Security. In focus.

Hype Alert: ‘The Largest Data Breach in History’ That Wasn’t

A recent report claimed a data breach of 16 billion stolen login credentials, but experts question its legitimacy. The data is likely a combination of outdated infostealer credentials, database leaks, and fabricated information. While the infostealer threat is real, the size and freshness of this particular breach are exaggerated.

Banana Squad Hides Data-Stealing Malware in Fake GitHub Repositories hackread.com/banana-sq…

Banana Squad hid data-stealing malware in fake GitHub repos posing as Python tools, tricking users and targeting sensitive info like browser and wallet data.

Telecom giant Viasat breached by China’s Salt Typhoon hackers www.bleepingcomputer.com/news/secu…

Satellite communications company Viasat is the latest victim of China’s Salt Typhoon cyber-espionage group, which has previously hacked into the networks of multiple other telecom providers in the United States and worldwide.

The company discovered the Salt Typhoon breach earlier this year and has been working with federal authorities to investigate the attack, as Bloomberg first reported.

Israel-tied Predatory Sparrow hackers are waging cyberwar on Iran’s financial system arstechnica.com/informati…

The Israel-linked hacker group known as Predatory Sparrow has carried out some of the most disruptive and destructive cyberattacks in history, twice disabling thousands of gas station payment systems across Iran and once even setting a steel mill in the country on fire. Now, in the midst of a new war unfolding between the two countries, they appear to be bent on burning Iran’s financial system.

Takeover of British Russia expert’s email accounts used novel phishing tactic therecord.media/keir-gile…

Email accounts belonging to a well-known British expert on Russia were targeted with a highly customized and novel social engineering attack that relied on the use of app-specific passwords (ASPs) to get around multi-factor authentication (MFA), new research shows.

Google detected the hack, which was likely executed by a Russian state-sponsored group, according to a report published Wednesday by the company’s Threat Intelligence Group (GTIG).

The Citizen Lab, a digital forensic research organization, released its own report Wednesday summarizing Google’s findings and providing more details on the attack and how such tactics are deployed broadly.

VMware security advisory (AV25-357) - Canadian Centre for Cyber Security

VMware released security advisories on June 18, 2025, addressing vulnerabilities in several Tanzu products. The Cyber Centre recommends reviewing the advisories and applying the suggested mitigations.

Paragon Commercial Spyware Infects Prominent Journalists

Two European journalists were targeted by Paragon Solutions’ Graphite spyware, according to a Citizen Lab report. The spyware, which exploits a zero-click iOS vulnerability, was used to compromise the journalists’ devices, highlighting the ongoing threat of commercial spyware to privacy and security.

Defending the Internet: how Cloudflare blocked a monumental 7.3 Tbps DDoS attack

In May 2025, Cloudflare successfully blocked a 7.3 Tbps DDoS attack targeting a hosting provider. The attack, originating from over 122,000 IP addresses across 161 countries, utilized multiple vectors including UDP floods and reflection attacks. Cloudflare’s global anycast network distributed the attack traffic, enabling effective mitigation.

Over Two Thirds of MSPs Hit by Multiple Breaches in Past Year, Survey Reveals - IT Security Guru

The second annual CyberSmart MSP Survey reveals that 69% of MSP leaders globally experienced multiple breaches in the past year, despite high confidence in their cybersecurity posture. The survey, which included insights from 900 MSP leaders across eight countries, highlights a disconnect between perceived readiness and actual resilience to cyber threats. MSPs also reported high confidence in their customers’ cybersecurity awareness, with 93% feeling confident in their customers’ overall cyber posture.

Serpentine#Cloud Uses Cloudflare Tunnels in Sneak Attacks www.darkreading.com/cloud-sec…

Threat actors are using .lnk shortcut files to deliver remote payloads in a sophisticated campaign, according to research security vendor Securonix published today.

In this malware campaign, tracked as “Serpentine#Cloud,” the attacker leverages “Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts,” the researchers explained.

ChainLink Phishing: How Trusted Domains Become Threat Vectors www.bleepingcomputer.com/news/secu…

Traditional phishing relied on easily identifiable red flags such as suspicious senders and questionable URLs. But modern phishing has matured.

Attackers now deploy chained sequences, funneling a victim from email through trusted infrastructure before harvesting credentials.

An employee might receive a link from what appears to be Google Drive or Dropbox. At first glance, there’s nothing unusual. But after the initial click, the user is quietly routed through a series of prompts, each looking credible on reputable sites, until they unknowingly hand over business-essential credentials to an attacker.

BeyondTrust warns of pre-auth RCE in Remote Support software www.bleepingcomputer.com/news/secu…

BeyondTrust has released security updates to fix a high-severity flaw in its Remote Support (RS) and Privileged Remote Access (PRA) solutions that can let unauthenticated attackers gain remote code execution on vulnerable servers.

Remote Support is BeyondTrust’s enterprise-grade remote support solution that helps IT support teams troubleshoot issues by remotely connecting to systems and devices, while Privileged Remote Access acts as a secure gateway and ensures that users can only access the specific systems and resources they’re authorized to use.

Tracked as CVE-2025-5309, this Server-Side Template Injection vulnerability was discovered by Jorren Geurts of Resillion in the chat feature of BeyondTrust RS/PRA.

New Linux udisks flaw lets attackers get root on major Linux distros www.bleepingcomputer.com/news/linu…

Attackers can exploit two newly discovered local privilege escalation (LPE) vulnerabilities to gain root privileges on systems running major Linux distributions.

The first flaw (tracked as CVE-2025-6018) was found in the configuration of the Pluggable Authentication Modules (PAM) framework on openSUSE Leap 15 and SUSE Linux Enterprise 15, allowing local attackers to gain the privileges of the “allow_active” user.

The other security bug (CVE-2025-6019) was discovered in libblockdev, and it enables an “allow_active” user to gain root permissions via the udisks daemon (a storage management service that runs by default on most Linux distributions).

While successfully abusing the two flaws as part of a “local-to-root” chain exploit can let attackers quickly gain root and completely take over a SUSE system, the libblockdev/udisks flaw is also extremely dangerous on its own.

Scammers hijack websites of Bank of America, Netflix, Microsoft, and more to insert fake phone number www.malwarebytes.com/blog/news…

Cybercriminals frequently use fake search engine listings to take advantage of our trust in popular brands, and then scam us. It often starts, as with so many attacks, with a sponsored search result on Google.

In the latest example of this type of scam, Malwarebytes found tech support scammers hijacking the results of people looking for 24/7 support for Apple, Bank of America, Facebook, HP, Microsoft, Netflix, and PayPal.

Famous Chollima deploying Python version of GolangGhost RAT blog.talosintelligence.com/python-ve…

In May 2025, Cisco Talos identified a Python-based remote access trojan (RAT) we call “PylangGhost,” used exclusively by a North Korean-aligned threat actor. PylangGhost is functionally similar to the previously documented GolangGhost RAT, sharing many of the same capabilities.

In recent campaigns, the threat actor Famous Chollima — potentially made up of multiple groups — has been using a Python-based version of their trojan to target Windows systems, while continuing to deploy a Golang-based version for MacOS users. Linux users are not targeted in these latest campaigns.

The attacks are targeting employees with experience in cryptocurrency and blockchain technologies.

Based on open-source intelligence, only a small number of users, predominantly in India, are affected. Cisco product telemetry does not indicate that there are any affected Cisco users.

Fake Minecraft mods distributed by the Stargazers Ghost Network to steal gamers’ data research.checkpoint.com/2025/mine…

Check Point Research discovered a multistage campaign targeting Minecraft users via the distribution as a service (DaaS) Stargazers Ghost Network, which operates on GitHub. The malware impersonates, among others, Oringo and Taunahi, which are “Scripts & Macro” tools (a.k.a cheats).

The first-stage downloader and the second-stage stealer are implemented in Java and require Minecraft to be installed on the host. The third and last stage malware is a .NET stealer with extended capabilities.

Minecraft malware is written in Java, which is often overlooked by security solutions. The malware is developed by a Russian-speaking threat actor and contains several artifacts written in the Russian language.

New Campaigns Distribute Malware via Open Source Hacking Tools - SecurityWeek

Two new campaigns were uncovered distributing malware through trojanized open source hacking tools on GitHub. The campaigns, attributed to threat actors Water Curse and Banana Squad, targeted red teams, cybercriminals, and developers, stealing credentials and providing remote access to compromised systems.

Iran-Israel War Triggers a Maelstrom in Cyberspace

Iran and Israel are engaged in a cyber war, with Iran restricting internet and phone connectivity for its citizens. Hacktivists are attacking both countries, with Israel facing a higher volume of attacks, though of lesser sophistication. The conflict has also extended to neighboring countries, with Jordan being a frequent target due to its perceived neutrality.

A New Breed Of Mobile Threat: GodFather Malware Goes Virtual

A new variant of GodFather malware uses on-device virtualization to hijack banking and crypto apps, creating a virtual environment that mimics the real app. This allows attackers to intercept credentials and bypass security checks, posing a significant threat to financial institutions and users. The technique, currently targeting Turkish financial institutions, highlights the need for robust security strategies to protect against sophisticated client-side breaches.

Hackers Claim Leak Of 64 Million T-Mobile Records, But Company Denies Breach

Hackers claim to have leaked 64 million T-Mobile customer records, including names, birthdates, and financial information. T-Mobile denies the breach, stating the data does not relate to them or their customers. Researchers are unable to verify the claims, leaving customers uncertain about potential risks and the need for protective measures

CVE-2025-3248 in Langflow Exploited to Deploy Flodrix Botnet - SOCRadar® Cyber Intelligence Inc.

Threat actors are exploiting CVE-2025-3248, a critical RCE vulnerability in Langflow, to deploy the Flodrix botnet. The botnet, a variant of LeetHozer, enables DDoS attacks, self-destruction, and anti-forensics capabilities. Organizations should upgrade to Langflow 1.3.0 or newer, configure private networks, and monitor for suspicious activity to mitigate the risk.

Russian APT29 Exploits Gmail App Passwords to Bypass 2FA in Targeted Phishing Campaign

Threat actors suspected to be Russian are using a novel social engineering tactic to gain access to victims’ emails. The tactic involves impersonating the U.S. Department of State and convincing targets to set up application-specific passwords, which are then used to establish persistent access to the victim’s mailbox. The attacks are meticulously planned and executed, often spanning several weeks to build rapport with the targets.

Security’s Blind Spot: Shadow AI Creeps Into The SOC

A Mindgard survey of 500 cybersecurity professionals reveals a concerning trend: 56% of organizations use AI without formal approval, and 87% of security professionals use AI in their daily work. This “Shadow AI” poses significant risks, including data exposure and lack of accountability, as only 32% of organizations have formal policies in place. The rapid adoption of AI outpaces governance, highlighting the need for clear ownership and oversight to mitigate these risks.

High-Severity Vulnerabilities Patched by Cisco, Atlassian - SecurityWeek

Cisco and Atlassian released patches for multiple high-severity vulnerabilities in their products. Cisco addressed a DoS vulnerability in Meraki devices and a DoS bug in ClamAV, while Atlassian patched five vulnerabilities in third-party dependencies across several products. Users are advised to apply the patches promptly.

How CVE-2025-6018 and CVE-2025-6019 Enable Full Root Access on Linux - SOCRadar® Cyber Intelligence Inc.

Two newly discovered Local Privilege Escalation (LPE) vulnerabilities, CVE-2025-6018 and CVE-2025-6019, allow attackers to gain full root control on several Linux distributions. CVE-2025-6018 enables attackers to manipulate environment variables during login, while CVE-2025-6019 allows attackers to gain root access by abusing how XFS file systems are resized. System administrators should apply vendor patches immediately and take additional security measures to reduce exposure.