The threats keep evolving, Digital Defenders. |
Today’s news brings disk-level exploits, an active Linux flaw, zero-click email hijacks, cryptojacking hidden in Windows tools, and AI platforms twisted for phishing. |
|
|
Here’s what you need to know: |
|
|
Hackers Exploit Raw Disk Reads to Evade Security Tools |
Researchers have discovered a technique that enables attackers to steal Windows files by reading raw disk data, thereby bypassing normal system calls. The technique bypasses EDR, file permissions, and even VBS, leaving it nearly invisible to traditional monitoring. |
Workday’s researchers also warned that attackers with admin rights or a vulnerable driver can rebuild files like the SAM hive by parsing NTFS disk sectors. This specific vulnerability is not reported in the wild yet, but there has been a rise in driver-based attacks.
Use full disk encryption and monitor raw access with Sysmon to close this blind spot. |
CISA Flags Linux Kernel Flaw Under Active Exploitation |
CISA has warned of an actively exploited Linux kernel race condition (CVE-2025-38352).
This Time-of-Check Time-of-Use (TOCTOU) flaw lets attackers escalate privileges, alter data, or crash systems, impacting confidentiality, integrity, and availability. With Linux powering servers, cloud, Android, and IoT, the attack surface is vast. Federal agencies must patch by Sept. 25, and all organizations are urged to act immediately. This vulnerability is being actively exploited in the wild. Check with your Linux vendor for updates and prioritize patching high-value assets first. |
Zero-Click Punycode Flaw Lets Hackers Hijack Accounts Instantly |
Researchers uncovered a critical zero-click flaw that hijacks accounts by exploiting Unicode and Punycode in email addresses. This “canonicalization mismatch” flaw breaks password resets and magic links, giving attackers full account access with no user interaction.
Attackers register look-alike Unicode domains to divert password reset links, silently seizing accounts. Since email anchors digital identity, a single breach can trigger wider compromises. This specific attack is not being seen in the wild yet, but zero-click attacks are becoming more prevalent.
Standardize email handling across systems and use validation libraries to catch Unicode confusables. |
|
|
How do you handle Linux kernel updates? |
|
|
Yesterday's Pulse Check Results |
AI Exposure Check: How secure are your deployments? |
|
|
Security Tools You Can Use |
-
Threats move fast—your defenses should move faster. Discover how top vulnerability tools minimize risk.
-
If it’s connected, it’s a target. Learn how NinjaOne secures and simplifies every endpoint.
-
Your data is everywhere… and hackers know it. See how Incogni erases personal information to restore your privacy.
|
|
|
Malware Hides in Windows Character Map to Mine Crypto |
A new cryptomining malware strain has been discovered that abuses Windows’ built-in Character Map (charmap.exe) to stealthily execute payloads.
An obfuscated PowerShell script drops an AutoIt loader that injects NBMiner into charmap.exe, bypassing Windows Defender and secretly mining through a trusted Microsoft process. |
Darktrace was able to disrupt this attack, but cryptojacking attacks continue to be seen in the wild. Watch for unusual process injections into benign Windows binaries and resource spikes to detect cryptojacking early. |
Hackers Exploit AI Platforms to Phish Microsoft 365 Credentials |
Cato Networks warns cybercriminals are exploiting trusted AI platforms for stealthy phishing. Attackers used Simplified AI to host fake Microsoft 365 portals and steal enterprise credentials.
By abusing trusted AI services, attackers evaded defenses and breached a US investment firm, highlighting the rising risks of “shadow AI.” Cato Networks stated the phishing campaign is no longer active. Treat AI traffic as untrusted—monitor use, enforce MFA, and inspect even trusted platforms. |
|
|
Move from reactive to proactive security. This guide to Security Automation Best Practices shows you how to streamline operations, reduce analyst fatigue, and improve your security posture. Learn to automate threat detection, vulnerability management, and more. Get your complimentary ebook and start building a stronger defense. |
|
|
How Safe Is Your Kernel From Active Exploits? |
With Linux powering servers for cloud environments, kernel flaws are prime targets…and recent exploits show how fast attackers strike. Kernel resilience is key to shrinking attack surfaces and protecting business continuity. |
Here’s how to strengthen your Linux kernel defenses |
-
Apply kernel patches promptly to close known vulnerabilities before attackers exploit them.
- Test patches in a controlled environment to ensure stability before rollout.
- Restrict and monitor root/sudo accounts to limit privilege escalation risks.
- Use SELinux or AppArmor to enforce strict access policies.
- Segment critical Linux servers from general networks to contain breaches.
- Monitor unusual processes or crashes to detect kernel-level attacks early.
|
Combining these practices strengthens Linux resilience, preventing core flaws from becoming enterprise-wide compromises. Treat kernel security as a foundation, not an afterthought. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
