Heads up, Digital Defenders! 🛡️

A stealthy SharePoint zero-day is cracking open critical systems. Meanwhile, Chinese hackers infiltrated the U.S. National Guard, FIDO security is under threat, and sensitive healthcare data keeps spilling fast.

Here’s what you need to know:

Zero-Day Download

Global SharePoint Hack Hits Governments, Universities, and Energy Firms

CISA warned that a new SharePoint vulnerability (CVE-2025-53770) is under active exploitation. The zero-day flaw gives attackers remote access to on-premise servers. Over 50 organizations have been compromised globally, and at least two SharePoint versions remain unpatched.

Source: news.microsoft.com

The breach impacted at least two U.S. federal agencies, public universities, energy companies, and a telecom firm in Asia, with some state agencies reporting documents hijacked or wiped. Experts warn the attackers stole cryptographic keys that could let them return even after fixes.

The attack adds pressure after a 65% staff cut to CISA’s response teams stalled weekend alerts to over 100 at-risk institutions.

Admins should isolate vulnerable servers, apply available patches immediately, check logs for strange activity, and rotate credentials. Even patched systems may still be compromised.

Virginia Radiology Breach Exposes Data of 1.4 Million Patients

Radiology Associates of Richmond revealed a cyberattack that compromised the personal and health data of 1.4 million individuals, including Social Security numbers. Hackers accessed the network undetected. 

The breach comes amid a wave of healthcare attacks: Anne Arundel Dermatology reported a breach affecting 1.9 million people, and Stormous ransomware claimed the theft of 600,000 patient records from North Country HealthCare.

Be sure to use multi-factor authentication on patient portals, and request annual medical records to spot suspicious activity.

Phishers Trick Users Into Skipping Strong FIDO Security

A new phishing scam fools users into ditching strong FIDO security without actually breaking it. Hackers set up fake Okta login pages, steal usernames and passwords, then relay real QR codes back to the victim to complete login with weaker MFA. 

It looks like a FIDO bypass, but it’s really a clever downgrade that takes advantage of fallback options like cross-device sign-ins.

To stay safe, admins should block weaker login methods like SMS or QR codes, and stick with true FIDO-only setups. If your login flow offers an easy way out, attackers will take it.

Share this newsletter!

Pulse Check

How locked down is your MFA setup—really?

Yesterday's Pulse Check Results

How quickly does your organization retire end‑of‑life systems like old routers or appliances?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

U.S. National Guard Breached by China-Linked Hackers

A cyber campaign by Salt Typhoon, a group tied to China’s state-backed hackers, infiltrated the National Guard network of at least one U.S. state for nearly nine months. The attackers accessed network diagrams, geographic data, and personal info on service members. 

Source: Joseph Eddins

Experts say Salt Typhoon often lingers for years once inside. The campaign went undetected from March to December 2024 and may have helped position future intrusions into other states’ systems.

Security teams should audit lateral access points, update detection rules, and isolate hybrid government networks where possible.

Google Sues Chinese Botnet Gang Behind 10 Million Infected Android Devices

Google is taking 25 unnamed Chinese operators to court over BadBox 2.0, a massive botnet that hijacked over 10 million uncertified Android devices. 

The malware came pre-installed on smart TVs, projectors, and even car infotainment systems, and turned them into ad fraud machines that quietly loaded fake ads and joined shady proxy networks. Victims had no clue their devices were working overtime for cybercriminals.

A U.S. court issued a global takedown order, and Google updated Play Protect to block related apps. If your gadget came with mystery apps and no Google seal, it might be time for a factory reset.

Security Tip of the Day

Watch Your DNS Traffic for Hidden Malware

Hackers are now stuffing malware into DNS records, the behind-the-scenes system that turns your web address into an IP number. Since DNS traffic usually flies under the radar of security tools, it can be a route for malicious code, binary payloads, and even AI prompt injection attacks. 

Here’s how to stay ahead of the trick:

DNS may seem boring, but it's quickly becoming a playground for stealthy exploits. Give it the attention it deserves before attackers use it to slip past your defenses.

Meet Our Writer:

Greg Parker

Greg Parker is a cybersecurity and emerging tech writer who explores the intersection of digital risk, human behavior, and innovation across sensing and security technologies.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.