The cyber battlefield isn’t easing up, Digital Defenders. |
This week brings silent tenant hijacks, hacktivists turning public data into weapons, AI-themed stealers slipping past defenses, mobile RATs emptying wallets, and identity breaches hitting high-visibility sectors. And that’s only the surface of what’s moving in the shadows… |
|
|
Here’s what you need to know: |
|
|
Microsoft Teams Guest Access Opens Dangerous Security Blind Spot |
A newly identified flaw in Teams’ cross-tenant model lets attackers pull users into malicious tenants with all Defender protections disabled. Once inside an attacker-controlled tenant, users lose Safe Links, Safe Attachments, and URL scanning — and their organization sees none of the activity. |
There are no reports of this being exploited in the wild.
Restrict external collaboration, enforce cross-tenant policies, require MFA, and regularly audit guest activity to limit exposure to untrusted or insecure Microsoft Teams tenants. | Hacktivists Weaponize Public Data to Target Tech Workers |
A Middle Eastern hacktivist group, Handala, has published a list of Israeli tech and aerospace workers, mixing scraped public data with fabricated accusations and offering bounties for more details.
The campaign signals a shift from broad rhetoric to direct targeting of private-sector employees, revealing how easily LinkedIn and other open sources can fuel intimidation and reputational harm. This is an active campaign in the wild and shows that even inaccurate or fabricated entries gain credibility when mixed with real data.
Notify affected employees, tighten their privacy settings, and monitor for phishing or impersonation attempts to reduce the risk of harassment or identity misuse. |
Xillen Stealer Expands Targeting With AI-Themed Evasion Tactics |
A major Xillen Stealer update adds AI-themed evasion and expands its data collection across cloud services, developer tools, VPN clients, and even biometric files. Xillen’s polymorphic Rust engine and simulated user behavior make it harder for EDR and behavioral-based tools to detect. The malware is active in the wild. Enforce phishing-resistant MFA, secure developer environments, strengthen behavioral monitoring, and tighten exfiltration controls. |
|
|
How prepared is your org when hacktivists target employees? |
|
|
Yesterday's Pulse Check Results |
How confident are you in your org’s credential hygiene right now? |
|
|
Security Tools You Can Use |
-
Kickstart your IT career — earn essential certifications from A+ through CySA+ in one complete training bundle.
-
Don’t let hidden flaws become your downfall — see which vulnerability tools catch threats before attackers do.
- Move faster than your adversaries — uncover tools that let you harden your environment before attacks land.
|
|
|
Albiriox Android RAT Enables Full Device Takeover for Fraud |
The fast-spreading Albiriox Android malware gives attackers real-time control of victims’ phones, enabling large-scale financial fraud across 400+ banking, payment, and crypto apps.
Unlike older mobile Trojans, Albiriox pairs full RAT control with evolving overlay attacks, allowing attackers to operate inside legitimate sessions and bypass authentication and fraud checks. |
This is an active campaign in the wild. Strengthen mobile threat detection, harden authentication, and educate users about sideloading risks. |
Compromised Admin Account Exposes French Football Federation Data |
A compromised privileged account gave attackers access to the French Football Federation’s management platform, allowing them to steal extensive member and licensee data.
The breach highlights an increase in identity-based attacks, especially in high-visibility sectors where centralized systems hold valuable PII that can drive phishing and fraud. The investigation into the attack is ongoing.
Enforce MFA, tighten privileged access controls, and continuously monitor administrator account activity. |
|
|
From threat detection to AI security, see how AWS and AWS Partners build trusted, secure solutions—live at AWS re:Invent. |
|
|
Are you reducing your digital footprint enough? |
Threat actors use OSINT — publicly available online data — to profile employees, fuel phishing campaigns, and build targeted harassment campaigns. Reducing your digital footprint is now essential as attackers increasingly automate data collection across social networks, data breach dumps, and public corporate pages. |
How to reduce what attackers can see: |
- Limit public-facing information by restricting social media visibility, minimizing LinkedIn details, and keeping corporate bios lean.
- Remove unnecessary digital traces by scrubbing old accounts with data broker removal tools and using alias emails for nonessential sign-ups.
- Reduce location exposure by disabling geotagging on photos, apps, and devices.
|
Reducing your digital footprint makes it harder for attackers to build accurate profiles, fabricate narratives, or craft believable phishing lures. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
