The shadows are moving again, Digital Defenders. |
This week brings delayed breach warnings, inherited AI flaws hiding in plain sight, guardrails that can be flipped with a single token, and threat actors who now target identities more than systems. The attacks are getting quieter… and far more personal. |
|
|
Here’s what you need to know: |
|
|
DoorDash Breach Exposes Millions to Social Engineering Fallout |
DoorDash confirmed a social-engineering breach that shared user contact details in four countries. Attackers tricked a DoorDash employee to access internal systems, exposing names, addresses, phone numbers, and emails. |
DoorDash took several weeks to notify impacted users, which has caused backlash across social media.
Use phishing-resistant MFA, help-desk verification, realistic social-engineering training, least-privilege access, and UEBA monitoring. |
ShadowMQ Flaws Ripple Across Leading AI Frameworks |
Oligo researchers uncovered widespread RCE risks across major AI inference frameworks tied to unsafe ZeroMQ communication and Python pickle deserialization.
The ShadowMQ flaw spread as projects like Llama Stack, TensorRT-LLM, vLLM, SGLang, and Modular Max reused the same vulnerable code — sometimes verbatim. Vendors have issued patches for some of the vulnerabilities. Harden your AI stack by patching frameworks, eliminating unsafe serialization, securing ZMQ channels, limiting exposure, and using monitoring. |
EchoGram Attack Silently Flips AI Guardrail Decisions |
HiddenLayer researchers discovered EchoGram, a new attack that silently flips AI guardrail decisions meant to block harmful prompts.
By adding simple flip tokens like =coffee, attackers can make malicious prompts appear safe or flood systems with false positives. The attack exploits token-distribution biases in guardrails, allowing EchoGram to bypass defenses across many LLM platforms. There are no reports of this being exploited in the wild.
Strengthen guardrails with diverse training, layered defenses, adversarial testing, hardened input handling, anomaly monitoring, and zero-trust deployments. |
|
|
Breach Wake-Up Test: How fast would YOU want to be alerted? |
|
|
Yesterday's Pulse Check Results |
How confident are you in spotting rogue accounts before they spread? |
|
|
Security Tools You Can Use |
|
|
Iranian SpearSpecter Campaign Targets Global Government Leaders |
A newly uncovered Iranian espionage campaign is using slow-burn social engineering and fileless malware to compromise senior government, military, and defense officials worldwide.
Attributed to Iran’s APT42, the SpearSpecter campaign builds weeks-long WhatsApp rapport before sending malicious invite links, then deploys a stealthy PowerShell backdoor to exfiltrate data via legitimate cloud services. |
This is an active campaign in the wild. Boost visibility, train staff, disable search-ms, tighten network monitoring, and harden endpoints. |
How the Criminal Online Marketplace Became a Cybercrime Powerhouse |
Researchers warn the English-speaking COM has evolved from niche username forums into a full cybercrime-as-a-service ecosystem powering SIM-swapping, ransomware, account takeovers, and major data breaches.
What started on forums like OGUsers and RaidForums now powers hybrid crews such as Scattered Lapsus$ Hunters, blending social engineering, breach tooling, and public extortion. With COM actors shifting to Telegram and aligning with Russian ransomware groups, identity-focused attacks now outpace perimeter defenses that fail to protect people and workflows.
Require phishing-resistant MFA, lock-down help-desk workflows, use zero-trust controls, tailor training, and harden cloud environments. |
|
|
Can Your Security Keep Up with Evolving Threat Groups? |
Cybercriminal groups are rapidly maturing into service-driven, identity-focused operations that combine social engineering, data theft, and extortion at scale. Their tactics evolve faster than traditional defenses, making it critical for organizations and individuals to adopt adaptive, human-centric security habits. |
How to strengthen your defenses against cybercriminals: |
- Strengthen identity security with phishing-resistant MFA, SIM-swap monitoring, and just-in-time access to limit credential theft and unauthorized privilege use.
-
Lock down human-facing workflows by enforcing strict help-desk verification and running frequent security micro-drills to improve resistance to social engineering.
- Enhance detection and response with UEBA and behavioral monitoring to quickly spot account takeover attempts or insider-style anomalies.
|
Staying ahead of modern cybercriminal groups requires strengthening identity protections and building cyber resilience. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
