The shadows are shifting, Digital Defenders. |
Signed drivers betray trust, cloud leaks secrets, vaults crash, vendors fall, and chip flaws keep widening the attack surface.
Think you know Snapdragon as a laptop processor? Take our quick survey and put your knowledge to the test. |
|
| Here’s what you need to know: |
|
|
Microsoft-Signed Exploit Opens the Door to ValleyRAT |
Check Point recently revealed that threat actor Silver Fox turned a Microsoft-signed WatchDog driver into a backdoor for a BYOVD campaign. Exploiting flaws in amsdk.sys, attackers disable defenses, gain privileges, and deploy ValleyRAT for full system control. |
Active since mid-2025, the campaign shows attackers weaponizing signed drivers to evade defenses and adapt to patches, escalating risks from malware to espionage and financial fraud. This is an ongoing campaign. WatchDog has issued a patch. Patch to WatchDog 1.1.100, tighten driver policies, and monitor activity to catch BYOVD attacks early.
|
Misconfigured Azure AD Hands Threat Actors the Keys |
A new Azure AD misconfiguration exposes sensitive app credentials in public appsettings.json files. Exposed ClientId and ClientSecret allow attackers to exploit Microsoft OAuth, impersonate apps, and access Microsoft 365 tenants.
Beyond data theft, attackers can harvest accounts, escalate privileges to admin, and deploy malicious apps—posing a severe risk to the cloud supply chain for organizations. Microsoft has not commented, but Resecurity has provided mitigation steps for organizations.
Reduce exposure by auditing configs for secrets, storing credentials in Azure Key Vault, rotating exposed credentials, and monitoring Graph API activity. |
JSON Bomb Crashes HashiCorp Vault Servers |
A newly disclosed vulnerability in HashiCorp Vault (CVE-2025-6203) allows attackers to crash servers by sending deeply nested JSON payloads that overwhelm CPU and memory.
With a CVSS score of 7.5, the flaw impacts Vault 1.15.0+ and threatens system availability. HashiCorp has issued patched versions (1.20.3, 1.19.9, 1.18.14, and 1.16.25) and introduced listener-level safeguards against abusive payloads.
Update immediately and configure JSON depth and object limits to harden Vault against denial-of-service exploitation attempts. | |
|
Driver Defense Check: How ready are you for BYOVD attacks? |
|
|
Yesterday's Pulse Check Results |
Deepfake Detection Check: Could you spot an AI fake? |
|
|
Security Tools You Can Use |
-
Don’t let risks hide in plain sight. Uncover them fast with the right cybersecurity tools.
-
Remote connections are attackers’ favorite entry. Protect yours and get 22% off with NordLayer.
-
From endpoint to cloud: Defend every layer with Bitdefender and get 30% off for a limited time.
|
|
|
Palo Alto Networks Data Breach Tied to Salesforce Attack |
Palo Alto Networks confirmed a breach after attackers used stolen OAuth tokens from Salesloft’s Drift integration to access Salesforce. Between Aug. 8 and 18, 2025, the breach exposed customer contacts, sales records, and limited case data, though products and services remain unaffected. |
The breach, tied to UNC6395 campaigns hitting Google and Zscaler, highlights rising SaaS supply chain risks as attackers harvest credentials and cloud secrets for further intrusions. Palo Alto Networks recommends rotating credentials and monitoring logs for IOCs.
Audit Salesforce logs for the attacker’s Python user agent, rotate exposed credentials, and apply Zero Trust controls to limit future supply chain breaches. |
Qualcomm Flaws Leave Mobile and IoT Wide Open |
Two critical Qualcomm flaws (CVE-2025-21483 and CVE-2025-27034) could let attackers seize control of millions of Snapdragon-powered devices.
Both flaws score 9.8 CVSS, exploiting buffer and index validation flaws in Qualcomm’s network stack and call processor—allowing silent compromises of device confidentiality and integrity with broad risks for enterprises and users.
Qualcomm has issued patches through its September 2025 Security Bulletin and is urging OEMs to deploy firmware updates immediately. Organizations should verify patch levels, block untrusted RTP/PLMN traffic, audit logs, and urgently update all Snapdragon devices with vendor firmware. |
|
|
What’s Hiding in Your Software Supply Chain? |
Recent breaches reveal attackers increasingly target the software supply chain by inserting malicious code or exploiting third-party dependencies. These attacks matter now because one vendor or CI/CD compromise can cascade across thousands of organizations, exposing sensitive data and critical services. |
How to harden your software supply chain: |
- Use SBOMs and scanners to spot vulnerable or malicious code.
- Sign code and scan secrets to ensure trusted sources.
- Enforce least privilege and secure CI/CD pipelines to limit attacker movement.
- Deploy RASP and immutable infrastructure to block runtime tampering.
- Conduct third-party risk management (TPRM) for vendors.
|
Strong supply chain security protects your code, customers, and reputation—combining visibility, automation, and monitoring to cut risks and build resilience against today’s fastest-growing threats. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
