Major Incidents or Breaches

  • A new Android malware family targeting vehicle head units manufactured by DoFun has been discovered. The malware is distributed via legitimate software updates and is designed to serve ads and build a proxy botnet, affecting the integrity of in-car systems and potentially exposing user data[1][7].
  • More than 9,300 Amazon Web Services (AWS) access keys have been found publicly exposed and remain active, granting full control over affected corporate accounts and posing a significant supply chain and cloud security risk[11].
  • Toronto’s Hospital for Sick Children (SickKids) suffered a data breach exposing personal information of current and former employees as well as job applicants, due to a vulnerability in third-party software[18].
  • Healthcare technology provider CareCloud reported a breach affecting 3.75 million individuals, with exposure of sensitive data including medical records, Social Security numbers, and bank details[31].

Newly Discovered Vulnerabilities

  • Cisco released security updates for nine vulnerabilities in Crosswork and Secure Workload platforms. Five of these flaws have a CVSS score of 10.0, allowing unauthenticated remote code execution and privilege escalation[9].
  • Microsoft patched a maximum-severity vulnerability in the Entra ID identity and access management platform that was being actively exploited. The company also released a total of 22 security patches, most addressing code execution, privilege escalation, and information disclosure issues[16][29].
  • CISA ordered US federal agencies to patch two actively exploited vulnerabilities in TrueConf Server, a self-hosted communication platform[15].
  • A critical type confusion vulnerability in the isolated-vm JavaScript library can lead to remote code execution on the host, enabling V8 sandbox escape and control-flow hijacking[26].
  • Researchers disclosed that Microsoft Defender’s boot-time remediation driver can be abused to perform arbitrary kernel-level operations, such as deleting security software at boot, effectively allowing attackers to disable endpoint protections[6].

Notable Threat Actor Activity

  • Fourteen trojanized npm packages were discovered delivering the RedC2 4.0 Linux backdoor, which uses artificial intelligence to enhance command and control operations. These packages masquerade as legitimate utilities[5].
  • A supply chain attack on the Rust programming ecosystem was linked to North Korean threat actors, involving a poisoned version of the arrayref crate that fetched malicious payloads from a remote server[27].
  • Threat actors are abusing FTP server banners to deliver two previously undocumented Windows remote access trojans, E4del and PINHOLE, via hidden commands[17].
  • A new phishing toolkit, iAuthFlow V2, registers attacker-controlled passkeys during phishing attacks, allowing persistent access to victim accounts even after password changes and session revocations[25].
  • The SynkLoader malware family was identified as being distributed through Microsoft Teams phishing campaigns, using a fake lock screen to steal credentials[10].

Trends, Tools, or Tactics of Interest

  • Vishing (voice phishing) and device code phishing attacks are surging, as attackers increasingly use social engineering methods that bypass traditional security controls[3].
  • Researchers demonstrated that encrypted prompts can bypass AI safety guardrails in large language models such as Grok and Gemini, using a method called Cryptographic Context Injection to conceal malicious instructions until runtime[24].
  • OWASP published a new Top 10 security risks list specific to AI skill integrations, introducing a Universal Skill Format for consistent and secure AI add-on development[19].
  • A new phishing toolkit leverages passkeys for post-compromise persistence, reflecting a shift in phishing tactics to exploit modern authentication mechanisms[25].
  • Scientific research revealed that expired Visa credit cards can be manipulated for purchases in so-called Zombie Card attacks, exposing weaknesses in payment processing systems[30].

Regulatory or Policy Developments Affecting the Security Industry

  • Two industry surveys indicated that while confidence among defense contractors regarding Cybersecurity Maturity Model Certification (CMMC) compliance is rising, the ability to provide evidence of compliance is lagging[28].

Sources#

  1. The invisible passenger in your car - securelist.com
  2. Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet - thehackernews.com
  3. Hundreds of leaked AWS keys give full control over corporate accounts - bleepingcomputer.com
  4. SickKids data breach exposes employee and job applicant info - bleepingcomputer.com
  5. Medical records, SSNs, and bank details exposed in CareCloud data breach - malwarebytes.com
  6. Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0 - thehackernews.com
  7. Microsoft patches max severity code execution, privilege escalation flaws - bleepingcomputer.com
  8. Microsoft Patches Exploited Entra ID Vulnerability - securityweek.com
  9. CISA orders feds to patch actively exploited TrueConf Server flaws - bleepingcomputer.com
  10. Critical Isolated-vm Vulnerability Leads to RCE on Host - securityweek.com
  11. Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot - thehackernews.com
  12. 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 - thehackernews.com
  13. Rust Supply Chain Attack Linked to North Korean Hackers - securityweek.com
  14. Hackers abuse FTP server banners to deliver new Windows malware - bleepingcomputer.com
  15. New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets - securityweek.com
  16. New SynkLoader malware pushed in Microsoft Teams phishing campaign - bleepingcomputer.com
  17. Report: Vishing and Device Code Phishing Are Surging - blog.knowbe4.com
  18. Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini - securityweek.com
  19. OWASP Flags Top AI Skill Risks in New Security Blueprint - darkreading.com
  20. Zombie Card: An expired Visa credit card can be used for purchases - malwarebytes.com
  21. Contractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind - securityweek.com