Welcome back, Digital Defenders! 🛡️

Public and private defenses are feeling the pressure. CISA’s leadership vacuum raises concerns about a slower national response, while law firms, payroll systems, and AI assistants are being exploited in increasingly creative ways.

Plus, scroll down to weigh in on our poll:  Are you worried about AI leaking secrets?

Here’s what you need to know:

Zero-Day Download

CISA Leadership Wipeout Comes at the Worst Possible Time

The Cybersecurity and Infrastructure Security Agency (CISA) is losing nearly all of its top officials, including leaders of five operational divisions and six regional offices, by the end of May. The sudden exits stem from federal downsizing across DHS agencies. 

Source: Heise

This shakeup comes amid a wave of phishing scams, ransomware campaigns, and state-sponsored threats targeting both public agencies and private companies. Critical infrastructure partners may face slower incident response times and reduced coordination as institutional knowledge is lost.

If you rely on CISA field teams, brace for delays and reinforce your own cyber response playbooks.

FBI Warns Law Firms: Hackers Now Call Instead of Email

The FBI warns that Luna Moth attackers are impersonating IT staff over the phone to trick law firm employees into launching remote access tools. Once inside, the group exfiltrates sensitive data using stealthy tools like WinSCP and Rclone.

The tactic blends callback phishing and voice-based deception to evade traditional email filters and antivirus detection.

Firms should audit remote access usage, flag unexpected file transfers, and train staff to verify IT communications.

Google Ads Used in Mobile Payroll Scam to Steal Paychecks

Google ads are leading employees to fake payroll portals on mobile devices, where attackers steal logins and reroute paychecks. The phishing sites resemble genuine login pages and display fake Microsoft prompts to capture credentials.

Hackers hide their tracks by using infected home routers and mobile IP addresses, making it difficult for security tools to catch them.

Warn staff not to search for payroll links on mobile. Block deposit changes without approval, and be vigilant for any unusual mobile access.

Share this newsletter!

Snackable Bytes

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Fake AI Video Ads Used to Spread Malware on Facebook and LinkedIn

Hackers tied to group UNC6032 are running fake ads for AI video generators to trick users into downloading malware. The campaigns have been active since late 2024 and have reached over 2 million people across Facebook and LinkedIn.

Source: Getty Images

The fake sites resemble real text-to-video tools but serve a malware bundle named STARKVEIL, which includes keyloggers, information stealers, and wallet scanners. Victims are presented with a fake video interface and are prompted to run a ZIP file twice.

Facebook and LinkedIn removed many of the ads, but users are still at risk. Defenders should watch for ZIP downloads from unknown AI sites and train users to avoid clicking on "Start Free" buttons in suspicious AI ads.

DragonForce Hits MSPs Through Remote Access Bugs

Ransomware group DragonForce exploited three known bugs in SimpleHelp, a remote access tool, to breach a managed service provider (MSP) and infect downstream clients. The attackers used the MSP’s own tools to spread ransomware and steal data across multiple businesses.

SimpleHelp issued patches quickly, but some clients had not updated before the attacks began.

DragonForce has become a major ransomware-as-a-service player, known for affiliate branding and aggressive recruitment. Organizations using remote access tools should patch quickly, monitor for unusual installations, and limit third-party access.

Hackers Tricked GitLab’s AI Into Leaking Private Code

A bug in GitLab Duo, the platform’s AI coding assistant, allowed attackers to hide secret prompts within code comments and project messages. The AI followed these hidden instructions to leak private source code and suggest fake or risky tools.

The flaw also allowed hackers to slip malicious HTML into AI responses and send stolen data to outside servers.

GitLab has fixed the issue, but the attack highlights how AI tools can be misused within trusted systems. Teams should review how AI is used in code tools and block any unsafe content in AI replies.

The Impact of Increasing Infrastructure Cyber Threats

The State of Critical Infrastructure Resilience found that 62% of responding utilities were attacked in the past 12 months. 

When a cyberattack compromises an electricity or water operator, the potential damage to public health and safety can put the entire nation at risk.
The key? Assume the breach has already happened—and be ready with a plan.

Security Tip of the Day

Don’t Let AI Agents Leak Your Secrets

Enterprises now manage 45+ machine identities (NHIs) per employee, with each NHI holding keys, tokens, or credentials. But many lack policies for rotation or access limits.

Source: IBM Technology (YouTube.com)

In 2024 alone, 23.7 million secrets were leaked on GitHub, 40% more often when Copilot was enabled.

To avoid LLM-driven leaks, implement five key controls:

With the right governance, AI scale doesn’t have to mean security sprawl.

Security Question of the Day

Are you worried about AI leaking secrets?

Results from Yesterday's Security Question of the Day

Do you use in-flight wifi during air travel?

Meet Our Writers:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Liz Ticong

Liz Ticong is a tech writer specializing in AI and software tools, known for turning complex topics into clear, actionable insights through hands-on testing and analysis.

Greg Parker

Greg Parker is a future-focused writer who covers emerging tech trends and human-centered sensing. He leverages his sharp insights to help organizations navigate the tech space with clarity and creativity. Outside of work, he enjoys playing pickup basketball and spinning records.

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.