Stay sharp out there, Digital Defenders.

Attackers are widening their reach as Scattered Spider sets sights on the airline industry and Google raises alarms over actively exploited SonicWall appliances. Meanwhile, a new study reveals widespread use of Chinese GenAI tools in US and UK workplaces.

Here’s what you need to know:

Zero-Day Download

Airlines Targeted: Microsoft Warns of Scattered Spider Hacker Group Eyeing Airline Industry

The Scattered Spider hacking group, also known as Octo Tempest, is now turning its attention to the airline and broader aviation industry, according to Microsoft’s Defender Security Research Team.

Google’s Threat Intelligence Group (GTIG) has disclosed the active exploitation targeting end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances, with attackers deploying the OVERSTEP backdoor to gain unauthorized access.

Tracked as UNC6148 since October 2024, the campaign could open the door to data theft, extortion schemes, and ransomware attacks, according to GTIG researchers. 

GTIG: Organizations using SMA appliances should analyze for possible compromise and reset all credentials if any breach is detected. 

Google Sounds Alarm on SonicWall SMA Appliance Exploit

Google’s Threat Intelligence Group (GTIG) has disclosed the active exploitation targeting end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances, with attackers deploying the OVERSTEP backdoor to gain unauthorized access.

Tracked as UNC6148 since October 2024, the campaign could open the door to data theft, extortion schemes, and ransomware attacks, according to GTIG researchers. 

GTIG: Organizations using SMA appliances should analyze for possible compromise and reset all credentials if any breach is detected.

Public GitHub Repositories Found Hosting Amadey Malware in Malware-as-a-Service Campaign

Cisco Talos researchers have uncovered an attack campaign where hackers are using public GitHub repositories to host Amadey malware and other malicious payloads.

According to the researchers, the threat actors used fake GitHub accounts to host payloads and Amadey plugins—likely to bypass web filtering and simplify management of their operation. Hackers Exploit TeleMessage (Signal Clone) to Steal Data

The malware loader Emmenthal (also called PEAKLIGHT) delivers Amadey, which then installs additional threats such as infostealers and ransomware.

Always be wary of unverified GitHub repositories and only pull code and plug‑ins from trusted, vetted sources.

Share this newsletter!

Pulse Check

How quickly does your organization retire end‑of‑life systems like old routers or appliances?

Friday's Pulse Check Results

Do you trust companies like Google and OpenAI to handle military AI?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

One in Twelve US/UK Employees Use Chinese GenAI Tools, Study Finds

A study from Harmonic Security found that one in 12 US and UK employees use Chinese generative AI tools, potentially opening themselves to security and privacy risks.

Source: Unsplash / Solen Feyissa

The study analyzed 14,000 US and UK-based users in a 30 day period, recording 535 incidents of sensitive data exposure—85% of which came from using the Chinese AI chatbot DeepSeek. Other GenAI tools examined were Baidu Chat, Moonshot Kimi, Qwen, and Manus.

IT teams should review outbound data policies and monitor AI tool usage to reduce the risk of sensitive information leaks.

Hackers Target Signal Messaging Clone To Steal Passwords, Other Sensitive Data

TeleMessage, a Signal clone used by high-ranking officials in the US government, is being targeted by attackers to harvest sensitive data from its users.

Researchers at GreyNoise discovered that hackers are exploiting the Spring Boot Actuator framework in the app. When abused, this security flaw allows hackers to download files containing usernames, passwords, and other sensitive information.

Organizations using TeleMessage should monitor for any unusual activity and apply available security patches immediately.

Security Tip of the Day

Protect Your Small Business With a VPN

Small businesses depend on the internet to stay productive, but that also makes them a prime target for hackers looking to steal data or disrupt operations.

Fortunately, a virtual private network (VPN) can help shield your business by encrypting all online traffic and keeping prying eyes away from sensitive information.

Source: Unsplash / Privecstasy

eSecurityPlanet points to these five VPN services as top choices for defending against Wi‑Fi snooping and other attacks:

By deploying a trusted VPN, SMBs can fortify their networks and stay focused on growth, not looming security risks.

Meet Our Writer:

Luis Millares

Senior Staff Writer at TechnologyAdvice

Luis Millares is a seasoned tech writer with broad experience reviewing consumer gadgets and enterprise software, offering clear, reliable insights across the latest in technology. 

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.