Security. In focus.

Cybercriminals Exploit X’s Grok AI to Bypass Ad Protections and Spread Malware to Millions

Cybercriminals are exploiting X’s Grok AI to bypass ad protections and spread malware. They use promoted posts with hidden malicious links, prompting Grok to display the link in responses, amplifying it to millions of users.

Popular Android VPN apps found to have security flaws and China links | Malwarebytes

A report from the University of Toronto’s Citizen Lab and Arizona State University reveals that many popular Android VPN apps have security flaws and undisclosed ownership links to China. The report identifies three families of VPNs with shared security vulnerabilities, including hard-coded passwords and undisclosed data collection. The researchers suggest that these apps are owned by a Chinese company, raising concerns about data privacy and security.

Scattered Lapsus$ Hunters Demand Google Fire Security Experts or Face Data Leak

Scattered Lapsus$ Hunters, a coalition of cybercrime groups, threatened to leak alleged stolen Google data unless two security experts, Austin Larsen and Charles Carmakal, are fired. The group also demanded Google stop investigating several malicious activity clusters. While the group has not provided proof of access to Google’s systems, their demands suggest an attempt to disrupt ongoing investigations.

Dutch Lab Cancer Screening Hack Balloons to 941,000 Victims

A ransomware attack on Dutch medical lab Clinical Diagnostics, a unit of Eurofins Scientific, compromised the data of 941,000 participants in a cervical cancer screening program. The ransomware gang Nova, responsible for the attack, is threatening to leak patient data on the dark web. The breach exposed sensitive information including names, addresses, and citizen service numbers.

EU Court Preserves EU-US Data Privacy Framework

The EU General Court upheld the EU-US Data Privacy Framework, rejecting a French politician’s claim that the US oversight mechanisms are not independent. The ruling allows American companies to transfer and process European citizens’ data, facilitating significant cross-border business. Privacy advocates remain skeptical, citing concerns about the framework’s safeguards and the potential impact of the Trump administration’s actions on the Privacy and Civil Liberties Oversight Board.

Matrix.org homeserver grinds to a halt after RAID meltdown www.theregister.com/2025/09/0…

A RAID failure has taken the Matrix.org homeserver offline, leaving users of the decentralized messaging service unable to send or receive messages while engineers attempt a 55 TB database restore.

To be clear, those with their own homeservers, such as government organizations, are unaffected, but anyone using Matrix.org as their homeserver will have been hearing the sound of silence from the platform while the team works to bring the service back online.

www.theregister.com/2025/09/0…

Censys Inc, vendor of the popular Censys internet-mapping tool, has revealed that state-based actors are trying to abuse its services by hiding behind academic researchers.

Censys started life in 2015 as an academic project that aimed to scan the internet and provide data to the research community. In 2017 the project formed a company that now provides a comprehensive map of the internet that it says can help cyber-defenders to find threats and respond before they create a problem.

The company continues to provide data to researchers, but in a paper [PDF] it will present at the SIGCOMM conference next week, admits “Equitably operating a research program is more challenging than we anticipated.”

“While it is easy to verify the identity of well-established researchers with a Google Scholar profile or presentations at conferences like Blackhat or BSides, these constitute only a small fraction of requests,” the paper states.

Nick Andersen appointed to CISA leadership role therecord.media/andersen-…

The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday announced that Nicholas Andersen has taken over as the executive assistant director for cybersecurity.

Andersen, who began Tuesday, served as principal deputy assistant secretary at the Department of Energy’s Cybersecurity, Energy Security, and Emergency Response office from 2019 until 2021. During that time, he performed the duties of assistant secretary, according to a CISA press release.

Andersen worked closely with Sean Plankey, who has been nominated to run CISA, while at the Department of Energy.

Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats thehackernews.com/2025/09/i…

An Iran-nexus group has been linked to a “coordinated” and “multi-wave” spear-phishing campaign targeting the embassies and consulates in Europe and other regions across the world.

The activity has been attributed by Israeli cybersecurity company Dream to Iranian-aligned operators connected to broader offensive cyber activity undertaken by a group known as Homeland Justice.

“Emails were sent to multiple government recipients worldwide, disguising legitimate diplomatic communication,” the company said. “Evidence points toward a broader regional espionage effort aimed at diplomatic and governmental entities during a time of heightened geopolitical tension.”

The attack chains involve the use of spear-phishing emails with themes related to geopolitical tensions between Iran and Israel to send a malicious Microsoft Word that, when opened, urges recipients to “Enable Content” in order to execute an embedded Visual Basic for Applications (VBA) macro, which is responsible for deploying the malware payload.

The email messages, per Dream, were sent to embassies, consulates, and international organizations across the Middle East, Africa, Europe, Asia, and the Americas, suggesting that the activity cast a wide phishing net. European embassies and African organizations are said to have been the most heavily targeted.

Android Security Alert: Google Patches 120 Flaws, Including Two Zero-Days Under Attack thehackernews.com/2025/09/a…

Google has shipped security updates to address 120 security flaws in its Android operating system as part of its monthly fixes for September 2025, including two issues that it said have been exploited in targeted attacks.

The vulnerabilities are listed below

• CVE-2025-38352 (CVSS score: 7.4) - A privilege escalation flaw in the Linux Kernel component
• CVE-2025-48543 (CVSS score: N/A) - A privilege escalation flaw in the Android Runtime component

Google said both vulnerabilities could lead to local escalation of privilege with no additional execution privileges needed. It also noted that no user interaction is required for exploitation.

Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure thehackernews.com/2025/09/t…

Threat actors are attempting to leverage a newly released artificial intelligence (AI) offensive security tool called HexStrike AI to exploit recently disclosed security flaws.

HexStrike AI, according to its website, is pitched as an AI‑driven security platform to automate reconnaissance and vulnerability discovery with an aim to accelerate authorized red teaming operations, bug bounty hunting, and capture the flag (CTF) challenges.

Per information shared on its GitHub repository, the open-source platform integrates with over 150 security tools to facilitate network reconnaissance, web application security testing, reverse engineering, and cloud security. It also supports dozens of specialized AI agents that are fine-tuned for vulnerability intelligence, exploit development, attack chain discovery, and error handling.

But according to a report from Check Point, threat actors are trying their hands on the tool to gain an adversarial advantage, attempting to weaponize the tool to exploit recently disclosed security vulnerabilities.

“This marks a pivotal moment: a tool designed to strengthen defenses has been claimed to be rapidly repurposed into an engine for exploitation, crystallizing earlier concepts into a widely available platform driving real-world attacks,” the cybersecurity company said.

Discussions on darknet cybercrime forums show that threat actors claim to have successfully exploited the three security flaws that Citrix disclosed last week using HexStrike AI, and, in some cases, even flag seemingly vulnerable NetScaler instances that are then offered to other criminals for sale.

Navy Federal Credit Union Backup Exposed Online www.databreachtoday.com/navy-fede…

Navy Federal, the world’s largest credit union, left hundreds of gigabytes of internal backup files exposed on Amazon’s cloud storage service, found cybersecurity researcher Jeremiah Fowler.

Fowler discovered an unencrypted and publicly accessible Amazon S3 bucket containing 378 gigabytes of internal backup files in May that contained 14 files in .gz, .sql and .twbx formats. The files belonged to Navy Federal Credit Union, which serves U.S. military members, veterans and their families.

The exposed backup included user names, email addresses, hashed passwords, keys and what appeared to be internal system data such as business logic, codes, optimization processes and financial performance metrics. Fowler said he did not see any member data in plain text. The internal records could provide attackers with a roadmap for phishing or social engineering attempts, or insights into the credit union’s network and operations.

Silver Fox APT Abuses Windows Driver in Active Campaign www.databreachtoday.com/silver-fo…

A Chinese nation-state cyber group is exploiting a Microsoft-signed driver to shut down Windows security protections.

Researchers at Check Point said the threat actor tracked as Silver Fox is abusing amsdk.sys, a WatchDog anti-malware driver, to terminate protected processes on Windows 10 and 11. The driver, version 1.0.600, is not on Microsoft’s official Vulnerable Driver Blocklist and was not catalogued by community trackers such as LOLDrivers, a volunteer effort to catalog vulnerable, malicious and known malicious Windows drivers. That blind spot allowed the group to exploit it without raising alerts.

The attackers deployed the driver through a custom loader that also contained a vulnerable driver for Zemana antrivirus software and a ValleyRAT downloader. Researchers said the loader runs checks for virtual machines and sandboxes before execution. If those checks pass, the loader installs the WatchDog driver and disables Windows protections such as protected process light, or PPL.

Hackers Grab $130M Using Brazil’s Real-Time Payment System www.databreachtoday.com/hackers-g…

Attackers stole $130 million from Brazil’s real-time payment system on Friday by wielding valid credentials for an IT service provider.

The unauthorized transfer of funds, some of which have been recovered, involved unauthorized access to an IT environment operated by financial technology provider Sinqia, a Brazilian subsidiary of publicly traded Evertec. Based in Sao Paulo, Brazil, Sinqia provides a platform used by 24 banks to connect to the Brazilian Central Bank’s real-time payment system, called Pix.

Preliminary results from an ongoing digital forensic investigation into the attack “indicate that the unauthorized transactions were introduced into Sinqia’s Pix environment by exploiting legitimate Sinqia IT vendors' credentials,” Evertec disclosed to investors.

WordPress Woes Continue Amid ClickFix Attacks, TDS Threats www.darkreading.com/vulnerabi…

WordPress sites have long been frequent targets for cybercriminals, and recent campaigns show the wave of threats has yet to ebb.

In recent weeks, different organizations have flagged malicious activity and vulnerabilities affecting the popular content management platform, once again illustrating its appeal to a wide range of threat actors.

WhatsApp Bug Anchors Targeted Zero-Click iPhone Attacks www.darkreading.com/cyberatta…

Attackers are exploiting a WhatsApp security vulnerability affecting iPhone iOS in a “sophisticated” zero-click attack against targeted Apple users. The campaign also uses a previously discovered and patched iOS flaw, CVE-2025-43300, known to be used in other attacks. The incidents, which have affected about 200 people so far, have spurred the US government to urge users across its federal workforce to update their devices immediately.

The new bug (CVE-2025-55177, CVSS 5.4) affects Meta’s WhatsApp chat application and could “allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device,” according to an advisory posted Tuesday by the Cybersecurity and Infrastructure and Security Agency (CISA). The flaw, characterized in an advisory by WhatsApp as an “incomplete authorization of linked device synchronization messages” issue, affects iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78.

Critical Start’s Cyber Research Unit (CRU) has released its H1 2025 Cyber Threat Intelligence Report, providing an in-depth look at the rapidly evolving global cyber threat landscape. The report highlights that Banking and Finance has overtaken Manufacturing as the most targeted sector, followed by Business Services, Retail, and Healthcare. These industries face heightened risks due to sensitive data, legacy systems, and reliance on third-party platforms. It also notes a growing concentration of ransomware activity among five major groups — Clop, Akira, Qilin, RansomHub, and Play — which now account for over 43% of tracked incidents. These groups use sophisticated, multi-stage attacks combining data theft, extortion, and repeated targeting of victims, creating significant operational and financial disruption. The report emphasizes that credential-based threats have now surpassed phishing as the primary attack vector, with techniques like Valid Accounts and Password Spraying becoming increasingly dominant. Emerging risks include the use of generative AI to automate phishing and accelerate software supply chain attacks, the exploitation of communication platforms such as Microsoft Teams and WhatsApp for phishing and impersonation, and state-sponsored cyber warfare targeting critical infrastructure and operational technology systems. Critical Start advises organizations to focus on strengthening identity security, leveraging AI-powered detection systems, enhancing ransomware response strategies, securing operational technology environments, and hardening software supply chains to build resilience against today’s most advanced cyber threats.

security.criticalstart.com/rs/586-OQ…

Cloudflare Confirms Data Breach Linked to Salesforce and Salesloft Drift

Cloudflare confirmed a data breach exposing customer support case data through the Salesloft Drift supply chain attack that exploited Salesforce integrations at hundreds of companies worldwide. Attackers gained access to Cloudflare’s Salesforce environment using stolen OAuth tokens from the Salesloft Drift chatbot integration, spending nearly a week conducting reconnaissance before exfiltrating support ticket data via Salesforce Bulk API in August 2025. The compromised data included customer contact details, support correspondence, and sensitive information like logs, configuration details, and credentials shared during troubleshooting, with Cloudflare finding 104 valid API tokens that were immediately rotated. This incident affected numerous major companies including Palo Alto Networks, Zscaler, PagerDuty, TransUnion (4.4 million customers), Google, Allianz Life, Farmers Insurance, and others, highlighting widespread vulnerabilities in third-party SaaS integrations. Cloudflare responded by severing the compromised integration, purging Salesloft software, implementing stricter third-party controls, and receiving praise from security experts for its transparent disclosure and accountability in handling the supply chain compromise.​​​​​​​​​​​​​​​​

Misconfigured Server Leaks 378GB of Navy Federal Credit Union Files

A misconfigured server exposed 378GB of internal Navy Federal Credit Union files, including operational data from Tableau, but no customer information. The exposed files contained potentially sensitive information, such as internal user names, email addresses, and possibly hashed passwords and keys. While no customer data was directly exposed, the security lapse still presents a serious risk.

Drift tool taken offline after hundreds were hacked​ | Cybernews

Salesloft has taken its Drift AI chatbot offline after hackers exploited compromised access tokens to breach Salesforce instances. The breach, affecting companies like Google and Cloudflare, involved the theft of credentials and customer data.

Palo Alto Networks data breach exposes customer info, support cases www.bleepingcomputer.com/news/secu…

Palo Alto Networks suffered a data breach that exposed customer data and support cases after attackers abused compromised OAuth tokens from the Salesloft Drift breach to access its Salesforce instance.

The company states that it was one of hundreds of companies affected by a supply-chain attack disclosed last week, in which threat actors abused the stolen authentication tokens to exfiltrate data.

No, Google did not warn 2.5 billion Gmail users to reset passwords www.bleepingcomputer.com/news/tech…

Google has disputed a widely reported story about the company warning all Gmail users to reset their passwords due to a recent data breach that also affected some Workspace accounts.

This claim was covered by numerous news outlets, as well as cybersecurity firms, which published stories about the so-called “urgent warning” asking 2.5 billion Gmail users worldwide to enable two-step authentication and reset their passwords.

However, as the company explained on a Monday blog post addressing these inaccurate stories, “Gmail’s protections are strong and effective, and claims of a major Gmail security warning are false.

Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps www.bleepingcomputer.com/news/secu…

Internet infrastructure company Cloudflare said it recently blocked the largest recorded volumetric distributed denial-of-service (DDoS) attack, which peaked at 11.5 terabits per second (Tbps).

In volumetric DDoS attacks, attackers overwhelm the target with massive amounts of data, consuming the bandwidth or exhausting system resources, leaving legitimate users with no access to the targeted servers and services.

“Cloudflare’s defenses have been working overtime. Over the past few weeks, we’ve autonomously blocked hundreds of hyper-volumetric DDoS attacks, with the largest reaching peaks of 5.1 Bpps and 11.5 Tbps,” the company said in a Tuesday tweet.

“The 11.5 Tbps attack was a UDP flood that mainly came from Google Cloud,” it stated, while showing in an attached image that the attack only lasted approximately 35 seconds.

This comes two months after Cloudflare announced another record-breaking 7.3 Tbps DDoS attack targeting an unnamed hosting provider in June. The previous record was of 3.8 Tbps and two billion packets per second (pps) in an attack that Cloudflare also blocked in October 2024.

Zscaler Confirms Limited Data Exposure Linked to Third-Party App

Zscaler disclosed a security incident involving Salesloft Drift, a marketing automation service, which led to the exposure of business contact details and Salesforce data. Zscaler revoked Salesloft Drift’s access, rotated API tokens, and launched an investigation. Customers are advised to remain vigilant against phishing attempts and verify the source of unsolicited communications.

Silver Fox APT Exploits Signed Windows Driver to Deliver ValleyRAT

Silver Fox APT is exploiting a signed but vulnerable WatchDog driver to disable Windows security and deliver ValleyRAT malware. The driver, amsdk.sys version 1.0.600, allows attackers to terminate security processes and install the malware, even after a patch was released. This campaign highlights the risks of trusting signed drivers without additional security checks.