https://blog.dansec.red/vendors/nodemailer/Recent content in Nodemailer on DanSec DailyHugoen-gbTue, 02 Sep 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-09-02-cybersecurity-news/Tue, 02 Sep 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-09-02-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Zscaler experienced a data breach after threat actors accessed its Salesforce instance via compromised third-party platforms (Salesloft and Drift), resulting in the exposure of customer information, including support case contents.</li> <li>The breach at AI chatbot maker Salesloft continues to have repercussions, with mass theft of authentication tokens affecting numerous organisations that integrate Salesloft with Salesforce.</li> <li>Amazon researchers disrupted an operation by Russian state-sponsored threat group Midnight Blizzard (APT29), who were targeting Microsoft 365 accounts and data.</li> <li>American consumer credit reporting agency TransUnion was listed among the week’s top attacks and breaches.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>WhatsApp patched a vulnerability that enabled zero-click attacks, which was exploited in conjunction with an Apple vulnerability.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>North Korea-linked group ScarCruft (APT37) is conducting a phishing campaign targeting South Korean academics, delivering RokRAT malware.</li> <li>Russian APT29 (Midnight Blizzard) was actively targeting Microsoft 365 environments before their operation was disrupted by Amazon.</li> <li>Sextortion campaigns continue at scale, with analysis of 1,900 messages and 205 Bitcoin addresses over four years providing insights into threat actor behaviour and tactics.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>A malicious npm package, nodejs-smtp, was discovered mimicking Nodemailer and targeting cryptocurrency wallets (Atomic and Exodus) by injecting malicious code into desktop applications.</li> <li>Android malware droppers are shifting from delivering primarily banking trojans to distributing a broader range of threats, including SMS stealers and spyware.</li> <li>Over 80% of security incidents now originate from web applications, with browsers increasingly becoming a primary attack surface for enterprise environments.</li> <li>Ongoing scams are targeting travellers to the UK, with fraudsters offering fake Electronic Travel Authorisation (ETA) documents for inflated prices or to harvest personal and financial data.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>No significant regulatory or policy developments were reported in the covered period.</li> </ul>