Someone’s always listening, Digital Defenders. |
Today’s cyber headlines shout one thing: your communications aren’t safe. WhatsApp is getting booted by the US House. Fake VPN clients are hijacking credentials. And npm packages are leaking dev secrets. |
|
|
Here’s what you need to know: |
|
|
US House Bans WhatsApp on Official Devices Citing Security and Data Privacy Risks
|
The US House of Representatives has banned WhatsApp from all government-issued devices due to concerns about data protection and transparency, according to a memo from the House Chief Administrative Officer. |
Citing a lack of clarity around data handling, inadequate stored data encryption, and other potential risks, the Office of Cybersecurity classified the app as high-risk.
Gov staff and organizations handling sensitive data should avoid using consumer messaging apps like WhatsApp on official devices and instead rely on vetted, enterprise-grade communication tools with transparent security practices |
Trojanized SonicWall VPN Client Steals Credentials via Spoofed Site |
SonicWall is warning users about a malicious, trojanized version of its NetExtender SSL VPN client distributed through spoofed websites.
The fake installer, which closely mimics the legitimate NetExtender v10.3.2.27, is digitally signed by a third party and designed to exfiltrate VPN credentials to an attacker-controlled server. The malware captures usernames, passwords, domains, and VPN configuration data once a user clicks "Connect." If you’re a SonicWall user, download NetExtender only from official SonicWall domains to avoid compromise. |
North Korean Hackers Target Developers in Ongoing Supply Chain Attack |
Researchers have uncovered a new wave of malicious npm packages, tied to the North Korean "Contagious Interview" operation, directly targeting software developers.
The campaign involved 35 packages uploaded across 24 npm accounts, with over 4,000 downloads so far. The malicious npm packages contain layered malware that exfiltrates host data, steals credentials, installs a Python backdoor, and, in some cases, logs keystrokes. Developers: Ensure that you vet all open-source dependencies and monitor them for suspicious behavior after installation. |
|
|
Messaging apps are a growing target. How safe is yours? |
|
|
Yesterday's Pulse Check Results |
How worried are you about deepfakes?
|
|
|
- With NinjaOne, you can secure your IT environment, streamline patching, and manage endpoints from a single, intuitive dashboard.
-
Get started with DNS and DHCP rules quickly with this ready-to-use DNS and DHCP Usage Policy, designed to streamline your IT management efforts.
|
|
|
Citrix Bleed 2 and SAP GUI Flaws Raise Alarms Over Token Theft and Sensitive Data Exposure |
Researchers have uncovered two critical vulnerabilities in SAP GUI for Windows that could allow attackers with system access to retrieve sensitive user input history, including usernames, Social Security numbers, and bank details. |
The SAP GUI. Source: SAP.com |
Although SAP patched the flaws in January 2025, the insecure storage of input data poses lingering risks if updates haven't been applied. Meanwhile, a separate Citrix Bleed 2 flaw also enables session token theft under certain conditions. If your organization uses SAP GUI, ensure your systems are fully updated and restrict access to local user directories. |
UMass Dartmouth Sued After Data Breach Exposes Personal Info of 75,000 People |
UMass Dartmouth is facing a class-action lawsuit after a data breach in early 2025 exposed the sensitive personal information of over 75,000 students, staff, and faculty members. This includes Social Security numbers, driver’s license details, and financial data.
The suit alleges the university failed to adequately protect this information from unauthorized cybercriminal access. It also claims that the institution didn’t notify people of the data breach until months after it discovered it.
This is a reminder to prioritize cybersecurity practices and incident response readiness to reduce legal exposure and protect user trust. |
| |
Time is critical—don’t panic! Semperis enables Active Directory recovery 90% faster than manual methods, saving organizations an average of $3.9 million over 3 years. Rapid recovery helps you resist ransomware, which disrupts 87% of victims. Say “No!” to downtime and data loss with Semperis—your AD recovery safety net. |
|
|
Want Real Privacy? Start With This Messaging App List |
Your messaging app choice can make or break your privacy. Forget flashy features—only apps with real, proven encryption and minimal data collection deserve your trust. But which ones are actually worth your trust? And which deserve to be flushed straight into the digital trash? |
Signal leads the pack with open-source, default end-to-end encryption and almost zero data logging. Alternatives like Wire and Wickr deliver solid security with a bit more polish.
Apple’s iMessage is good if you’re all-in on their ecosystem. But WhatsApp? Its encryption is solid but overshadowed by questionable data practices. |
Here are some privacy tips for locking down your messaging habits: |
-
Use Signal for the strongest, most transparent end-to-end encryption.
- Consider Wire or Wickr for secure messaging with extra features.
- Stick to iMessage only if you are fully invested in Apple’s ecosystem.
-
Avoid using WhatsApp for sensitive conversations due to concerns about data collection.
- Always keep your messaging apps updated to patch security flaws
- Be cautious about sharing sensitive info over any platform—no app is foolproof.
|
Remember: your data is only as safe as your weakest app. |
|
|
| Leon Yen is a cybersecurity expert and seasoned tech journalist with over a decade of experience, including founding a cyber risk startup and leading industry-focused research and reporting. |
|
|
Into more than just malware and mayhem? |
Stay sharp on AI, cloud, DevOps, and the tech players shaking things up. Subscribe to Daily Tech Insider for no-fluff rundowns and witty breakdowns delivered straight to your inbox—because knowing what’s next helps you stay secure. |
|
|
Into more than just malware and mayhem? |
Stay sharp on AI, cloud, DevOps, and the tech players shaking things up. Subscribe to Daily Tech Insider for no-fluff rundowns and witty breakdowns delivered straight to your inbox—because knowing what’s next helps you stay secure. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA. |
|
|
|
