Trust is cracking, Digital Defenders

Today’s cyber news highlights threats that hide in the tools we trust most—vendors, updates, inboxes, and even defenses themselves. When trust breaks, attackers move in.

Here’s what you need to know:

Zero-Day Download

Third-Party Trap: Workday Breach Shows Hidden Risk

Workday has confirmed a data breach after hackers compromised a third-party Customer Relationship Management (CRM) system through a social engineering campaign. 

Attackers posed as HR and IT through calls and texts, tricking employees into giving up credentials and business contact details.

Image Source: Giphy

Although customer data and tenant systems remain safe, Workday warns that the stolen contact details may fuel phishing and impersonation, highlighting how attackers exploit human trust and third-party vendors to bypass defenses.

Train employees to verify unusual requests via official channels. And remind them that HR or IT will never ask for passwords by phone.

Windows Update Backfires: Drives Vanish, Data at Risk

Microsoft’s Windows 11 24H2 update (KB5063878) is causing critical issues with SSDs and HDDs, leaving some users unable to access storage devices and facing possible data corruption. 

Meant to fix malware risks, the patch instead causes drives to vanish during large transfers or gaming, often beyond recovery. 

With SMART data unreadable and no official fix, enterprises and power users face severe data loss risks.

Delay KB5063878, and if affected, back up data and roll back until a stable patch arrives.

Voicemail Phishing Campaign Targets Gmail Users

A new Gmail phishing campaign is duping users with voicemail-themed emails that exploit Microsoft Dynamics infrastructure to appear legitimate. This is not the first time hackers have targeted Gmail.

Clicking the “Listen to Voicemail” link leads to a CAPTCHA, then a fake Gmail login that steals passwords, 2FA codes, recovery data, and security answers—giving attackers full account control.

Stolen data sent over encrypted channels lets attackers hijack accounts instantly, underscoring how trusted platforms and obfuscation are abused to evade defenses.

Train users to verify logins via Google’s official channels and block the scam domains like horkyrown[.]com.

Share this newsletter!

Third-Party Risk Check

How secure are your vendors?

Yesterday's Pulse Check Results

How well can you spot a fake?

Security Tools You Can Use

🛡️ This section contains sponsored cybersecurity insights. Advertise with us!

Threat Tracker

EDR’s Dark Side: Zero-Day Strikes Back

A zero-day flaw in Elastic’s Endpoint Detection and Response (EDR) software allows attackers to bypass defenses, run malware undetected, and even crash systems with a Blue Screen of Death (BSOD).

Image Source: Microsoft

The Microsoft-signed elastic-endpoint-driver.sys flaw enables attackers to bypass detection, execute remote code, persist via custom drivers, and crash systems. 

This turns a trusted defense into a weapon, leaving enterprises using Elastic EDR and SIEM tools exposed until a patch is released. 

Monitor driver activity, limit kernel access, and plan to disable Elastic EDR until patched.

WarLock Ransomware Disrupts Telecom Services

Colt Technology Services confirmed a WarLock ransomware attack that disrupted hosting, porting, Colt Online, and Voice API services.

The attackers are allegedly selling over 1 million stolen documents for $200K, including sensitive employee, customer, and financial data. 

While Colt initially described the incident as a technical issue, it later admitted to a cyberattack, shutting down systems to contain the threat. Analysts link the breach to a Microsoft SharePoint flaw (CVE-2025-53770), raising concerns about patching and transparency, while prolonged outages underscore ransomware risks to critical telecom services.

Review patching for exposed apps like SharePoint and segment critical services to reduce ransomware disruption.

Security Tip of the Day

How Hackers Exploit What You Trust

Cybercriminals are increasingly exploiting what users trust most—familiar tools, vendors, and updates. 

Attackers weaponize trust with fake HR calls, phishing on legitimate platforms, and ransomware in third-party apps—making awareness key to protecting data and systems.

Image Source: Giphy

How to stop attacks hiding in trusted tools:

Hackers love to hide in what feels routine. Double-check requests, updates, and tools—staying skeptical is how you stay secure.

Meet Our Writer:

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.

Secure your spotlight and Advertise in Cybersecurity Insider!

Cybersecurity Insider is a TechnologyAdvice business

© 2025 TechnologyAdvice, LLC. All rights reserved.

TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 100, Nashville, TN 37211, USA.

Want to change how you receive these emails? Update your preferences or unsubscribe here.