Cybersecurity Brief – 2025-09-09

Tue, 09 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Multiple popular npm JavaScript packages, collectively exceeding two billion weekly downloads, were compromised in a supply chain attack after a maintainer’s account was accessed via phishing. At least 18–20 high-profile packages were affected, with attackers injecting malicious code to steal cryptocurrency and other sensitive data.
Salesloft experienced a breach beginning with the compromise of its GitHub account in March. Attackers stole Drift OAuth tokens, which were later used in widespread attacks targeting Salesforce instances in August, impacting at least 22 companies, including major cybersecurity firms such as BeyondTrust, Bugcrowd, CyberArk, Cato Networks, JFrog, and Rubrik.
A new supply chain attack, dubbed ‘GhostAction’, targeted GitHub workflows, leading to the theft of 3,325 secrets, including PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys. Hundreds of repositories were affected.
Plex, a media streaming platform, suffered a data breach in which a hacker accessed customer authentication data. Customers have been advised to reset their passwords.
Lovesac, a US-based furniture company, confirmed a data breach following ransomware attack claims, with exposure of personal data for an undisclosed number of individuals.
Wealthsimple, a Canadian fintech firm, reported a data breach resulting from a supply chain attack, impacting some customer information but not compromising accounts or funds.
In the second phase of the Nx supply chain attack, over 6,700 private repositories from hundreds of organizations were made public.
iCloud Calendar infrastructure was abused in a phishing campaign targeting PayPal users, leveraging Apple and Microsoft services to send legitimate-seeming call-back phishing emails.

Newly Discovered Vulnerabilities

Researchers observed a surge in network scans targeting Cisco ASA devices, raising concerns about a potential upcoming vulnerability or exploitation campaign against these products.

Notable Threat Actor Activity

At least 45 previously unreported domains dating back to May 2020 have been linked to China-backed threat actors Salt Typhoon and UNC4841, indicating longstanding cyber-espionage operations using undiscovered infrastructure for persistent access.
A campaign attributed to China’s APT41 involved impersonating a US lawmaker to deliver malware to US trade groups, aiming to collect intelligence ahead of trade talks.
The GPUGate malware campaign is using paid Google search ads and fake GitHub commits to distribute malware to IT firms, targeting users searching for popular tools.
‘MostereRAT’ malware, deployed by an unidentified threat actor, is designed to evade and disable endpoint detection and response (EDR) tools, enabling long-term persistence on Windows systems.

Trends, Tools, or Tactics of Interest

Multiple supply chain attacks are targeting software development ecosystems, with a focus on compromising developer accounts (notably via phishing) to inject malicious code into widely used packages and repositories.
Attackers are increasingly targeting CI/CD pipelines and GitHub workflows to steal secrets and credentials at scale.
AI-powered ransomware is emerging, with proof-of-concept tools like PromptLock demonstrating the potential for LLM-orchestrated file encryption and extortion.
Threat actors are leveraging legitimate cloud services and infrastructure (Apple, Microsoft) to increase the credibility and deliverability of phishing campaigns.
Use of HTTP request signatures in new attack traffic was observed in honeypots, indicating evolving tactics for authentication and evasion.

Regulatory or Policy Developments

CISA announced its top priorities for securing US infrastructure at the Billington CyberSecurity Summit, with a focus on operational collaboration and innovation between government and industry.
Significant cybersecurity industry M&A activity continued, with 27 deals in August involving major vendors including Accenture, CrowdStrike, F5, Okta, and SentinelOne.

Other Security Technology Developments

Signal introduced an opt-in feature for end-to-end encrypted cloud backups, enabling users to securely restore chats if devices are lost or damaged.

Cybersecurity Brief – 2025-08-29

Fri, 29 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion suffered a data breach impacting over 4.4 million individuals in the US, exposing personal information but not credit reports or core credit data.
MathWorks (MATLAB developer) disclosed a ransomware attack that resulted in the theft of data belonging to over 10,000 individuals.
Google confirmed that the Salesloft breach is larger than previously reported, with attackers using stolen OAuth tokens to access both Google Workspace email accounts and Salesforce data.
The maintainers of the Nx build system reported a supply chain attack involving malicious npm packages and plugins, resulting in the leakage of over 2,300 GitHub, cloud, and AI credentials. This incident marks the first known use of AI-powered stealers in a supply chain attack.
Law enforcement agencies (FBI and Dutch Police) seized servers and domains associated with the VerifTools fake ID marketplace.
TransUnion and MathWorks incidents highlight continued targeting of large data repositories by threat actors, with significant personal data exposure.

Newly Discovered Vulnerabilities

A high-severity authentication bypass vulnerability was disclosed in Passwordstate, an enterprise password manager. Customers have been urged to patch immediately.
A flaw in the Visual Studio Code Marketplace allows attackers to republish previously deleted extensions under the same names, posing a risk to the software supply chain.
Researchers highlighted hidden vulnerabilities in popular project management tools (e.g., Trello, Asana), with risks including data exposure and insufficient backup protections.

Notable Threat Actor Activity

The China-linked APT group Salt Typhoon has exploited vulnerabilities in Cisco, Ivanti, and Palo Alto devices to breach over 600 organizations globally, including critical infrastructure in telecom, government, and military sectors. The group maintains persistent access for espionage purposes.
Cybercriminals are actively recruiting social engineering talent with fluent English skills, according to a new report on the cybercriminal recruitment ecosystem.
A new phishing-as-a-service (PhaaS) platform named “Salty 2FA” is being used to bypass MFA and steal Microsoft 365 credentials, targeting organizations across North America and Europe.
The TamperedChef malware campaign uses malvertising and fake PDF editor sites to deliver an information stealer that exfiltrates credentials and cookies.
North Korean IT worker schemes were targeted by new US Treasury sanctions, exposing $600K in crypto transfers and over $1M in profits for DPRK-linked threat actors.
Threat actors have abused Anthropic’s Claude AI to develop ransomware and automate data extortion campaigns.
Akira and Cl0p remain among the most active ransomware-as-a-service groups, with reports noting increased use of AI by both established and emerging gangs.

Trends, Tools, or Tactics of Interest

First documented AI-weaponized supply chain attack occurred via the Nx build system, where AI-powered stealers were used to rapidly exfiltrate developer secrets.
There is a notable rise in requests for ZIP files in web honeypot logs, indicating a possible trend in attackers seeking to exploit ZIP-based delivery or exfiltration methods.
Shadow IT continues to expand organizational attack surfaces, with researchers finding widespread exposed backups, open Git repositories, and accessible admin panels containing sensitive data.
RedExt, a browser extension-based C2 framework, has been released for red team operations, enabling data collection and command-and-control via Chromium-based browsers.
Meta reported shutting down millions of WhatsApp accounts linked to scam centers, reflecting ongoing large-scale anti-fraud operations.
Increasing use of malvertising and fake software download sites to deliver malware, as seen in the TamperedChef campaign.
Affiliates are flocking to scam gambling sites that lure victims with free credits and steal cryptocurrency deposits.
Microsoft Word for Windows will soon autosave and default to cloud storage for new documents.
CISA, FBI, and NSA issued a global advisory on the widespread espionage activities of Chinese nation-state actors targeting network devices.

Regulatory or Policy Developments

The US Treasury’s Office of Foreign Assets Control (OFAC) imposed new sanctions on individuals and entities associated with North Korean IT worker schemes.
The FCC disconnected over a thousand voice operators from the public telephone network for failing to combat robocalling.
CISA released updated Software Bill of Materials (SBOM) guidelines, receiving mixed industry reviews regarding their effectiveness and practical utility.

Nx on DanSec Daily

Cybersecurity Brief – 2025-09-09

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Other Security Technology Developments

Cybersecurity Brief – 2025-08-29

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments