Cybercriminals are getting creative, Digital Defenders. |
This week we’re tracking how attackers twist trusted tools—turning AI into malware megaphones, payment platforms into phishing gateways, and forgotten namespaces into backdoors. From PayPal to Sitecore, no system is off-limits. |
|
| Here’s what you need to know: |
|
|
Grok Goes Rogue: X’s AI Hijacked for Malware Ads |
Hackers have hijacked X’s Grok AI assistant, turning it into an amplifier for malicious ads. By exploiting the platform’s ad system and Grok’s trusted responses, attackers trick users into clicking malware-laden links hidden in promoted posts. |
The “Grokking” campaign fuses paid ads with AI’s authority, exposing millions. Researchers warn that variants like WormGPT and Mixtral show how easily criminals can weaponize AI as cyber assistants. X has not officially responded to this attack. Update security awareness training to cover AI-driven phishing and enforce stricter ad and link filtering across networks. |
PayPal Phishing Scam Puts 434M Users at Risk |
A phishing campaign is duping PayPal users into granting attackers account access via fake “Set up your profile” emails. The links redirect to PayPal’s real site, where victims unknowingly add attackers as secondary users with full payment access.
This phishing tactic is particularly dangerous because it bypasses traditional defenses by exploiting PayPal’s own systems, potentially putting 434 million users at financial risk. PayPal has yet to comment on this ongoing attack.
Organizations should train employees to avoid email links and log into PayPal directly for verification. |
1,100+ Ollama AI Servers Left Exposed Online |
Researchers found 1,100+ Ollama AI servers online, with 20% actively running models and vulnerable to exploitation. Beyond access, attackers can steal model weights, plant backdoors, or spread tampered models—threatening data integrity and AI supply chains.
Exposed deployments of mistral:latest, llama3.1:8b, and smollm2:135m lack authentication and network protection, revealing systemic gaps in AI infrastructure security. Researchers did not report the servers being actively exploited in the wild.
Audit AI deployments for open endpoints, enforce authentication, and monitor queries to block model theft or injection. |
|
|
AI Exposure: How secure are your deployments? |
|
|
Yesterday's Pulse Check Results |
If your SSD failed today, how prepared are you? |
|
|
Security Tools You Can Use |
-
Risks don’t wait. Why should your defenses? Learn how leading vulnerability management tools can help reduce exposure.
-
Every device is a target. See how NinjaOne strengthens protection and simplifies endpoint security.
-
Want better cyber skills without the expensive price tag? Access 65% savings on practical training to build resilience.
|
|
|
Namespace Reuse Flaw Hits Azure AI, Vertex AI, and Thousands More |
Researchers found a Hugging Face namespace flaw that lets attackers hijack deleted model names and upload malicious versions into trusted environments.
The flaw impacts major platforms, including Microsoft Azure AI Foundry, Google Vertex AI, and thousands of open-source projects. |
The “Model Namespace Reuse” flaw is dangerous because enterprises often trust models by name alone, letting attackers hijack abandoned namespaces to deliver malware and gain remote access—expanding risks across the AI supply chain.
Pin model versions, use controlled storage for critical deployments, and audit dependencies to ensure models resolve to trusted commits. |
Google Uncovers Active Zero-Day in Sitecore Platforms |
The flaw stems from a ViewState deserialization bug tied to outdated ASP.NET machine keys in pre-2017 guides, exposing Sitecore XM, XP, XC, and Managed Cloud. Attackers have used WEEPSTEEL malware with tunneling and recon tools to exfiltrate data and maintain persistence.
Sitecore has released mitigation recommendations for organizations impacted by this exploit. Review Sitecore setups, rotate legacy keys, enable ViewState MAC, and follow SC2025-005 to secure deployments. |
|
|
Who’s Really Holding Your Keys to the Kingdom? |
From machine keys to API tokens, secrets sprawl is a growing blind spot, with unmanaged credentials driving breaches across cloud, SaaS, and AI systems. Without strong key hygiene, attackers can pivot quickly from one exposed secret to total compromise. |
How to keep your keys and secrets under control: |
-
Centralize secrets in a vault to prevent hardcoded credentials.
- Automate key rotation to limit attacker opportunities.
- Apply least privilege so only necessary users access secrets.
- Monitor for exposure with tools that detect leaked secrets.
-
Enforce MFA on admin accounts managing critical keys.
- Audit and remove stale or unused credentials regularly.
|
Centralizing, rotating, and monitoring keys reduces risk and keeps critical systems secure when built into daily operations. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
