Heads up, Digital Defenders! 🛡️

Today’s updates bring a novel zero-click AI exploit, a malware attack infecting over 269,000 sites, and a major EU investment in cybersecurity. There’s a dark web drug bust in the mix, too.

Here’s what you need to know:

Before you dive in: The Neuron just dropped its revamped podcast—and it’s asking the big question: Will AI wipe out half of all white-collar jobs? We unpack the data, dodge the hype, and get smart insights from Microsoft’s Alexia Cambon on how to stay ahead in an AI-saturated workday.

Listen on Spotify or wherever you get your podcasts!

Zero-Day Download

First Known Zero-Click AI Exploit ‘EchoLeak’ Found in Microsoft 365 Copilot

AIM Security has uncovered “EchoLeak,” a novel, zero-click AI exploit that enables threat actors to exfiltrate user data from Microsoft 365 Copilot context—all without the user taking a single action.

Labeled CVE-2025-32711 with a 9.3 CVSS, the flaw tricks Copilot into pulling private user data after it follows malicious instructions concealed in an ordinary-looking email.

Source: TechRepublic

Fortunately, Microsoft has confirmed and mitigated the vulnerability. According to the company, no customer action is required to address the flaw.

EchoLeak might be the first of many zero-click AI exploits we see in the wild. Time to keep our eyes wide open.

269,000 Sites Infected in Massive ‘JSFireTruck’ Malware Campaign

Researchers from Palo Alto Networks’ Unit 42 group have discovered a growing JavaScript attack campaign that infected 269,552 websites between March and April of this year.

The attackers employed an obscure JavaScript obfuscation method called JSFireTruck, injecting the sites with malicious code that allows them to recreate any code that they want. The JavaScript code can lead to exploits, malware downloads, traffic monetization schemes, and malvertising incidents

Web admins: Scan your sites, monitor your traffic, and watch for unexpected scripts.

European Commission Earmarks €145.5M to Boost Cybersecurity for SMEs, Healthcare

The European Commission has allocated €145.5 million to support small and medium-sized enterprises and healthcare providers, strengthening their overall cybersecurity efforts.

The budget rollout is split under two calls for proposals: €55 million for the Digital Europe Program and €90.5 million for the Horizon Europe Program. Key allocations include €30 million to enhance cybersecurity in hospitals and healthcare providers and €40 million toward generative AI cybersecurity applications.

Cybersecurity might be expensive…but not as expensive as a breach.

Share this newsletter!

Pulse Check

How secure is your organization’s cybersecurity posture?

Yesterday's Pulse Check Results

Would you ever use a public-facing AI assistant for sensitive topics
(e.g., legal, health, or personal finance)?

Snackable Bytes

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

‘Archetyp’ Drug Marketplace on Dark Web Shut Down by European, US Authorities

Archetyp Market—an online drug marketplace that has operated on the dark web since May 2020—has been shut down following a coordinated police effort between five European countries and the United States.

According to Bleeping Computer, Archetyp Market provided access to illegal drugs such as cocaine, MDMA, heroin, amphetamines, and fentanyl, with over 3,200 registered vendors and 17,000+ listings. Law enforcement took down the marketplace’s infrastructure, seizing 47 smartphones, 45 computers, and assets worth €7.8 million in the process.

Use this as a reminder to audit your systems and monitor for illicit dark web activity tied to your organization.

23andMe Fined £2.31M for 2023 Data Breach Affecting 155K UK Residents

The United Kingdom’s Information Commissioner’s Office (ICO) has fined 23andMe £2.31 million (around $3.1 million USD) for “failing to protect UK users’ genetic data.”

Between April and September 2023, a hacker targeted the DNA company with a credential stuffing attack, ultimately exposing the personal information of approximately 155,592 UK citizens. John Edwards, UK information commissioner, called 23andMe’s security systems “inadequate.”

Use this as a wake-up call to enforce multi-factor authentication and review your password policies, especially for systems storing sensitive data

Washington Post Investigating Hack on Journalists’ Emails

The Washington Post is investigating a cyberattack targeting the email accounts of some of its journalists, according to a report from Reuters.

The incident was discovered last Thursday, with the affected emails reportedly belonging to staffers who covered national security, economic policy, and China. The attack is believed to have been perpetrated by a foreign government. Since the incident, all Post employees have been instructed to do a password reset and a credential reset.

Reinforce email security by training staff on phishing awareness and ensuring access to sensitive communications is protected by MFA.

Security Tip of the Day

Don’t Let VPNs Give a False Sense of Security

VPNs can boost your privacy. However, they’re not a silver bullet for total online anonymity. It’s essential to understand what VPNs are actually capable of—and what’s more marketing fluff than reality.

Source: Surfshark screenshot

What VPNs Can Do:

What VPNs Can't Do:

VPNs are valuable additions to your online security toolkit, especially when used wisely. With that, knowing what they can’t do is just as important as knowing what they can.

Share this newsletter!

Meet Our Writers:

Luis Millares

Senior Staff Writer at TechnologyAdvice

Luis Millares is a seasoned tech writer with broad experience reviewing consumer gadgets and enterprise software, offering clear, reliable insights across the latest in technology. 

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.