The cyber undercurrents are shifting, Digital Defenders. |
AI leaks secrets, npm turns to bait, and WordPress sites fall prey. Payroll heists and dark web takedowns prove even trusted tools can’t be trusted. |
|
|
Here’s what you need to know: |
|
|
GitHub Copilot Flaw Enables Silent Code Theft |
GitHub has already released a fix for the vulnerability.
Restrict AI assistant privileges, disable unverified rendering features, and train developers to treat all pull request content as untrusted input. |
175 npm Packages Abused in Phishing Operation |
Researchers at Socket uncovered Beamglea, a phishing campaign that used the npm registry and unpkg CDN to spread 175 malicious packages with over 26,000 downloads.
Aimed at 135+ firms across Europe and APAC, the campaign used trusted npm delivery to redirect users to fake, pre-filled login pages, showing how legitimate developer platforms can be weaponized for silent attacks. The research team contacted npm to have the packages removed.
Restrict npm dependencies to vetted sources, implement automated package integrity checks, and educate developers to spot typosquatting or suspicious package naming patterns. | Thousands of WordPress Sites Vulnerable to Admin Takeover |
A critical flaw in the Service Finder Bookings plugin lets unauthenticated attackers gain admin access and seize control of WordPress sites.
CVE-2025-5947 arises from an authentication bypass in the plugin’s account-switching function that fails to validate cookies. With over 6,000 sites affected, attackers are automating exploits for data theft, malware, and SEO spam. A patch has been released for the vulnerability.
Update to the latest version, review site logs for suspicious “switch_back” activity, and enable a web application firewall (WAF) to block future exploitation attempts. |
|
|
Website Defense Check: How ready is your site? |
|
|
Yesterday's Pulse Check Results |
APT Readiness Check: Could your defenses outlast a nation-state attack? |
|
|
Security Tools You Can Use |
|
|
Payroll Pirates Plunder University Paychecks |
Microsoft uncovered a Storm-2657 campaign hijacking university accounts to redirect payroll deposits to attacker-controlled banks.
Dubbed “payroll pirate” attacks, the campaign exploits weak MFA and phishing to compromise HR platforms like Workday, alter payroll data, hide alerts, and add attacker MFA devices—stealing paychecks and identities across US universities. |
This is an active attack in the wild. Use phishing-resistant MFA for HR and finance roles, audit inbox and payroll changes, and monitor SaaS and email logs for early compromise detection.
|
FBI Seizes BreachForums Tied to Salesforce Data Leaks |
The FBI and French authorities seized the BreachForums domain run by ShinyHunters.
The takedown disrupted a major cybercrime hub tied to Scattered Spider and Lapsus$, seizing data and servers from 2023. Yet the group’s dark website remains active, underscoring growing global cooperation—and how quickly decentralized threat actors adapt.
The threat actor group told BleepingComputer that it will continue to leak data from organizations that do not pay ransom demands. Strengthen defenses by monitoring leaks, enforcing MFA, and using layered security to reduce exposure to extortion campaigns. |
|
|
AI-driven attacks are increasing, highlighting the need for stronger identity security. Learn how Duo’s security-first IAM protects against evolving threats. |
|
|
Is Your Website as Secure as You Think? |
With attacks surging, even small businesses face risks of data theft and ransomware as threat actors exploit weak passwords, outdated plugins, and unpatched flaws. Strengthening your site’s defenses now can protect against costly breaches and downtime later. |
How to lock down your website defenses: |
-
Secure and harden systems: Use HTTPS, CSP, and DNSSEC to protect data, regularly patch and test software, and strengthen configurations to prevent exploitation.
-
Control access and authentication: Enforce multi-factor authentication (MFA), restrict administrative privileges, and train employees to recognize social engineering tactics.
-
Monitor, back up, and respond quickly: Implement continuous monitoring and a web application firewall (WAF), maintain secure backups, and ensure rapid incident response to contain threats.
|
Together, these measures create a stronger, more resilient security posture against emerging threats. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
