Lovable on DanSec Daily

Cybersecurity Brief – 2025-09-26

Fri, 26 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The Co-operative Group (UK) reported a loss of £80 million ($107 million) in operating profit due to a cyberattack attributed to the Scattered Spider threat group.
RTX (Raytheon Technologies) confirmed a ransomware attack affecting its airport services division.
Volvo Group disclosed that employee data was stolen in a ransomware attack linked to the Miljödata breach, impacting multiple Swedish organizations and municipalities.
An unofficial npm package mimicking ‘postmark-mcp’ was found to exfiltrate users’ email communications.
Over 500 npm packages were infected by the Shai-Hulud worm in a supply-chain attack, impacting packages with millions of downloads.
Two malicious Rust crates (fast_tlog and fast_log) on crates.io were found stealing Solana and Ethereum wallet keys from developers, with 8,424 downloads confirmed.

Newly Discovered Vulnerabilities

Cisco disclosed multiple zero-day vulnerabilities in its ASA firewalls and IOS devices, several of which have been actively exploited in the wild, including by nation-state actors (notably the “ArcaneDoor” campaign). Exploits have resulted in remote code execution and privilege escalation.
Salesforce patched a critical vulnerability (“ForcedLeak”) in the Agentforce AI platform that allowed prompt injection attacks, potentially exposing CRM data via AI agent manipulation and expired domain abuse.
Cisco patched a zero-day flaw affecting routers and switches, enabling remote attackers with admin privileges to execute arbitrary code as root.

Notable Threat Actor Activity

The China-linked APT group UNC5221 deployed new versions of the “Brickstorm” backdoor on edge devices, targeting appliances that cannot run traditional EDR agents. Campaigns persisted undetected for nearly 400 days, with evidence of analysis of stolen code to weaponize additional zero-day vulnerabilities.
North Korean actors behind the “Contagious Interview” campaign have been linked to a new backdoor dubbed AkdoorTea, along with tools TsunamiKit and ExistentialKit, targeting global cryptocurrency developers.
The threat actor “Vane Viper” was identified as operating a large-scale ad fraud and malware network, generating over 1 trillion DNS queries and using shell companies to obfuscate operations.
Chinese APT “RedNovember” targeted US defense contractors, government, aerospace, and legal organizations in a recent espionage campaign.
Microsoft reported a new variant of the XCSSET macOS malware targeting Xcode developers, with enhanced browser targeting and credential theft features.

Trends, Tools, or Tactics of Interest

A new AI-driven phishing platform, “SpamGPT”, was observed automating attack campaigns by leveraging generative AI and integrated email campaign tools.
Attackers are using AI-powered development platforms (Lovable, Netlify, Vercel) to rapidly create and host convincing fake CAPTCHA pages for phishing.
A fresh phishing campaign is targeting PyPI users by impersonating administrators and directing victims to credential-harvesting sites.
SVG-based phishing campaigns continue, with recent attacks using malicious SVG files disguised as recipes to deliver malware.
Webshells are increasingly being hidden in “.well-known” directories to evade detection.
Gcore Radar reported that the technology sector has overtaken gaming as the top target for DDoS attacks, with a 41% year-on-year increase and attack peaks reaching 2.2 Tbps.
Cloud Security Alliance introduced a SaaS Security Controls Framework to help customers manage shared responsibility in SaaS environments.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive mandating federal agencies to identify, mitigate, and patch Cisco zero-day vulnerabilities exploited in active attacks.
Microsoft announced it will offer free extended security updates for Windows 10 users in the European Economic Area (EEA), including all EU member states, Iceland, Liechtenstein, and Norway.
LinkedIn will use user data for AI training by default unless users opt out.
Canadian privacy commissioners accused TikTok of improperly collecting data from hundreds of thousands of children on its platform.

Cybersecurity Brief – 2025-08-21

Thu, 21 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a pharmaceutical company, confirmed a ransomware attack that resulted in the compromise and encryption of internal systems, with business operations impacted.
Vulnerabilities in a Workhorse Software application used by hundreds of municipalities exposed sensitive data; CERT/CC disclosed details following the release of patches.
Vulnerable internal services at Intel exposed information of 270,000 employees, as reported by a security researcher.
Microsoft is investigating an outage affecting Copilot and Office.com, impacting user access across North America.
Six major password managers are currently vulnerable to unpatched clickjacking flaws, potentially exposing user credentials, two-factor authentication codes, and credit card information.
McDonald’s staff and partner portals were found to have exposed APIs, sensitive data, and corporate documents due to security flaws.
Hackers are using legitimate ADFS redirects via office.com links to steal Microsoft 365 login credentials through phishing attacks.
The RapperBot DDoS-for-hire botnet was disrupted, and the alleged developer and administrator has been charged by the US Department of Justice.
A member of the “Scattered Spider” cybercrime group was sentenced to 10 years in prison and ordered to pay $13 million in restitution for SIM-swapping and related cyber offences.
Europol has clarified that a purported $50,000 reward for Qilin ransomware group members is a scam.

Newly Discovered Vulnerabilities

Apple released emergency security updates for iOS, iPadOS, and macOS, patching CVE-2025-43300, an out-of-bounds write zero-day vulnerability actively exploited in targeted attacks.
Google and Mozilla issued patches for multiple high-severity vulnerabilities in Chrome and Firefox browsers.
DOM-based clickjacking vulnerabilities affecting major password manager browser extensions could allow attackers to steal credentials and sensitive data.
A vulnerability in GPT-5’s routing mechanism can redirect user queries to older, less secure models, risking exposure to jailbreaks and unsafe outputs.
Researchers identified prompt injection vulnerabilities in AI browsers, such as Perplexity’s Comet, allowing malicious prompts to trigger unintended actions, including fraudulent purchases.
Vulnerabilities in McDonald’s internal portals exposed sensitive APIs and corporate documents.
CERT/CC disclosed information exposure vulnerabilities in Workhorse Software, used by local governments, after patch release.

Notable Threat Actor Activity

The Russian state-sponsored group “Static Tundra” (aka Energetic Bear) is exploiting a seven-year-old flaw in Cisco IOS/IOS XE software, targeting unpatched, end-of-life devices for cyber espionage against enterprises and critical infrastructure.
North Korean threat actors have conducted a coordinated cyber espionage campaign against diplomatic missions in South Korea, leveraging GitHub for command and control and deploying spear-phishing tactics.
Detailed spear-phishing attacks targeting European government entities in Seoul have been attributed to North Korea, China, or both.
Cybercriminals are increasingly abusing the AI-powered Lovable website builder to generate phishing pages, malware delivery sites, and fraudulent portals.
Low-skill attackers are leveraging LLM-generated scripts and services like Lovable to rapidly create convincing malicious websites.
Increased scanning activity targeting Airtell routers and web servers has been observed via honeypots.

Trends, Tools, or Tactics of Interest

HR-themed phishing attacks have surged by 120% in Q1 2025, with attackers impersonating internal HR communications to increase success rates.
The use of legitimate infrastructure (e.g., office.com, ADFS) in phishing campaigns is on the rise, enabling more convincing credential theft schemes.
AI browsers and agentic tools are being actively researched for vulnerabilities, with prompt injection and clickjacking emerging as significant risks.
The “Warlock” ransomware group is specifically targeting vulnerable on-premises SharePoint servers using sophisticated attack methods.
There is a notable increase in the abuse of AI-driven website builders (e.g., Lovable, Vibe) to lower barriers for cybercriminals, enabling rapid deployment of malicious sites.
The disruption of the RapperBot botnet and law enforcement action against its administrator highlight ongoing efforts to combat DDoS-for-hire operations.
Increased focus on shadow AI agents within enterprises, with concerns that unmonitored deployments could introduce significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced its Quantum-Safe Program, aiming to ensure all products and services are secured against quantum-based attacks by 2033.
Incode has acquired AuthenticID to enhance AI-driven identity verification, combining AI models with large-scale, regulated identity programme experience.
Europol issued a warning about fraudulent reward offers targeting ransomware group members, clarifying that a recently publicised Qilin reward is a scam.

Cybersecurity Brief – 2025-04-10

Thu, 10 Apr 2025 00:00:00 +0000

North Korea Expands Fraudulent IT Worker Operations
- Focus on Europe with global reach
- Identified by Google’s Threat Intelligence Group
AkiraBot Targets 420,000 Sites with OpenAI-Generated Spam
- Spams website chats, comment sections, and contact forms
- Bypasses CAPTCHA protections
Lovable AI Found Vulnerable to VibeScamming
- Vulnerable AI platform for creating web applications
- Susceptible to jailbreaking
New TCESB Malware Exploits ESET Security Scanner
- Chinese-affiliated threat actor exploiting security flaw in ESET
- Delivers previously undocumented malware
PipeMagic Trojan Exploits Windows Zero-Day Vulnerability
- Windows CLFS security flaw exploited in ransomware attacks
- Targeted a small number of victims
CISA Warns of CentreStack’s Hard-Coded MachineKey Vulnerability
- CISA adds security flaw impacting CentreStack to known exploited vulnerabilities
- Allows for Remote Code Execution (RCE) attacks
Explosive Growth of Non-Human Identities Creating Security Blind Spots
- GitGuardian report reveals secrets exposure due to NHIs
- Highlights security risks in modern software environments
Critical FortiSwitch Flaw Allows Remote Admin Password Changes
- Security patches released for FortiSwitch devices
- Vulnerability exploited for remote admin password changes
Microsoft Investigates Global Exchange Admin Center Outage
- Ongoing outage blocking admin access to EAC
- Microsoft actively investigating the issue
US Comptroller Cyber ‘Incident’ Compromises Org’s Emails
- Major cyber incident involving US Comptroller
- Investigation ongoing by Treasury Department
China-Linked Hackers Harassing Ethnic Groups with Spyware
- Targeting Uyghurs, Taiwanese, Tibetans with spyware
- Spreading malicious apps on online forums
Spyware Maker NSO Group Lobbying Trump Administration
- NSO Group hires lobbying firm with ties to Trump administration
- Despite being on US Commerce Department’s blacklist
Tariffs May Prompt Increase in Global Cyberattacks
- Concerns over reduced cybersecurity spending due to tariffs
- Potential increase in global cyberattacks
Using Post-Quantum Planning to Improve Security Hygiene
- Transition to post-quantum cryptography for improved security
- Planning for present and future security needs