Security. In focus.

Microsoft Edge security advisory (AV25-378) - Canadian Centre for Cyber Security

Microsoft published a security update on June 26, 2025, for Microsoft Edge Stable Channel versions prior to 138.0.3351.55. The Cyber Centre recommends reviewing the release notes and applying the update.

VMware security advisory (AV25-379) - Canadian Centre for Cyber Security

VMware published a security advisory on June 26, 2025, addressing a vulnerability in RabbitMQ versions 3.13.7 and prior. Users and administrators are advised to review the provided web links and perform the suggested mitigations.

OneClik APT campaign targets energy sector with stealthy backdoors

A new APT malware campaign, OneClik, targets the energy sector using stealthy ClickOnce and Golang backdoors. The campaign, likely carried out by China-linked actors, abuses Microsoft’s ClickOnce deployment technology and custom Golang backdoors to evade detection. The Golang backdoor, RunnerBeacon, communicates with C2 servers via AWS services, making detection challenging.

In Other News: Norway Dam Hacked, $177M Data Breach Settlement, UNFI Attack Update - SecurityWeek

This week’s cybersecurity news highlights a $177 million data breach settlement by AT&T, the restoration of systems at United Natural Foods after a cyberattack, and a ban on WhatsApp use by the US House of Representatives. The FDA released a whitepaper on securing medical product manufacturing OT, and vulnerabilities were disclosed in SAP GUI client. Interpol warned of a surge in cybercrime in Africa, while Forescout’s report showed concerns about industrial cybersecurity. A ransomware attack in the UK contributed to a patient’s death, and Norway’s Lake Risevatnet dam was hacked, though no significant harm occurred. Nova Scotia Power provided an update on its recent cyberattack, disclosing the compromise of customer information.

Some Brother printers have a remote code execution vulnerability, and they can’t fix it | CSO Online

A critical authentication bypass vulnerability affecting hundreds of Brother printer models allows unauthenticated remote code execution when chained with another flaw. The vulnerability, stemming from a manufacturing issue, cannot be fixed through firmware updates. Users are advised to replace their printers with new models without the manufacturing flaw.

Fake DocuSign email hides tricky phishing attempt | Malwarebytes

A cybersecurity researcher encountered a sophisticated phishing attack disguised as a DocuSign notification that passed email authentication checks and used a legitimate Webflow preview URL to avoid detection. The multi-layered attack included a fake DocuSign interface, a suspicious randomized domain, and a deliberately simple CAPTCHA before redirecting victims to Google’s actual login page to create legitimacy. Rather than deploying immediate malware, the attack conducted data reconnaissance by fingerprinting browser metadata and system information to profile targets for future attacks, making it particularly dangerous as victims may not realize they’ve been compromised. The researcher recommends avoiding unsolicited email links, verifying requests through separate channels, and using active anti-malware solutions.​​​​​​​​​​​​​​​​

The Good, the Bad and the Ugly in Cybersecurity – Week 26

A British national, Kai West, was charged by U.S. authorities for orchestrating cyberattacks resulting in $25 million in damages. APT28, a Russian-based state-sponsored group, used Signal to distribute malware to Ukrainian government entities. Salt Typhoon, a China-linked threat group, breached a Canadian telecom firm by exploiting a Cisco IOS XE vulnerability, highlighting the ongoing threat to critical infrastructure.

MongoDB security advisory (AV25-380) - Canadian Centre for Cyber Security

MongoDB published a security advisory on June 26, 2025, addressing a vulnerability in MongoDB Server v6.0, v7.0, and v8.0. The Cyber Centre recommends reviewing the advisory and applying necessary updates.

Malicious AI Models Are Behind a New Wave of Cybercrime, Cisco Talos

Cisco Talos reports a rise in cybercriminals using Large Language Models (LLMs) to enhance their illicit activities. These models, designed with safety features, are being manipulated to generate malware, phishing scams, and other harmful content. The dark web is a marketplace for these malicious LLMs, with some criminals even scamming potential buyers.

FBI Warns of Scattered Spider’s Expanding Attacks on Airlines Using Social Engineering

The FBI has issued a warning that the notorious cybercrime group Scattered Spider is expanding its operations to target the airline industry, using sophisticated social engineering techniques to bypass security measures. The group typically impersonates employees or contractors to deceive IT help desks into granting unauthorized access, often convincing staff to add rogue multi-factor authentication devices to compromised accounts or reset passwords. Security firms including Palo Alto Networks’ Unit 42 and Google’s Mandiant have confirmed multiple incidents in aviation and transportation sectors, with Scattered Spider also known to target third-party IT providers to gain access to larger organizations. A recent ReliaQuest report detailed how the group successfully breached an organization by targeting its CFO through extensive reconnaissance and social engineering, ultimately gaining access to over 1,400 secrets from a CyberArk password vault and engaging in destructive activities when detected. The group, which overlaps with threat clusters like Muddled Libra and Octo Tempest, represents an evolution in ransomware risk by combining deep social engineering with technical sophistication, highlighting the critical need for organizations to strengthen identity verification protocols and reduce reliance on human-centric workflows that can be manipulated by attackers.​​​​​​​​​​​​​​​​

Misconfigured AI Servers Expose Data, Systems

Cybersecurity researchers have discovered that hundreds of Model Context Protocol (MCP) servers are misconfigured and publicly accessible, creating significant security vulnerabilities for AI applications. Despite the protocol only launching in November, over 15,000 MCP servers are already deployed globally, with approximately 7,000 exposed to the public internet and around 70 containing critical security flaws. These servers, which connect AI models to sensitive organizational data beyond their training sets, suffer from issues including path traversal vulnerabilities, inadequate input sanitization, and “neighbourjacking” scenarios where unauthenticated devices on local networks can gain access. Backslash Security researchers found that some servers accept any input and execute it as shell commands, potentially allowing attackers to achieve full system takeover, delete data, or conduct context poisoning attacks that manipulate AI model outputs. The security firm attributes these widespread misconfigurations to the technology’s novelty and teams implementing MCP servers quickly without fully understanding the security implications, recommending organizations implement strict API access controls, verify data origins, and ensure only approved language models are connected.​​​​​​​​​​​​​​​​

Berlin Regulator Orders Apple, Google to Remove DeepSeek

A German data protection regulator has ordered Apple and Google to remove the Chinese AI app DeepSeek from their app stores, citing violations of European privacy and digital service regulations. The Berlin Commissioner for Data Protection classified DeepSeek as “illegal content” due to concerns that Chinese authorities have extensive access rights to personal data, while users lack enforceable privacy protections available in the EU. DeepSeek’s parent company, Hangzhou DeepSeek Artificial Intelligence, collects and transfers user data including chat histories and location information to servers in China, which regulators argue violates EU data transfer laws since China lacks adequate privacy protections. This action follows similar measures by Italy, which banned the app in January, and reflects broader concerns among Asian governments about DeepSeek’s data practices, despite the company’s claims that its R1 reasoning model was developed at significantly lower costs than American competitors like ChatGPT.​​​​​​​​​​​​​​​​

Threat Spotlight: CVE-2025-5777: Citrix Bleed 2 Opens Old Wounds - ReliaQuest

Citrix has issued urgent guidance addressing CVE-2025-5777—a critical vulnerability in NetScaler ADC and Gateway devices that enables attackers to bypass multifactor authentication and hijack active sessions. Although public proof of exploitation is not yet available, ReliaQuest reports credible indicators of active exploitation, including session reuse and domain reconnaissance. Dubbed “Citrix Bleed 2” due to its similarity to the devastating 2023 flaw, this new vulnerability exposes authentication tokens via out-of-bounds memory reads, allowing persistent unauthorized access. Citrix urges immediate patching and active session termination, especially as older versions (12.1 and 13.0) have reached end-of-life.

Copyright Cases Should Not Threaten Chatbot Users’ Privacy | Electronic Frontier Foundation

A recent U.S. court order requires OpenAI to indefinitely retain all ChatGPT user conversations—even if users attempt to delete them—undermining global privacy norms. This sweeping directive, part of a copyright lawsuit, overrides privacy laws in 19 U.S. states, the EU, and other countries that protect individuals’ right to delete their data. With over 300 million users generating more than a billion daily messages—many containing deeply personal or sensitive content—the ruling sets a troubling precedent. The Electronic Frontier Foundation (EFF) warns this could chill legitimate uses of generative AI and calls for the order to be overturned. OpenAI is actively challenging the decision.

AI Evasion: The Next Frontier of Malware Techniques blog.checkpoint.com/artificia…

Check Point Research identifies the first documented case of malware embedding prompt injection to evade AI detection.

Sextortion email scammers increase their “Hello pervert” money demands www.malwarebytes.com/blog/news…

Every so often the sextortion emails that start with “Hello pervert” get a redesign.

We know these emails are a big problem. We see thousands of people visiting our website a week looking to find information on sextortion emails like these. And now we’re seeing a new version with some features we haven’t seen in the past.

This most recent email we’ve seen also gives away the probable origin of the emails.

With all that we thought it would be interesting to take a closer look.

Ransomware attack contributed to patient’s death, says Britain’s NHS therecord.media/ransomwar…

A ransomware attack that disrupted blood testing across several hospitals in London last year contributed to a patient’s death, according to the National Health Service (NHS).

The attack by the Qilin cybercrime group against London-based pathology service Synnovis last June severely disrupted care at a large number of NHS hospitals and care providers in London.

Iranian Educated Manticore Targets Leading Tech Academics research.checkpoint.com/2025/iran…

Amid ongoing tensions between Iran and Israel, the Iranian threat group Educated Manticore, associated with the Islamic Revolutionary Guard Corps, has launched spear-phishing campaigns targeting Israeli journalists, high-profile cyber security experts and computer science professors from leading Israeli universities.

For the last few years, Check Point Research has been monitoring the activity of the Iranian APT group, Educated Manticore. This group aligns with activity tracked by the wider security community as APT42, Charming Kitten, or Mint Sandstorm, and is believed to operate on behalf of the Islamic Revolutionary Guard Corps’ Intelligence Organization (IRGC-IO).

China-Nexus ‘LapDogs’ Network Thrives on Backdoored SOHO Devices www.darkreading.com/threat-in…

Researchers have discovered yet another network of operational relay boxes (ORBs) controlled by suspected Chinese nation-state actors for cyber-espionage purposes.

According to SecurityScorecard’s STRIKE research team, the ORB network, nicknamed “LapDogs,” has infected more than 1,000 nodes with a custom backdoor against “highly localized targets” in the US as well as Japan, South Korea, Hong Kong, and Taiwan. The researchers attributed the network to China-nexus actors with moderate confidence and noted similarities between LapDogs and other Chinese state-sponsored ORB networks.

Is my phone infected with spyware? How to tell www.pandasecurity.com/en/mediac…

Holding personal data, conversations, and sensitive information, our smartphones are indispensable. But this also makes them prime targets for spyware and unauthorized monitoring. One report suggests that nearly 3 out of every 1000 smartphones is already infected with malware.

But how can you tell if your phone has been hacked? And what can you do about it? In this article we’ll show you what to look for and how to deal with it.

XOR Marks the Flaw in SAP GUI www.darkreading.com/cloud-sec…

The company has patched two vulnerabilities in its Graphical User Interface that would have allowed attackers to grab data from a user’s input history feature.

SAP is tracking the vulnerabilities as CVE-2025-0056 and CVE-2025-0055 (both CVSS 6.0). The official description of the flaws issued today described them as issues that would allow an attacker with admin-level privileges or access to the victim’s user directory to read data contained in it.

nOAuth Abuse Alert: Full Account Takeover of Entra Cross-Tenant SaaS Applications www.semperis.com/blog/noau…

The nOAuth vulnerability exposes a critical authentication flaw in vulnerable software-as-a-service (SaaS) applications. With only access to an Entra tenant—a low barrier—and the target user’s email address, an attacker can take over that user’s account in the vulnerable application. From there, the attacker can access all the data that the target has access to within that application.

This article details the Semperis Security Research Team’s exploration of nOAuth, focused on applications in the Microsoft Entra App Gallery. We discovered nine vulnerable applications, including those that might hold personally identifiable information (PII).

New ‘CitrixBleed 2’ NetScaler flaw let hackers hijack sessions www.bleepingcomputer.com/news/secu…

A recent vulnerability in Citrix NetScaler ADC and Gateway is dubbed “CitrixBleed 2,” after its similarity to an older exploited flaw that allowed unauthenticated attackers to hijack authentication session cookies from vulnerable devices.

Last week, Citrix published a security bulletin warning about flaws tracked as CVE-2025-5777 and CVE-2025-5349 that impact NetScaler ADC and Gateway versions before 14.1-43.56, releases before 13.1-58.32, and also 13.1-37.235-FIPS/NDcPP and 2.1-55.328-FIPS.

While Citrix has not stated whether these flaws are being actively exploited, they do recommend that admins terminate all active ICA and PCoIP sessions as soon as all appliances have been updated.

In a LinkedIn post, Mandiant CTO Charles Carmakal warns that it is essential to kill sessions after updating devices to prevent previously stolen sessions from being used even after devices are no longer vulnerable.

“Many organizations did not terminate sessions when remediating a similar vulnerability in 2023 (CVE-2023-4966 aka “Citrix Bleed”),” warns Carmakal.

“In those cases, session secrets were stolen before companies patched, and the sessions were hijacked after the patch. Many of those compromises resulted in nation-state espionage or ransomware deployment.”

New wave of ‘fake interviews’ use 35 npm packages to spread malware www.bleepingcomputer.com/news/secu…

A new wave of North Korea’s ‘Contagious Interview’ campaign is targeting job seekers with malicious npm packages that infect dev’s devices with infostealers and backdoors.

The packages were discovered by Socket Threat Research, which reports they load the BeaverTail info-stealer and InvisibleFerret backdoor on victims' machines, two well-documented payloads associated with DPRK actors.

Dire Wolf Strikes: New Ransomware Group Targeting Global Sectors www.trustwave.com/en-us/res…

Dire Wolf is a newly emerged ransomware group first observed in May 2025 and Trustwave SpiderLabs recently uncovered a Dire Wolf ransomware sample that revealed for the first time key details about how the ransomware operates.