The shadows are busy, Digital Defenders. |
Today's news brings hijacked editors, stealthy DNS tricks, weaponized installers, poisoned ads, and job fraud. The tactics are evolving… are your defenses keeping pace? |
|
| Here’s what you need to know: |
|
|
Notepad++ Zero-Day Leaves Millions Exposed to Hijacking |
Hackers don’t need to guess anymore—Notepad++ is wide open. A newly exposed flaw (CVE-2025-56383) lets attackers hijack DLLs to run malicious code, and a public PoC means millions of installs are already at risk.
With a proof-of-concept (PoC) already publicly available, the risk (CVE-2025-56383) affects millions of installations worldwide. |
Enterprise deployments are especially vulnerable since compromised editors can be leveraged as persistence mechanisms or launchpads for ransomware. No patch has been released yet for the vulnerability.
Use file integrity monitoring on plugin folders and alert on DLL changes—early visibility is key to catching intrusions. |
Dynamic DNS Abuse Fuels Stealthy Command-and-Control Networks |
Threat actors are exploiting Dynamic DNS to build resilient command-and-control (C2) infrastructure.
With lax provider checks, attackers spin up more than 70,000 malicious subdomains—used by APT28, APT29, and Scattered Spider—to persist and bypass defenses. These domains are being used as part of C2 in the wild.
Baseline outbound traffic and alert on DDNS connections. Early visibility can expose compromises before data theft or ransomware. |
Weaponized Teams Installer Delivers Oyster Backdoor Malware |
Hackers are using a fake Microsoft Teams installer in a sophisticated malvertising campaign to deploy the Oyster backdoor, also known as Broomstick or CleanUpLoader.
A poisoned Bing ad redirected users to a spoofed site that delivered a signed malicious executable. Short-lived certificates bypassed detection, but Defender’s ASR blocked the C2 traffic—though researchers warn such campaigns are becoming more frequent. Tighten endpoint controls. Enable ASR or similar behavior-based defenses to block signed malicious binaries before they can persist. |
|
|
When malware phones home, who answers first? |
|
|
Yesterday's Pulse Check Results |
If attackers hit your CI/CD pipeline with DoS today, what happens? |
|
|
Security Tools You Can Use |
-
Build a resilient security foundation by uniting MDM, encryption, antivirus, and backup in one suite.
-
Protect every account with Keeper Security, offering unlimited password storage, seamless sync, secure sharing, and biometric login in one trusted platform.
-
Strengthen network resilience with a customizable DNS and DHCP policy that enforces security, ensures uptime, streamlines compliance, and deploys in minutes.
|
|
|
Malicious Ads Deliver Trojanized Installers via Service Workers |
Paid Facebook and Google ads promoted trojanized finance apps that delivered a multi-stage loader and the Oyster backdoor via service-worker downloads. Bitdefender found attackers using StreamSaver.js, oversized installers, anti-sandbox checks, and rotating domains to evade analysis. |
Source: Will Francis/Unsplash |
By abusing trusted ads and branding, they targeted high-value users, bypassed browser safeguards, and set persistent tasks to disable Defender and run PowerShell. This is an active attack in the wild. Monitor for StreamSaver.js file writes, flag unusual scheduled tasks (e.g., EdgeResourcesInstallerV12-issg), and enforce allowlisting with restricted PowerShell use. |
North Korea’s 'DeceptiveDevelopment' Targets Developers With Job Fraud |
A North Korea–aligned campaign called Deceptive Development is combining malware delivery with fraudulent recruitment to compromise developers, especially in the crypto and Web3 sectors.
The campaign operates on two tracks: fake recruiters deliver malware, while WageMole operatives use stolen identities to secure remote jobs, thereby gaining insider access.
Treat recruiting and onboarding as attack surfaces: verify identities with liveness checks, monitor new hires for anomalies, and block terminal commands in web interviews. |
|
|
Elastio with AWS ensures clean, proven recovery from ransomware. AWS delivers scale and secure storage, while Elastio adds behavior-based detection and continuous validation. The result: audit-ready, uncompromised recovery points you can trust. Don’t assume your data is safe—prove it. |
|
|
Strengthen Your DNS Security Today |
DNS attacks are surging as adversaries hijack queries, poison caches, and exploit dynamic DNS to mask malicious infrastructure. As the backbone of internet traffic, DNS flaws give attackers easy entry—protecting it is essential, not optional. |
Here's how to lock down your DNS defenses: |
-
Enable DNSSEC & resolvers: Sign records and use trusted resolvers to block spoofing.
- Monitor with logs & feeds: Track queries and spot malicious activity early.
- Restrict & segment services: Limit exposure to trusted networks and reduce leakage.
- Apply proactive controls: Combine monitoring, validation, and segmentation to harden DNS.
|
Strong DNS hygiene blocks exploits, improves visibility, and limits attacker persistence. Small steps today can prevent massive breaches tomorrow. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
