Eyes up, Digital Defenders! 🛡️

Data is leaking. Hackers are scheming. From shady Chrome extensions to a stealthy iMessage flaw, digital threats are everywhere. And with billions of records exposed across global breaches, it’s a rough time to let your guard down.

And be sure to check in with our poll at the bottom: What level are you playing at when it comes to password security?

Here’s what you need to know:

Zero-Day Download

Chrome Extensions Caught Spilling Your Data

Cybersecurity researchers from Symantec have uncovered several widely used Google Chrome extensions leaking sensitive data.

Source: thehackernews.com.

Extensions like SEMRush Rank, Browsec VPN, and MSN New Tab were found sending data in plaintext. In contrast, others embed API keys and secrets directly in their code, potentially enabling attackers to exploit these credentials for malicious purposes.

To prevent security compromises, avoid extensions that send data unencrypted or contain embedded secrets, and keep your extensions up to date from trusted sources.

DOJ Seizes $7.7M in Crypto Tied to North Korea’s Global IT Worker Fraud Scheme

U.S. authorities have seized $7.74 million in cryptocurrency linked to a North Korean scheme in which IT workers illegally secured jobs at global companies—often under stolen American identities—and funneled wages back to the regime.

Officials warn the scheme has infiltrated even Fortune 500 companies and continues to expand in scale and sophistication.

Remember to rigorously vet remote hires, watch for signs of identity fraud, and follow government advisories on IT worker threats.

Proof-of-Concept Exploit Emerges for Critical Apache Tomcat Flaw

A critical memory leak vulnerability in Apache Tomcat’s HTTP/2 implementation (CVE-2025-31650) has been weaponized, allowing unauthenticated denial-of-service attacks via malformed priority headers.

Public proof-of-concept exploits are now circulating, using thousands of concurrent malformed requests to overwhelm affected servers within minutes.

If you’re an Apache Tomcat admin, apply the necessary fixes immediately to prevent servers from being compromised.

Share this newsletter!

Snackable Bytes

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Apple Scrambles to Fix iMessage Zero-Click Vulnerability

A previously unknown zero-click vulnerability in Apple’s iMessage allows sophisticated attackers to compromise iPhones without any user interaction.

Source: imore.com.

Affecting iOS versions up to 18.1.1, the “NICKNAME” flaw can be triggered using just a phone number or Apple ID, allowing threat actors to remotely execute malicious code.

Apple quietly patched the flaw in iOS 18.3 after iVerify revealed it was caused by memory corruption in the iMessage process. However, the situation still highlights the risks associated with stealthy attacks.

Update your iPhone to the latest iOS version as soon as possible to protect against this stealthy zero-click exploit.

AT&T Data Nightmare: 86 Million Records, Including 44 Million Unmasked SSNs, Exposed

In what could be one of the biggest breaches yet, hackers dumped 86 million AT&T customer records online—44 million of which include fully exposed Social Security numbers.

The data leak, first spotted on a Russian cybercrime forum, may tie back to last year’s Snowflake hack. However, this dump is significantly larger, with information neatly organized for easy exploitation. 

AT&T customers are advised to monitor all their accounts for suspicious activity and consider setting up credit freezes or fraud alerts.

Massive Data Leak Exposes Over 4 Billion Chinese Records

The largest data breach ever in China has exposed more than 4 billion user records containing sensitive information such as financial details, WeChat and Alipay data, IDs, birthdates, phone numbers, and residential addresses.

A 631GB database was found online without any password protection, making these private records publicly accessible. The exposed dataset is believed to have been compiled to create comprehensive behavioral, economic, and social profiles on nearly every Chinese citizen.

To safeguard your personal data, stay informed about the data privacy regulations in your region and consistently monitor your accounts for any suspicious activity.

Security Tip of the Day

Still Not Using a Password Manager? You’re an Easy Target

Your online identity is more valuable—and more vulnerable—than ever.

This quick video guide breaks down how password managers can be your first line of defense, keeping your accounts secure, your credentials organized, and your personal data out of the wrong hands.

Discover how they function, their significance, and how to select the ideal one for your requirements.

Source: eSecurityPlanet / YouTube

Whether you're managing a handful of logins or juggling dozens, this video provides some easy first steps towards stronger, smarter online security.

Security Question of the Day

What's your player level when it comes to password security?

Results from Yesterday's Security Question of the Day

How secure is your personal AI usage?

Meet Our Writers:

Leon Yen

Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.