McDonald's on DanSec Daily

Cybersecurity Brief – 2026-08-17

Mon, 17 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

SafePal, a cryptocurrency hardware wallet provider, disclosed a data breach affecting approximately 39,798 customers after a vulnerability was exploited to steal customer order information. The stolen data is now reportedly being offered for sale by a threat actor ^[1].
A threat actor claims to have exfiltrated millions of records from major organisations including McDonald’s, TCS, and Vodafone as part of an Azure data theft campaign targeting Fortune 500 companies ^[7].

Newly Discovered Vulnerabilities

Wireshark version 4.6.8 was released, addressing 28 vulnerabilities and 25 bugs ^[6].

Notable Threat Actor Activity

Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service, resulting in significant disruption to communications earlier this week ^[3].
A new macOS malware strain, AmnesiaStealer, has been identified. It targets users via ClickFix attacks and includes a streaming module enabling attackers to hijack and remotely control victims’ browser sessions ^[4].

Sources

SafePal data breach impacts 39,798 customers, stolen info for sale - bleepingcomputer.com
Fortune 500 Companies Hit in Azure Data Theft Campaign - securityweek.com
Wireshark 4.6.8 Released, (Sun, Aug 16th) - isc.sans.edu
Large-scale DDoS attacks disrupted Threema secure messaging service - bleepingcomputer.com
New AmnesiaStealer macOS malware hijacks browser sessions via remote control - bleepingcomputer.com

Cybersecurity Brief – 2025-08-21

Thu, 21 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a pharmaceutical company, confirmed a ransomware attack that resulted in the compromise and encryption of internal systems, with business operations impacted.
Vulnerabilities in a Workhorse Software application used by hundreds of municipalities exposed sensitive data; CERT/CC disclosed details following the release of patches.
Vulnerable internal services at Intel exposed information of 270,000 employees, as reported by a security researcher.
Microsoft is investigating an outage affecting Copilot and Office.com, impacting user access across North America.
Six major password managers are currently vulnerable to unpatched clickjacking flaws, potentially exposing user credentials, two-factor authentication codes, and credit card information.
McDonald’s staff and partner portals were found to have exposed APIs, sensitive data, and corporate documents due to security flaws.
Hackers are using legitimate ADFS redirects via office.com links to steal Microsoft 365 login credentials through phishing attacks.
The RapperBot DDoS-for-hire botnet was disrupted, and the alleged developer and administrator has been charged by the US Department of Justice.
A member of the “Scattered Spider” cybercrime group was sentenced to 10 years in prison and ordered to pay $13 million in restitution for SIM-swapping and related cyber offences.
Europol has clarified that a purported $50,000 reward for Qilin ransomware group members is a scam.

Newly Discovered Vulnerabilities

Apple released emergency security updates for iOS, iPadOS, and macOS, patching CVE-2025-43300, an out-of-bounds write zero-day vulnerability actively exploited in targeted attacks.
Google and Mozilla issued patches for multiple high-severity vulnerabilities in Chrome and Firefox browsers.
DOM-based clickjacking vulnerabilities affecting major password manager browser extensions could allow attackers to steal credentials and sensitive data.
A vulnerability in GPT-5’s routing mechanism can redirect user queries to older, less secure models, risking exposure to jailbreaks and unsafe outputs.
Researchers identified prompt injection vulnerabilities in AI browsers, such as Perplexity’s Comet, allowing malicious prompts to trigger unintended actions, including fraudulent purchases.
Vulnerabilities in McDonald’s internal portals exposed sensitive APIs and corporate documents.
CERT/CC disclosed information exposure vulnerabilities in Workhorse Software, used by local governments, after patch release.

Notable Threat Actor Activity

The Russian state-sponsored group “Static Tundra” (aka Energetic Bear) is exploiting a seven-year-old flaw in Cisco IOS/IOS XE software, targeting unpatched, end-of-life devices for cyber espionage against enterprises and critical infrastructure.
North Korean threat actors have conducted a coordinated cyber espionage campaign against diplomatic missions in South Korea, leveraging GitHub for command and control and deploying spear-phishing tactics.
Detailed spear-phishing attacks targeting European government entities in Seoul have been attributed to North Korea, China, or both.
Cybercriminals are increasingly abusing the AI-powered Lovable website builder to generate phishing pages, malware delivery sites, and fraudulent portals.
Low-skill attackers are leveraging LLM-generated scripts and services like Lovable to rapidly create convincing malicious websites.
Increased scanning activity targeting Airtell routers and web servers has been observed via honeypots.

Trends, Tools, or Tactics of Interest

HR-themed phishing attacks have surged by 120% in Q1 2025, with attackers impersonating internal HR communications to increase success rates.
The use of legitimate infrastructure (e.g., office.com, ADFS) in phishing campaigns is on the rise, enabling more convincing credential theft schemes.
AI browsers and agentic tools are being actively researched for vulnerabilities, with prompt injection and clickjacking emerging as significant risks.
The “Warlock” ransomware group is specifically targeting vulnerable on-premises SharePoint servers using sophisticated attack methods.
There is a notable increase in the abuse of AI-driven website builders (e.g., Lovable, Vibe) to lower barriers for cybercriminals, enabling rapid deployment of malicious sites.
The disruption of the RapperBot botnet and law enforcement action against its administrator highlight ongoing efforts to combat DDoS-for-hire operations.
Increased focus on shadow AI agents within enterprises, with concerns that unmonitored deployments could introduce significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced its Quantum-Safe Program, aiming to ensure all products and services are secured against quantum-based attacks by 2033.
Incode has acquired AuthenticID to enhance AI-driven identity verification, combining AI models with large-scale, regulated identity programme experience.
Europol issued a warning about fraudulent reward offers targeting ransomware group members, clarifying that a recently publicised Qilin reward is a scam.

Cybersecurity Brief – 2025-07-16

Wed, 16 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Century Support Services, a Pennsylvania-based debt settlement firm, disclosed a data breach impacting 160,000 individuals after its systems were compromised in November 2024.
US department store chain Belk was targeted by the DragonForce ransomware group, which claims to have stolen over 150GB of data during a May 2025 attack.
Abacus Market, a major Western darknet drug marketplace, has gone offline in a suspected exit scam, shutting down its public infrastructure.
McDonald’s hiring platform inadvertently exposed data of approximately 64 million job applicants due to the use of default credentials.
Several companies in Italy’s Lombardy region suffered business disruption after a Romanian ransomware group known as ‘Diskstation’ attacked NAS devices. The group was dismantled by international law enforcement.

Newly Discovered Vulnerabilities

Google released a security update for Chrome version 138, patching its fifth zero-day vulnerability of 2025.
Microsoft issued emergency update KB5064489 to address an issue preventing Azure virtual machines from launching when Trusted Launch is disabled and Virtualization-Based Security is enabled.

Notable Threat Actor Activity

North Korean threat actors associated with the “Contagious Interview” campaign published 67 malicious packages to the npm registry, delivering the XORIndex malware loader to developer systems.
A state-backed group is targeting Southeast Asian government organizations with the novel HazyBeacon Windows backdoor, utilizing AWS Lambda for command-and-control and data exfiltration.
Attackers leveraged over 600 domains to distribute a trojanized Telegram Android app, stealing data from Chinese-speaking users, particularly those on older Android versions.
A new variant of the Android malware Konfety uses malformed APKs and obfuscation techniques to evade detection and analysis.
Threat actors are embedding obfuscated JavaScript in SVG files to enable browser-native redirection to malicious sites.

Trends, Tools, or Tactics of Interest

AsyncRAT, an open-source remote access trojan first released in 2019, has proliferated into a complex ecosystem of forks and variants, fueling global cybercrime and democratizing access to malware capabilities.
GLOBAL GROUP, a newly emerged ransomware-as-a-service (RaaS) operation, is expanding its activities across Australia, Brazil, Europe, and the United States, employing AI-driven negotiation tools to enhance extortion processes.
Cloudflare reported mitigation of 7.3 million DDoS attacks in Q2 2025, with hyper-volumetric attacks reaching a record 7.3 Tbps. The company noted that the total number of DDoS attacks blocked in 2025 has already exceeded the total for 2024.
Criminal networks continue to exploit insider vulnerabilities within organizations, adapting rapidly to bypass traditional security measures.
Alternate Data Streams (ADS) in NTFS are being used by keylogger malware to hide captured data, providing stealth persistence.
AI prompt attacks and the security of agentic AI systems are highlighted as emerging concerns, with risks associated with high-privilege authentication and invisible identity access in automated workflows.

Regulatory or Policy Developments Affecting the Security Industry

MITRE launched the AADAPT framework, designed to complement the ATT&CK framework, focusing on detection and response to cyberattacks targeting cryptocurrency assets and financial systems. The framework provides documentation for identifying, investigating, and mitigating weaknesses in digital asset payments.

Cybersecurity Brief – 2025-07-15

Tue, 15 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Louis Vuitton has notified customers in the UK, South Korea, Turkey, and possibly other countries of a data breach affecting their personal information.
McDonald’s has suffered a data breach resulting in the exposure of customer data.
Two versions of the Gravity Forms WordPress plugin, distributed via the official download page, were compromised in a supply chain attack, with malware injected into the plugin.
A malicious Visual Studio Code extension for the Cursor AI IDE led to the theft of $500,000 in cryptocurrency from a Russian crypto firm, after infecting devices with remote access tools and infostealers.
India’s Central Bureau of Investigation (CBI) dismantled a transnational cybercrime syndicate responsible for a £390,000 UK tech support scam, arresting key operatives at a Noida call center.

Newly Discovered Vulnerabilities

Multiple Gigabyte motherboard models have UEFI firmware vulnerabilities that allow attackers to bypass Secure Boot and install persistent bootkit malware invisible to the operating system and capable of surviving OS reinstalls.
Vulnerabilities in Gigabyte firmware could allow attackers to disable Secure Boot and execute code during the early boot phase, facilitating backdoor deployment.
A vulnerability in train End-of-Train and Head-of-Train radio systems allows remote attackers to trigger train brakes; this issue has been known in the industry for 20 years.
CISA has added the recently disclosed CitrixBleed 2 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, designating it as an unacceptable risk.
Google Gemini AI assistant is vulnerable to prompt-injection attacks, allowing attackers to craft invisible, malicious prompts that can be used to display phishing messages, including when summarising emails in Google Workspace.

Notable Threat Actor Activity

The Interlock ransomware group is distributing a new PHP-based variant of its remote access trojan (RAT) using a delivery mechanism called FileFix, in campaigns targeting multiple industries. The group is leveraging the KongTuke Traffic Distribution System (TDS) and legitimate websites for web-inject campaigns to gain control of victim devices.
Cybercriminals are impersonating major news outlets (CNN, BBC, CNBC) via sponsored ads and fake news websites to lure victims into investment scams.
Scattered Spider threat actor arrests have been reported, indicating law enforcement action against this group.
Exposed Git repositories continue to be a source of sensitive data leaks across enterprises, representing a persistent but often overlooked risk.

Trends, Tools, or Tactics of Interest

There is a reported increase in honeypot log volumes, indicating a rise in scanning and malicious activity observed on internet-facing systems.
The UserAssist Windows artifact, including previously undocumented binary data structures, has been detailed for forensic and incident response purposes, with a new parsing tool released.
Attackers are increasingly targeting supply chains, as evidenced by the compromise of the Gravity Forms WordPress plugin.
The use of prompt-injection attacks against AI assistants is an emerging tactic for phishing and social engineering.

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) has launched the Vulnerability Research Initiative (VRI), a new programme to strengthen collaboration with external cybersecurity experts for vulnerability discovery and reporting.

Cybersecurity Brief – 2025-07-12

Sat, 12 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

A vulnerability in McHire, McDonald’s chatbot job application platform, exposed chat histories and personal data of over 64 million job applicants in the United States due to weak authentication (“123456” password) and insecure API design.
The developer account for the WordPress Gravity Forms plugin was compromised, leading to backdoored plugin installers being distributed via the official website in a supply-chain attack.
A critical vulnerability (CVE-2025-47812) in Wing FTP Server is being actively exploited in the wild, allowing attackers to execute arbitrary commands with root or system privileges.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE-2025-25257) in FortiWeb that allows unauthenticated attackers to execute arbitrary database commands. Proof-of-concept exploits for this vulnerability have been publicly released.
Security researchers disclosed four vulnerabilities in OpenSynergy’s BlueSDK Bluetooth stack (“PerfektBlue”), which could allow remote code execution on millions of vehicles (including Mercedes, Skoda, and Volkswagen) and over a billion industrial, medical, mobile, and consumer devices.
The U.S. CISA confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway, mandating federal agencies to patch within 24 hours.
A zero-day vulnerability in OpenVSX, a popular extension marketplace, was discovered and patched. The flaw could have enabled attackers to compromise millions of developer machines via a supply chain attack.
Microsoft disclosed new attack techniques targeting AMD CPUs.
NVIDIA issued guidance recommending activation of System Level Error-Correcting Code (ECC) to mitigate Rowhammer attacks on GPUs with GDDR6 memory. Researchers demonstrated Rowhammer-based “GPUHammer” attacks that can degrade machine learning model accuracy.

Notable Threat Actor Activity

The Iranian-backed Pay2Key ransomware-as-a-service operation has resurfaced, offering affiliates an increased profit share (80%) for attacks targeting Western organisations, particularly in the US and Israel. This follows recent geopolitical tensions involving Iran, Israel, and the US.
The Indian APT group DoNot is actively targeting government entities.

Trends, Tools, or Tactics of Interest

Researchers at Netcraft highlighted that AI-generated search engine summaries are inadvertently directing users to phishing sites when queried for legitimate login pages, posing a new phishing risk vector.
SentinelOne reported evolution in the ZuRu macOS malware family.
The 2025 Data Risk Report notes heightened data loss risks from AI-powered tools, with calls for unified, AI-driven data security strategies.
Cyber-insurance premiums are declining from previous highs, though comprehensive coverage remains vital for risk management.
There is increased emphasis on integrating cybersecurity into financial sector digital transformation strategies.
Discussion of passwordless authentication mechanisms-specifically passkeys using public key cryptography-to address the inherent risks of shared secrets in traditional password systems.

Regulatory or Policy Developments

The European Union unveiled a voluntary AI Code of Practice to help businesses comply with the phased rollout of the EU AI Act.
The Irish Data Privacy Commission opened a new investigation into TikTok regarding the transfer of user data to China under EU privacy regulations.
Google did not release a scheduled July 2025 Android security patch, breaking a ten-year streak of monthly updates.

Cybersecurity Brief – 2025-07-11

Fri, 11 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

CISA added CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
A critical remote code execution vulnerability was discovered in the open-source mcp-remote project, affecting over 437,000 downloads.
Multiple critical vulnerabilities, dubbed “PerfektBlue,” were identified in the BlueSDK Bluetooth stack used by Mercedes, Volkswagen, and Skoda vehicles. These flaws could allow remote code execution and potential access to critical vehicle systems.
A high-severity flaw, CVE-2025-3648, was disclosed in the ServiceNow platform. Exploitation could lead to data exposure via misconfigured access control lists (ACLs).
AMD disclosed a new class of vulnerabilities called Transient Scheduler Attacks, impacting a wide range of its CPUs and potentially allowing information disclosure.
A 6-year-old Oracle vulnerability affecting eSIM technology was disclosed, enabling potential spying and device takeover across millions of phones.
The Model Context Protocol (MCP) ecosystem, widely adopted for integrating AI models with external data, was found to have critical security vulnerabilities opening new attack vectors.

Notable Threat Actor Activity

Scattered Spider, a data theft and extortion group, has shifted its targeting to the aviation and transportation sectors, according to warnings from the FBI and cybersecurity experts.
Kaspersky identified malicious open-source packages for Cursor AI that deploy the Quasar backdoor and a cryptocurrency stealer.
Ongoing social engineering campaigns are using fake gaming and AI startup firms on Telegram and Discord to distribute malware targeting cryptocurrency users.
A new ZuRu malware variant is propagating via trojanized versions of the Termius macOS app, targeting developers.
Deepfake attacks are being used to impersonate high-profile political figures, such as Marco Rubio, to attempt to extract government secrets.
A Russian professional basketball player was arrested in France at the request of the US for allegedly acting as a negotiator for a ransomware gang.

Trends, Tools, or Tactics of Interest

AI-driven attacks are becoming more sophisticated, faster, and pervasive, with increased use of generative AI in offensive operations.
SSH tunneling, specifically direct-tcp requests, is highlighted as an active technique.
Force Push Scanner is a new tool for red teams to identify leaked secrets in ephemeral GitHub commits.
Anubis, an open-source self-hosted firewall, is being used to block AI bots from scraping website content.
SIM swap fraud is reportedly increasing, highlighting ongoing risks to mobile-based authentication.
Microsoft replaced the default JScript engine with JScript9Legacy in Windows 11 version 24H2 and later, aiming to improve scripting security.

Regulatory or Policy Developments

The FBI issued guidance on CJIS (Criminal Justice Information Services) compliance, emphasizing password hygiene, multi-factor authentication, and access control for law enforcement data handlers.
The U.S. Department of Homeland Security is advising law enforcement to treat certain protest activities as violent tactics, including livestreaming and skateboarding, potentially affecting policing and surveillance practices.
CISA’s update to the KEV catalog with Citrix NetScaler CVE-2025-5777 signals heightened regulatory attention to actively exploited enterprise vulnerabilities.

Cybersecurity Brief – 2025-07-10

Thu, 10 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas confirmed a data breach affecting 5.7 million customers, with threat actors exfiltrating customer data.
Bitcoin Depot reported a data breach impacting nearly 27,000 cryptocurrency users, exposing sensitive customer information.
Ingram Micro is restoring operations after a ransomware attack by the SafePay group, which disrupted systems and business services.
McDonald’s AI hiring platform, operated by Paradox.ai, exposed the personal information of tens of millions of job applicants due to basic security flaws, including the use of the password ‘123456’.
Nippon Steel Solutions disclosed a data breach following exploitation of a zero-day vulnerability in network equipment.
Nova Scotia Power, a Canadian electric utility, reported disruption of power meters and a data breach affecting individuals in both Canada and the United States.
Researchers identified millions of users being spied on via malicious browser extensions available in the Chrome and Edge web stores.

Newly Discovered Vulnerabilities

Microsoft released patches for 130 vulnerabilities, including critical flaws in SPNEGO and SQL Server. One of the patched vulnerabilities was publicly known prior to remediation.
A new vulnerability in ServiceNow, dubbed “Count(er) Strike,” allows low-privileged users to enumerate and extract restricted data from tables they should not access.
Multiple severe vulnerabilities remain unpatched in Ruckus Wireless management products, allowing attackers to fully compromise managed network environments.
A container escape vulnerability in the NVIDIA Container Toolkit could allow attackers to access AI datasets across Kubernetes tenants.
Ivanti, Fortinet, and Splunk released security updates addressing critical and high-severity vulnerabilities in their respective products.
Siemens, Schneider Electric, and Phoenix Contact issued July 2025 ICS Patch Tuesday advisories, addressing vulnerabilities in industrial control systems.

Notable Threat Actor Activity

The Initial Access Broker (IAB) Gold Melody has been linked to campaigns exploiting leaked ASP.NET machine keys to gain unauthorized access to organizations and sell that access.
APT group DoNot, with suspected ties to India, expanded operations targeting European foreign ministries using the LoptikMod malware for data harvesting.
The U.S. Department of the Treasury sanctioned a North Korean hacker affiliated with the Andariel group for involvement in remote IT worker schemes and malware campaigns.
Xu Zewei, a Chinese national, was arrested in Milan for alleged involvement with the Silk Typhoon state-sponsored group and cyberattacks against U.S. organizations.
Researchers reported a North American APT exploiting a Microsoft Exchange zero-day to target a Chinese entity.
The SatanLock ransomware group has shut down its operations but plans to leak additional files stolen from victims.

Trends, Tools, or Tactics of Interest

Attackers are bypassing legacy MFA solutions using real-time phishing and fake websites, highlighting the limitations of traditional authenticator apps.
A proof-of-concept AI malware using reinforcement learning was demonstrated to reliably evade Microsoft Defender.
Deepfake technology was used to impersonate a government official, successfully deceiving diplomats and politicians, exemplifying the growing national security threat from AI-generated impersonations.
Malicious browser extensions continue to be distributed via official Chrome and Edge stores, enabling large-scale user surveillance.
The open-source bot blocker “Anubis” was introduced to prevent AI scrapers from accessing website content using a proof-of-work firewall.
SSH tunneling and direct-tcp requests were highlighted as active techniques for covert network access.
Security automation platforms like Tines are offering extensive libraries of pre-built workflows for ticketing, device identification, and threat triage.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s OFAC imposed sanctions on a North Korean cyber actor for their role in IT worker schemes supporting the Andariel group.
Microsoft confirmed a widespread issue with Windows Server Update Services (WSUS) preventing synchronization and deployment of Windows updates.
Microsoft announced that Windows 10 Extended Security Updates (ESU) will be available for consumers and businesses post-October 2025, with varying pricing models.
Microsoft Authenticator on iOS will transition backups to iCloud, removing the requirement for a Microsoft personal account.
Google disclosed further details on Android’s Advanced Protection for Chrome, emphasizing enhanced security measures.
Samsung announced new security features for Galaxy smartphones, including on-device AI protections, cross-device threat detection, and quantum-resistant encryption for network security.