
The exposure and exploitation of legacy protocols such as Telnet continue to present significant attack surfaces, especially in IoT and OT environments.

Regulatory or Policy Developments Affecting the Security Industry

Meta (WhatsApp) has introduced a ‘Strict Account Settings’ security mode to protect high-risk users from spyware and advanced cyber attacks, similar to Apple’s Lockdown Mode.
Criticism has been raised regarding MITRE’s management of the CVE vulnerability database, with calls to transfer oversight to the private sector for improved efficiency.
TikTok has narrowly avoided a US ban by forming a new American joint venture, impacting data governance and regulatory oversight for the platform in the US.

Cybersecurity Brief – 2025-08-12

Tue, 12 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Connex Credit Union disclosed a data breach affecting 172,000 members, with attackers stealing personal and financial information after breaching its systems.
The Netherlands’ National Cyber Security Centre (NCSC) reported exploitation of Citrix NetScaler vulnerability CVE-2025-6543 to breach critical organisations in the country.
Air France experienced a data breach resulting in the leak of frequent flyer data (as per Check Point’s weekly threat bulletin).
A major automaker’s dealership platform used by over 1,000 US dealerships was found to be vulnerable, allowing car hacking and personal data theft, including the ability for unauthorised remote vehicle unlocking.
Two hackers reportedly breached North Korean state-sponsored group Kimsuky, stealing and leaking internal data.
Law enforcement, in collaboration with international partners, took down infrastructure and seized over $1 million associated with the BlackSuit (Royal) ransomware group.
Over 29,000 Microsoft Exchange servers remain unpatched against a high-severity vulnerability, leaving them exposed to lateral movement and cloud environment compromise.

Newly Discovered Vulnerabilities

Researchers identified new security flaws in the TETRA (Terrestrial Trunked Radio) communications protocol, including weaknesses in its proprietary end-to-end encryption, impacting law enforcement and critical infrastructure communications.
A critical vulnerability in the OPC UA industrial protocol was disclosed, exposing utilities and factories to risk despite the protocol’s use of complex cryptography.
A sandbox escape with remote code execution was discovered in Google Chrome, earning a $250,000 bug bounty.
A path traversal vulnerability in WinRAR (CVE-2025-8088) was exploited as a zero-day by the Russian ‘RomCom’ group, targeting financial, defence, manufacturing, and logistics sectors in Europe and Canada.
A BadUSB attack technique, dubbed BadCam, was demonstrated against Lenovo Linux webcams, allowing persistent compromise via malicious USB devices.
Flaws in a major automaker’s dealership portal exposed customer and vehicle data and enabled unauthorised remote access to vehicles.

Notable Threat Actor Activity

The Russian-linked ‘RomCom’ hacking group exploited the WinRAR CVE-2025-8088 zero-day in targeted attacks on organisations in Europe and Canada.
North Korean Kimsuky hackers were themselves compromised, with internal data reportedly leaked by adversarial actors.
US authorities charged four Ghanaian nationals for their involvement in a $100 million fraud ring involving romance scams and business email compromise attacks.
The BlackSuit (Royal) ransomware gang suffered infrastructure seizures and asset forfeiture following coordinated law enforcement action.
An affiliate of the REvil ransomware group accused the Russian government of orchestrating the 2021 Kaseya supply chain attack.
Malicious actors have been actively exploiting a critical Erlang/OTP SSH vulnerability, with 70% of detected attacks targeting operational technology (OT) firewalls.

Trends, Tools, or Tactics of Interest

Surge in exploitation of Erlang/OTP SSH vulnerabilities, with a focus on OT firewall targets.
Increase in “native phishing” campaigns, where attackers abuse Microsoft 365 apps such as OneNote and OneDrive to deliver internal phishing lures.
Jailbreaking techniques for GPT-5 were demonstrated using “echo chamber” prompts and storytelling, bypassing safeguards without using inappropriate language.
The DarkBit ransomware (linked to MuddyWater) encryption was cracked by researchers, enabling free victim data recovery.
Exposure of persistent threats via USB-based attacks (BadCam) targeting Linux webcams.
Ongoing risk from large numbers of unpatched Exchange servers, facilitating potential lateral movement and cloud compromise.

Regulatory or Policy Developments

The Netherlands’ NCSC issued a public warning regarding active exploitation of Citrix NetScaler CVE-2025-6543, urging immediate remediation for critical infrastructure.

Cybersecurity Brief – 2025-08-11

Mon, 11 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Google patched a vulnerability that allowed malicious Google Calendar invites to hijack Gemini agents on target devices, enabling attackers to leak sensitive user data.
Researchers reported that attackers are leveraging Google paid ads to promote fake Tesla websites, potentially leading to credential theft and other fraudulent activities.

Newly Discovered Vulnerabilities

WinRAR maintainers released an update addressing an actively exploited zero-day vulnerability (CVE-2025-8088, CVSS 8.8).
New attack techniques have been identified that exploit flaws in Windows domain controllers, allowing attackers to leverage public DCs via RPC and LDAP to create DDoS botnets.
Researchers disclosed a now-patched Windows Remote Procedure Call (RPC) Endpoint Mapper (EPM) poisoning vulnerability that could be exploited to escalate privileges within a Windows domain.

Notable Threat Actor Activity

Threat actors have been observed exploiting the WinRAR zero-day (CVE-2025-8088) in the wild.
Malicious actors are using Google paid advertisements to direct users to phishing sites impersonating Tesla.

Trends, Tools, or Tactics of Interest

xsshunter-express, a self-hosted tool for capturing and analyzing blind XSS payloads, has been released, offering features such as screenshot capture, DOM dumps, and full attack context.
Attackers are increasingly targeting public infrastructure, such as domain controllers, to amplify DDoS attacks.
POS (Point-of-Sale) scams involving portable devices remain a concern, with continued reports of theft and fraud using these tools.

Cybersecurity Brief – 2025-08-09

Sat, 09 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Columbia University suffered a significant data breach impacting nearly 870,000 individuals, including students, applicants, and employees. Stolen data includes personal, financial, and health information.
French telecom provider Bouygues disclosed a breach affecting 6.4 million customers, with personal information compromised.
Allianz Life reported a cybersecurity incident exposing personal information of hundreds of thousands of individuals.
The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, impacting confidential court documents.
Royal and BlackSuit ransomware operations breached over 450 U.S. companies before their infrastructure was dismantled, according to the U.S. Department of Homeland Security.
FTC reported that Americans aged 60 and older lost a record $700 million to online scams in 2024, indicating a sharp increase in fraud targeting seniors.

Newly Discovered Vulnerabilities

Over a dozen vulnerabilities were identified in enterprise secure vaults from CyberArk and HashiCorp, enabling potential remote takeover without credentials if exploited.
A WinRAR vulnerability (CVE-2025-8088) was exploited as a zero-day in phishing attacks to install RomCom malware.
Security researchers found two techniques to crack at least eight brands of electronic safes using Securam Prologic locks, allowing unauthorized access within seconds.
A misconfiguration in corporate livestreaming platforms’ APIs was discovered, potentially exposing internal company meetings.
A feature in stream-oriented UNIX domain sockets (MSG_OOB) was leveraged to escalate privileges from Chrome renderer code execution to Linux kernel code execution.

Notable Threat Actor Activity

The Efimer Trojan is being mass-mailed via email and hacked WordPress sites to steal cryptocurrency by substituting clipboard wallet addresses, with over 5,000 victims reported.
A campaign dubbed GreedyBear used over 150 malicious Firefox extensions impersonating popular crypto wallets to steal more than $1 million in cryptocurrency.
60 new malicious packages were found on RubyGems, targeting credential and crypto theft. Similar activity was reported on PyPI, leading to changes in security practices for these software repositories.
AI-powered website builders (DeepSite AI, BlackBox AI) are being leveraged in Brazilian phishing scams to create convincing malicious sites.
Data from an APT actor, believed to be affiliated with China or North Korea, was leaked, revealing details on recent campaigns, attacker tools, compromised credentials, and command files.
Scattered Spider threat actor has been targeting help desks and identity systems, exploiting social engineering to bypass traditional security perimeters.

Trends, Tools, or Tactics of Interest

Leaked credentials incidents increased by 160%, with attackers using them for a range of malicious activities beyond immediate compromise.
Attackers are increasingly targeting the foundations of cryptocurrency, including smart contracts, through both scams and exploitation of vulnerabilities.
Red teams demonstrated that GPT-5’s prompt-level filters can be easily bypassed using multi-turn “storytelling” attacks, raising concerns about the model’s enterprise security.
Shadow AI and rogue AI models are being identified as new risks, with tools like BigID’s Shadow AI Discovery launched to uncover such instances.
There is a notable drop in ransomware attacks in Q2, with reported incidents falling by nearly half.
Security flaws in IoT devices, such as school bathroom vape detectors, can enable covert audio surveillance due to embedded microphones and insecure configurations.

Regulatory or Policy Developments

Microsoft 365 apps for Windows will block file access via the insecure FPRPC legacy authentication protocol by default from late August.
Microsoft will retire the Lens PDF scanner app for iOS and Android as of September 15, 2025.
The U.S. Judiciary is implementing enhanced cybersecurity measures following the breach of its electronic case management systems.
Software repositories RubyGems and PyPI are enforcing new security measures in response to the discovery of malicious packages.
Ex-NSA chief Paul Nakasone indicated at Defcon that major policy changes for the tech community may be forthcoming.