Welcome back, Digital Defenders! 🛡️

Today’s cyber threats are all about fakes—fake apps, fake logins, and fake personas. From bogus AI tools spreading malware to phishing traps built with Google’s own scripts, even trusted tech is getting duped.

Scroll on for the latest. And don’t miss the quick poll at the end: How often do you accept friend or connection requests on social media?

Here’s what you need to know:

Zero-Day Download

Apple’s Fullscreen Flaw Opens Door to Stealth Phishing

A vulnerability in Apple's Safari browser allows attackers to exploit the Fullscreen API in a browser-in-the-middle (BitM) attack, tricking users into entering credentials into fake login screens.

Source: bleepingcomputer.com.

Researchers at SquareX warn that Safari fails to properly notify users when a site enters full-screen mode, making it easier for attackers to mask phishing attempts.

To stay safe, users should avoid entering login credentials while in full-screen mode and stay alert for visual inconsistencies or missing browser UI elements.

Fake ChatGPT and InVideo AI Installers Spread Ransomware, Malware

Threat actors are exploiting fake installers for ChatGPT and InVideo AI to distribute CyberLock and Lucky_Gh0$t ransomware, along with a new destructive malware dubbed Numero.

Masquerading as legitimate AI tools popular in marketing and B2B sales, these bogus downloads are promoted through SEO poisoning and hosted on fraudulent sites, such as "novaleadsai[.]com."

Users should only download tools from verified official sources and remain cautious of unsolicited offers or unfamiliar websites, especially those promising free access to premium software.

Meta Dismantles Covert Influence Ops from Iran, China, and Romania

Meta has taken down three covert influence operations originating from Iran, China, and Romania, according to its Q1 2025 Adversarial Threat Report.

The campaigns leveraged fake accounts and pages across Facebook, Instagram, TikTok, X, and YouTube to impersonate local users, disseminate propaganda, and influence public opinion.

Meta says it disrupted the efforts before they gained real traction, despite the actors’ use of advanced operational security and cross-platform presence. However, users should critically evaluate online content to stay ahead of covert influence campaigns.

Share this newsletter!

Snackable Bytes

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Cyber Criminals Hijack Google Apps Script to Mimic Legit Login Pages

Threat actors are abusing Google Apps Script, a development platform within Google Workspace, to host phishing pages that closely resemble legitimate login screens.

Source: developerxofficialdesign.blogspot.com.

The attack begins by using a fake invoice email linking to a deceptive login page. By operating within Google's trusted ecosystem, the malicious actors enhance the credibility of their traps, increasing the chances that victims will unknowingly hand over their credentials.

Users should constantly scrutinize unexpected emails—even those appearing to come from trusted platforms—and verify links before entering any login information.

ConnectWise Hit by Cyber Attack Targeting ScreenConnect

ConnectWise has disclosed a cyberattack likely carried out by a sophisticated nation-state actor, affecting a number of its ScreenConnect customers.

The breach follows an April patch for CVE-2025-3935, a high-severity flaw in ScreenConnect that could allow code injection attacks—a potential entry point for intrusion.

ScreenConnect users should apply the April patch to prevent the flaw from being exploited by malicious actors.

LexisNexis Breach Exposes Data of 360,000 Users

LexisNexis Risk Solutions (LNRS) is dealing with the fallout of a third-party data breach that compromised the personal information of more than 360,000 individuals.

The breach involved data stored on a third-party software development platform, reportedly GitHub. Although the company’s own systems were not compromised, the stolen data may include names, contact details, Social Security numbers, and driver’s license information. 

Users should review their account statements and remain vigilant for signs of fraud and identity theft. They should also take up LNRS’ offer for free identity protection and credit monitoring services for up to two years.

Security Tip of the Day

The Friend Request That Could Wreck Your Life

Welcome to the wild world of social media in 2025, where making digital connections comes with real-world risks. From privacy breaches to weaponized misinformation, your social media presence is constantly under attack by malevolent actors.

One of the most common entry points? Suspicious friend or connection requests. Accepting the wrong one can open the door to phishing, impersonation, or worse.

Source: bbc.com.

However, you don’t have to go off the grid to stay safe on social media. Instead, follow a few handy guidelines to dramatically reduce your risk of becoming a target for cybercriminals and malicious actors.

Here are some quick tips for smart social media use:

By being proactive with these tips, you can maximize the benefits of social media while maintaining your privacy and peace of mind. And above all else, stay informed and alert—it’s your best bet for keeping your digital world secure.

Security Question of the Day

How often do you accept friend or connection requests on social media?

Results from Yesterday's Security Question of the Day

Have you ever charged your phone using a public USB charging station?

Meet Our Writers:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.