Major Incidents or Breaches

  • Columbia University suffered a significant data breach impacting nearly 870,000 individuals, including students, applicants, and employees. Stolen data includes personal, financial, and health information.
  • French telecom provider Bouygues disclosed a breach affecting 6.4 million customers, with personal information compromised.
  • Allianz Life reported a cybersecurity incident exposing personal information of hundreds of thousands of individuals.
  • The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, impacting confidential court documents.
  • Royal and BlackSuit ransomware operations breached over 450 U.S. companies before their infrastructure was dismantled, according to the U.S. Department of Homeland Security.
  • FTC reported that Americans aged 60 and older lost a record $700 million to online scams in 2024, indicating a sharp increase in fraud targeting seniors.

Newly Discovered Vulnerabilities

  • Over a dozen vulnerabilities were identified in enterprise secure vaults from CyberArk and HashiCorp, enabling potential remote takeover without credentials if exploited.
  • A WinRAR vulnerability (CVE-2025-8088) was exploited as a zero-day in phishing attacks to install RomCom malware.
  • Security researchers found two techniques to crack at least eight brands of electronic safes using Securam Prologic locks, allowing unauthorized access within seconds.
  • A misconfiguration in corporate livestreaming platforms’ APIs was discovered, potentially exposing internal company meetings.
  • A feature in stream-oriented UNIX domain sockets (MSG_OOB) was leveraged to escalate privileges from Chrome renderer code execution to Linux kernel code execution.

Notable Threat Actor Activity

  • The Efimer Trojan is being mass-mailed via email and hacked WordPress sites to steal cryptocurrency by substituting clipboard wallet addresses, with over 5,000 victims reported.
  • A campaign dubbed GreedyBear used over 150 malicious Firefox extensions impersonating popular crypto wallets to steal more than $1 million in cryptocurrency.
  • 60 new malicious packages were found on RubyGems, targeting credential and crypto theft. Similar activity was reported on PyPI, leading to changes in security practices for these software repositories.
  • AI-powered website builders (DeepSite AI, BlackBox AI) are being leveraged in Brazilian phishing scams to create convincing malicious sites.
  • Data from an APT actor, believed to be affiliated with China or North Korea, was leaked, revealing details on recent campaigns, attacker tools, compromised credentials, and command files.
  • Scattered Spider threat actor has been targeting help desks and identity systems, exploiting social engineering to bypass traditional security perimeters.

Trends, Tools, or Tactics of Interest

  • Leaked credentials incidents increased by 160%, with attackers using them for a range of malicious activities beyond immediate compromise.
  • Attackers are increasingly targeting the foundations of cryptocurrency, including smart contracts, through both scams and exploitation of vulnerabilities.
  • Red teams demonstrated that GPT-5’s prompt-level filters can be easily bypassed using multi-turn “storytelling” attacks, raising concerns about the model’s enterprise security.
  • Shadow AI and rogue AI models are being identified as new risks, with tools like BigID’s Shadow AI Discovery launched to uncover such instances.
  • There is a notable drop in ransomware attacks in Q2, with reported incidents falling by nearly half.
  • Security flaws in IoT devices, such as school bathroom vape detectors, can enable covert audio surveillance due to embedded microphones and insecure configurations.

Regulatory or Policy Developments

  • Microsoft 365 apps for Windows will block file access via the insecure FPRPC legacy authentication protocol by default from late August.
  • Microsoft will retire the Lens PDF scanner app for iOS and Android as of September 15, 2025.
  • The U.S. Judiciary is implementing enhanced cybersecurity measures following the breach of its electronic case management systems.
  • Software repositories RubyGems and PyPI are enforcing new security measures in response to the discovery of malicious packages.
  • Ex-NSA chief Paul Nakasone indicated at Defcon that major policy changes for the tech community may be forthcoming.