Stay alert, Digital Defenders! 🛡️

Malware is hiding in GitHub. Hackers are slipping past Gmail defenses. Even Google search results are being weaponized. These threats aren’t just aggressive — they’re deceptive.

Let’s break down today’s biggest threats and how to respond.

Here’s what you need to know:

Zero-Day Download

Netflix, Apple, and BofA Targeted in Google Search Scam

Attackers are purchasing Google ads that display fake support phone numbers at the top of search results for companies such as Netflix, Apple, and Bank of America. The ads link to real company websites but include a search query with a fake support phone number. 

Source: MalwarebytesLABS.com

Victims searching for help see the fake number listed in the search results and call scammers posing as support agents. The scammers steal credentials, financial information, or gain remote access to victims’ devices.

Watch for phone numbers appearing in URLs or unusual search terms, such as “call now” or “emergency support,” in the browser address bar. Also, remember: legitimate support agents will never ask for passwords, bank account numbers, or remote access.

CoinMarketCap Removes Malicious Wallet Pop-Up After Phishing Attempt

CoinMarketCap removed malicious code after a pop-up on its site instructed users to verify wallets and approve ERC-20 token access. Attackers attempted to collect wallet credentials and token permissions through the fake prompt. 

MetaMask and Phantom identified the threat, and Phantom blocked the site as unsafe. The incident follows CoinMarketCap’s 2021 breach that exposed 3.1 million user email addresses. 

If you use crypto, always avoid interacting with unexpected wallet prompts and use wallet extensions that block known phishing sites.

Russian State Hackers Bypass Gmail MFA in Targeted Phishing

Russian state-backed group UNC6293 (linked to APT29) bypassed Gmail multi-factor authentication by tricking targets into generating app-specific passwords. Victims unknowingly handed over credentials that granted full Gmail access. 

The hackers posed as US State Department officials and targeted academics and Kremlin critics with fake meeting invites between April and June. Google and Citizen Lab linked the campaign to VPS servers and residential proxies, which masked the attacker's access.

Eliminate app-specific passwords, enforce hardware security keys, and enable Google’s Advanced Protection Program to block similar credential hijacking attempts.

Share this newsletter!

Pulse Check

Are you using any form of multi-factor authentication (MFA) for email?

Yesterday's Pulse Check Results

When a breach hits the news, what do you do?

Snackable Bytes

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

Trojanized GitHub Repositories Spread Malware to Gamers and Developers

Threat actors uploaded over 200 malicious GitHub repositories disguised as gaming tools, cheats, and developer utilities. These repositories contain trojanized payloads that steal credentials, browser data, and session tokens.

Source: Bleeping Computer.com

The campaign, called Banana Squad, builds on earlier attacks that infected over 75,000 systems through PyPI packages. Researchers linked the activity to broader networks like Water Curse and Stargazers Ghost, which use fake celebrities, Discord servers, and YouTube channels to boost exposure. 

If you’re a developer, verify repository authenticity, restrict open-source code imports, and monitor software supply chains for malicious modifications

Hackers Exploit WordPress Theme to Hijack Websites

Attackers are exploiting a critical vulnerability (CVE-2025-4322, CVSS 9.8) in the WordPress Motors theme that allows unauthorized password resets on any user account. Over 22,000 websites use the theme, and the flaw has been actively exploited since June 7. 

The issue stems from missing identity checks in the Login Register widget’s password recovery feature. Once compromised, attackers can upload malicious plugins, alter site content, and redirect users to phishing or spam sites. 

Website owners should update to Motors theme version 5.6.68 or later to prevent further exploitation.

Linux Bugs Let Hackers Take Full Control of SUSE Systems

Qualys identified two linked bugs (CVE-2025-6018, CVE-2025-6019) in SUSE Linux Enterprise 15 and openSUSE Leap 15 that allowed attackers to fully take control of systems. The exploit works on multiple Linux distributions using only default software. 

First, a PAM flaw allows remote users to gain “active user” status through SSH. Then, using a common storage service (udisks), attackers escalate to full root access. Unpatched servers risk full compromise and could allow attackers to disable defenses and spread across networks.

Patch immediately, strengthen privilege rules, and review system-wide Linux security policies to ensure optimal security.

Security Tip of the Day

No-Code Platforms Create Hidden Risks

Citizen developers are increasingly building apps with low-code or no-code platforms that use third-party connectors, often bypassing IT oversight. Vulnerabilities in these connectors can expose sensitive enterprise systems to spoofing, dependency confusion, or silent data leaks.

Source: Medium

"Here’s how to reduce your exposure:

No-code accelerates innovation, but it quietly expands your attack surface when unmanaged.

Meet Our Writers:

Greg Parker

Greg Parker is a cybersecurity and emerging tech writer who explores the intersection of digital risk, human behavior, and innovation across sensing and security technologies.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.