Apr 21, 2025

Read in Browser     Subscribe

Share this newsletter!

Welcome, Digital Defenders! 🛡️

I hope you had a chance to recharge, because the cybersecurity front is heating up again. From phone-based malware targeting your crypto to critical flaws in Windows Task Scheduler, the threat landscape is as intense as ever. Let’s dive into the latest alerts and vulnerabilities you need to know about—and don’t forget to weigh in on our poll at the bottom.

Here’s what you need to know:

Zero-Day Download

New Windows Task Scheduler Flaws Allow UAC Bypass and Log Tampering

Researchers at Cymulate have discovered four vulnerabilities in Windows Task Scheduler that could let local attackers bypass User Account Control (UAC), escalate privileges, and erase event logs to hide malicious activity. The flaws, found in the “schtasks.exe” utility, allow attackers to run high-privilege commands without user consent, posing a serious threat to system integrity.

schtasks.exe. Source: file.net.

Users and admins should apply the latest Windows security updates and monitor system logs for suspicious activity.

Node.js Malware Targets Crypto Users with Fake Binance and TradingView Installers

Microsoft is sounding the alarm on a Node.js-based malvertising campaign aimed at cryptocurrency traders.

The campaign delivers malicious payloads through fake Binance and TradingView installers. Once downloaded, the malware gathers system information, establishes persistence via scheduled tasks, and uses PowerShell to bypass security detection while displaying a legitimate cryptocurrency site to maintain the illusion.

To protect against this threat, users should avoid downloading software from untrusted sources and ensure their security software is up-to-date.

Ransomware Group ‘CrazyHunter’ Targets Critical Taiwanese Sectors

A new ransomware group, called "CrazyHunter", has emerged as a significant threat to Taiwan. It focuses on critical sectors like healthcare and education. Trend Micro researchers reveal that the group, which has been active for just a month, uses sophisticated tactics and open-source tools, including Prince Ransomware Builder and ZammoCide, to execute attacks.

Heading to Computex 2025 or coming back from CYBERSEC 2025? Make sure you’re not bringing home unwanted Taiwanese souvenirs like this new malware.

Threat Tracker

Malware Preloaded on Budget Android Phones Targets Crypto Wallets

Security researchers have uncovered a new threat targeting cryptocurrency users via low-cost Android phones from Chinese manufacturers. These devices come with pre-installed, Trojanized apps mimicking WhatsApp and Telegram, designed to hijack crypto transactions by silently swapping wallet addresses.

A malicious automation script from Mora_001. Source: forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/.

Marketed under names like S23 Ultra and Note 13 Pro, these SHOWJI-made phones mimic premium models while secretly enabling crypto theft via clipboard hijacking.

Avoid these devices, and be cautious with budget Android phones from unfamiliar brands.

Legends International Breach Exposes Data of Employees and Venue Visitors

Legends International has disclosed a data breach from November 2024 that exposed the personal data of employees and visitors to its managed venues, including SoFi Stadium and OVO Arena Wembley.

If you’ve attended an LA Rams or Chargers home game, Super Bowl LVI, WrestleMania 39, or any events recently held at one of Legends’ managed venues, you should watch for suspicious activity, enable account alerts, and be cautious of unexpected emails or messages.

Ahold Delhaize Confirms Data Theft in US Cyberattack

Ahold Delhaize has confirmed that data was stolen from its U.S. systems during a November 2024 cyberattack. The breach affected brands like Food Lion, Stop & Shop, and Hannaford. The breach disrupted some pharmacies and e-commerce services, as systems were taken offline. 

Customers should monitor accounts for suspicious activity, update passwords, and stay alert for phishing attempts.

Snackable Bytes

🛡️ This section contains sponsored cybersecurity insights.

Security Tip of the Day

Are Your Voice Assistants Spying On You?

The short answer: absolutely, especially if you’ve got them set to wake up on command. And while Apple just settled for a whopping $95 million for “listening without permission,” the jury's still out on whether they’re secretly listening in on your private chats to hit you with ads later.

Source: designtaxi.com.

However, you can take measures to prevent Alexa, Siri, and Google Assistant from snooping on you.

🔐 How to protect yourself:

Bonus tip: Add a mic toggle to your quick settings for easy shutdown.

We’ve saved you a seat for Cisco Secure Access Live Demo

Hi there,

Secure access, simplified. Join Cisco’s Secure Access live demo on May 21 to learn how to protect users anywhere — and get a free pair of Cisco socks for attending the session!

      *Offer is only available in the US while supplies last.

Slopsquatting Targets Developer Trust With AI Hallucinated Packages

A new breed of AI-fueled cyberattacks is emerging through slopsquatting—a supply chain threat that exploits AI tools like GitHub Copilot and ChatGPT. Developers, take caution: relying too heavily on “vibe coding” and automated tools can leave you vulnerable to slopsquatting attacks. 

Developers, trust your hard-earned programming instincts, and always verify what goes into your codebase.

Security Question of the Week

Would you trust AI to write your company's code?

Meet Our Writers:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Liz Ticong

Liz Ticong is a tech writer specializing in AI and software tools, known for turning complex topics into clear, actionable insights through hands-on testing and analysis.

We're Hiring! 📝

We're looking for talented writers to help shape Cybersecurity Insider. If you're passionate about cyber security, apply to join our team!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.