Cybersecurity Brief – 2025-05-24

Sat, 24 May 2025 00:00:00 +0000

Major Incidents and Breaches

A massive data breach has exposed 184 million unencrypted passwords associated with Google, Microsoft, Facebook, and other platforms, significantly increasing credential stuffing and account takeover risks.
The decentralized exchange Cetus Protocol suffered a cryptocurrency heist resulting in the theft of $223 million. The operator is offering a deal to the attacker for the return of funds.
Europol, as part of Operation Endgame, coordinated a global crackdown on ransomware infrastructure, seizing approximately 300 servers, neutralizing 650 domains, and issuing arrest warrants for 20 individuals.
The FBI issued a warning regarding ongoing extortion attacks by the Luna Moth (Silent Ransom Group) targeting U.S. law firms through callback phishing and social engineering tactics.

Three critical zero-day vulnerabilities in Versa’s Concerto Orchestrator SD-WAN platform were patched. The flaws could allow complete compromise of both the application and the underlying host system.
Researchers disclosed that the threat actor “ViciousTrap” exploited a Cisco vulnerability to compromise nearly 5,300 network edge devices across 84 countries, creating a global honeypot network.

A surge in phishing campaigns has been observed impersonating Meta and leveraging Google’s AppSheet platform, enabling attackers to evade detection by exploiting trusted cloud services.
Cybercriminals are actively distributing Vidar and StealC infostealer malware using the ClickFix technique, now propagated via TikTok videos for social engineering and malware delivery.
60 malicious NPM packages have been identified collecting host and network data, exfiltrating it to Discord webhooks controlled by threat actors.

Attackers are increasingly abusing legitimate platforms (e.g., Google AppSheet, TikTok, NPM) for phishing, social engineering, and malware distribution, demonstrating a shift toward exploiting trusted ecosystems to bypass security controls.
The open-source SafeLine WAF has been highlighted for its zero-day exploit detection and bot protection capabilities, reflecting increased demand for self-hosted, user-friendly web application firewalls.
The ClickFix technique is gaining traction as a malware distribution vector, leveraging interactive social engineering to facilitate infections.
AI continues to transform security operations, with advancements in automated policy enforcement, threat detection, and user coaching for data protection noted as key developments.
Concerns over data privacy and the extensive collection of user data by AI chatbots remain prominent, with some platforms harvesting up to 90% of user data types.

Ongoing discussions emphasize the need for strengthened regulatory frameworks and privacy-enhancing technologies to address risks associated with generative AI and data privacy.
Law enforcement’s coordinated actions against ransomware infrastructure signal increased international collaboration and operational pressure on cybercriminal networks.