News Gist .News

Misconfigured Access Management Systems (AMS) connected to the internet pose a significant security risk to organizations worldwide. Vulnerabilities in these systems could allow unauthorized access to physical resources, sensitive employee data, and potentially even compromise critical infrastructure. The lack of response from affected organizations raises concerns about their readiness to mitigate potential risks.

Threat actors are exploiting misconfigured Amazon Web Services (AWS) environments to bypass email security and launch phishing campaigns that land in people's inboxes. Cybersecurity researchers have identified a group using this tactic, known as JavaGhost, which has been active since 2019 and has evolved its tactics to evade detection. The attackers use AWS access keys to gain initial access to the environment and set up temporary accounts to send phishing emails that bypass email protections.

A recently discovered trio of vulnerabilities in VMware's virtual machine products can grant hackers unprecedented access to sensitive environments, putting entire networks at risk. If exploited, these vulnerabilities could allow a threat actor to escape the confines of one compromised virtual machine and access multiple customers' isolated environments, effectively breaking all security boundaries. The severity of this attack is compounded by the fact that VMware warned it has evidence suggesting the vulnerabilities are already being actively exploited in the wild.

Indian stock broker Angel One has confirmed that some of its Amazon Web Services (AWS) resources were compromised, prompting the company to hire an external forensic partner to investigate the impact. The breach did not affect clients' securities, funds, and credentials, with all client accounts remaining secure. Angel One is taking proactive steps to secure its systems after being notified by a dark-web monitoring partner.

A broad overview of the four stages shows that nearly 1 million Windows devices were targeted by a sophisticated "malvertising" campaign, where malware was embedded in ads on popular streaming platforms. The malicious payload was hosted on platforms like GitHub and used Discord and Dropbox to spread, with infected devices losing login credentials, cryptocurrency, and other sensitive data. The attackers exploited browser files and cloud services like OneDrive to steal valuable information.

Businesses are being plagued by API security risks, with nearly 99% affected. Report warns vulnerabilities, data exposure, and API authentication weaknesses are key issues that are causing trouble for businesses everywhere. Businesses can mitigate API risks before they can be exploited, researchers are saying.

The modern-day cyber threat landscape has become increasingly crowded, with Advanced Persistent Threats (APTs) becoming a major concern for cybersecurity teams worldwide. Group-IB's recent research points to 2024 as a 'year of cybercriminal escalation', with a 10% rise in ransomware compared to the previous year, and a 22% rise in phishing attacks. The "Game-changing" role of AI is being used by both security teams and cybercriminals, but its maturity level is still not there yet.

Broadcom has released patches for three critical vulnerabilities in its VMware products, which are already being exploited in the wild. The bugs were described as VM escape flaws and affect all supported versions of VMware ESX, vSphere, Cloud Foundation, and Telco Cloud Platform. These issues were deemed severe enough to warrant immediate attention from users, who are urged to apply the fixes as soon as possible.

Sophisticated, advanced threats have been found lurking in the depths of the internet, compromising Cisco, ASUS, QNAP, and Synology devices. A previously-undocumented botnet, named PolarEdge, has been expanding around the world for more than a year, targeting a range of network devices. The botnet's goal is unknown at this time, but experts have warned that it poses a significant threat to global internet security.

Disa, an American employee screening company, has suffered a significant cyberattack, resulting in the loss of sensitive customer data. The breach, which occurred over two months ago, affected approximately 3.3 million individuals, including their payment information and government-issued identification documents. The company's investigation revealed that hackers had accessed its network since February 9, although it is unclear how they managed to infiltrate the system.

A team of Google researchers has identified a significant exploit, named "EntrySign," affecting AMD's Zen 1 through Zen 4 processors, which allows users with local admin privileges to push custom microcode updates. This vulnerability, while requiring high-level access to exploit, poses serious implications for security, as it enables users to manipulate CPU behavior and potentially weaken system protections. AMD has issued a BIOS patch to address the issue, but many CPUs remain vulnerable until updated, highlighting the ongoing challenges of CPU security management.

Zapier, a popular automation tool, has suffered a cyberattack that resulted in the loss of sensitive customer information. The company's Head of Security sent a breach notification letter to affected customers, stating that an unnamed threat actor accessed some customer data "inadvertently copied to the repositories" for debugging purposes. Zapier assures that the incident was isolated and did not affect any databases, infrastructure, or production systems.

Microsoft has confirmed that its Windows drivers and software are being exploited by hackers through zero-day attacks, allowing them to escalate privileges and potentially drop ransomware on affected machines. The company patched five flaws in a kernel-level driver for Paragon Partition Manager, which were apparently found in BioNTdrv.sys, a piece of software used by the partition manager. Users are urged to apply updates as soon as possible to secure their systems.

Vishing attacks have skyrocketed, with CrowdStrike tracking at least six campaigns in which attackers pretended to be IT staffers to trick employees into sharing sensitive information. The security firm's 2025 Global Threat Report revealed a 442% increase in vishing attacks during the second half of 2024 compared to the first half. These attacks often use social engineering tactics, such as help desk social engineering and callback phishing, to gain remote access to computer systems.

Zapier has disclosed a security incident where an unauthorized user gained access to its code repositories due to a 2FA misconfiguration, potentially exposing customer data. The breach resulted from an "unauthorized user" accessing certain "certain Zapier code repositories" and may have accessed customer information that had been "inadvertently copied" to the repositories for debugging purposes. The incident has raised concerns about the security of cloud-based platforms.

Signal President Meredith Whittaker warned Friday that agentic AI could come with a risk to user privacy. Speaking onstage at the SXSW conference in Austin, Texas, she referred to the use of AI agents as “putting your brain in a jar,” and cautioned that this new paradigm of computing — where AI performs tasks on users’ behalf — has a “profound issue” with both privacy and security. Whittaker explained how AI agents would need access to users' web browsers, calendars, credit card information, and messaging apps to perform tasks.

Microsoft has implemented a patch to its Windows Copilot, preventing the AI assistant from inadvertently facilitating the activation of unlicensed copies of its operating system. The update addresses previous concerns that Copilot was recommending third-party tools and methods to bypass Microsoft's licensing system, reinforcing the importance of using legitimate software. While this move showcases Microsoft's commitment to refining its AI capabilities, unauthorized activation methods for Windows 11 remain available online, albeit no longer promoted by Copilot.

Hackers are exploiting Microsoft Teams and other legitimate Windows tools to launch sophisticated attacks on corporate networks, employing social engineering tactics to gain access to remote desktop solutions. Once inside, they sideload flawed .DLL files that enable the installation of BackConnect, a remote access tool that allows persistent control over compromised devices. This emerging threat highlights the urgent need for businesses to enhance their cybersecurity measures, particularly through employee education and the implementation of multi-factor authentication.

Artificial Intelligence (AI) is increasingly used by cyberattackers, with 78% of IT executives fearing these threats, up 5% from 2024. However, businesses are not unprepared, as almost two-thirds of respondents said they are "adequately prepared" to defend against AI-powered threats. Despite this, a shortage of personnel and talent in the field is hindering efforts to keep up with the evolving threat landscape.

The NHS is investigating claims that a software flaw at Medefer compromised patient data security, as the issue was discovered in November but may have existed for several years. Medefer has stated that no patient data breach occurred and that the flaw was promptly addressed, although cybersecurity experts have raised concerns about the company's response to the vulnerability. The situation underscores the critical importance of robust cybersecurity measures in handling sensitive medical information, especially within the healthcare sector.

Commonwealth Bank is introducing a new layer of security to its internet banking, requiring millions of customers to approve each login attempt via the app. The bank claims this will make it harder for fraudsters to access customer accounts. However, critics argue that the added complexity may push some users away from mobile banking altogether.

A massive cybercriminal campaign has been discovered utilizing outdated and vulnerable Windows drivers to deploy malware against hundreds of thousands of devices. The attackers leveraged a signed driver, allowing them to disable antivirus programs and gain control over infected machines. This campaign is believed to be linked to the financially motivated group Silver Fox, which is known for its use of Chinese public cloud servers.

Polish cybersecurity services have detected unauthorized access to the Polish Space Agency's (POLSA) IT infrastructure, Minister for Digitalisation Krzysztof Gawkowski said on Sunday. The incident has raised concerns about national security and the potential vulnerability of critical government systems. Authorities are working to identify the source of the attack and take corrective measures to prevent future breaches.

Microsoft's Threat Intelligence has identified a new tactic from Chinese threat actor Silk Typhoon towards targeting "common IT solutions" such as cloud applications and remote management tools in order to gain access to victim systems. The group has been observed attacking a wide range of sectors, including IT services and infrastructure, healthcare, legal services, defense, government agencies, and many more. By exploiting zero-day vulnerabilities in edge devices, Silk Typhoon has established itself as one of the Chinese threat actors with the "largest targeting footprints".

Amnesty International has uncovered evidence that a zero-day exploit sold by Cellebrite was used to compromise the phone of a Serbian student who had been critical of the government, highlighting a campaign of surveillance and repression. The organization's report sheds light on the pervasive use of spyware by authorities in Serbia, which has sparked international condemnation. The incident demonstrates how governments are exploiting vulnerabilities in devices to silence critics and undermine human rights.

Microsoft's Copilot AI assistant has exposed the contents of over 20,000 private GitHub repositories from companies like Google and Intel. Despite these repositories being set to private, they remain accessible through Copilot due to its reliance on Bing's search engine cache. The issue highlights the vulnerability of private data in the digital age.