Not all breaches start with malware anymore, Digital Defenders. |
Some emerge from calendars you forgot, networks you trusted, and tools you rely on to build software. This week, everyday conveniences are turning into attack vectors — and threat actors are already taking advantage. |
|
|
Here’s what you need to know: |
| |
Coupang Breach Impacts Almost 34 Million Customers |
A major data incident in South Korea has escalated after Coupang confirmed that nearly 34 million customer records were exposed.
Investigators now believe the breach may involve insider misuse or unauthorized internal access. |
With names, phone numbers, addresses, and order histories exposed, authorities warn the data could drive large-scale phishing, impersonation scams, and fraud.
Regularly audit privileged access, tighten monitoring for abnormal behavior, encrypt sensitive data in-transit and at rest, and train users to spot phishing attempts. |
Hidden Calendar Flaw Exposes Millions of Apple Devices |
New research shows that abandoned calendar subscriptions are emerging as a stealthy delivery channel for attacks, putting millions of devices at risk.
Bitsight found over 390 expired calendar domains still receiving sync requests from about 4 million devices, potentially allowing attackers to re-register them and silently push malicious .ics events. There are no reports of the flaw being exploited in the wild. Audit and remove risky calendar subscriptions, block malicious .ics traffic, harden devices, and train users to recognize calendar-based phishing. |
Shai-hulud Malware Turns npm Installs Into Supply Chain Threat |
A new Shai-hulud variant is using trusted npm installs as a launchpad for multi-cloud credential theft and large-scale package backdooring.
By abusing the npm preinstall hook, the malware deploys a stealthy payload that steals multi-cloud and developer credentials, then uses them to spread through the software supply chain. This is an active campaign in the wild.
Enforce strong identity controls, monitor CI/CD and cloud activity for unauthorized changes, and tightly audit npm packages and secrets to prevent attackers from turning developer pipelines into a supply chain backdoor. |
|
|
How confident are you in your org’s playbook for a large-scale breach? |
|
|
Yesterday's Pulse Check Results |
How prepared is your org when hacktivists target employees? |
|
|
Security Tools You Can Use |
-
Don’t let unseen weaknesses put you at risk — find out which vulnerability tools expose threats before attackers do.
-
Stay ahead of attackers — discover tools that help you harden systems before threats strike.
-
Build job-ready IT skills and earn certifications from A+ through CySA+ with one all-in-one learning package.
|
|
|
Evil Twin Wi-Fi Operator Jailed for Large-Scale Credential Theft |
An Australian man was sentenced to over seven years in prison for operating fake Wi-Fi networks that stole travelers’ social media credentials and private data.
The man used a Wi-Fi Pineapple to clone airport SSIDs across multiple cities, causing devices to auto-connect and capture logins through a fake captive portal — giving him access to victims’ personal accounts and intimate data, according to the Australian Federal Police. |
Use a VPN, disable auto-connect, avoid logging into suspicious sites, and keep devices locked down with strong passwords and patching. |
Fake Windows Update Scam Delivers Multistage JackFix Malware |
Attackers are using full-screen fake Windows Update pages on spoofed adult websites to trick users into running clipboard commands that install a multistage malware stack.
The JackFix campaign uses convincing system UI and staged PowerShell payloads to push multiple infostealers and RATs at once, exploiting social pressure to bypass user suspicion. This is an active campaign in the wild.
Lock down endpoints with allowlisting, restrict risky scripting tools, tighten DNS/web filtering, enhance PowerShell and EDR visibility, enforce least privilege with strong credential hygiene, and train users to spot fake system prompts and full-screen browser scams. |
|
|
Builds taking too long? Users hitting invisible bugs?
Boost Mobile Dev Velocity with CI/CD & Observability Best Practices, live December 11, 2025, at 1:00 PM ET, shows how teams eliminate bottlenecks and deliver faster, higher-quality apps. Join peers optimizing mobile performance. |
|
|
Do You Have a Strong Data Breach Response Plan? |
Data breaches are happening faster as adversaries begin to use AI in their attacks. When millions of records can be exfiltrated in minutes, organizations need a mature, disciplined response plan that limits damage and stops attackers from capitalizing on their initial foothold. |
Source: Markus Spiske/Unsplash |
Simple steps to contain and manage a breach: |
-
Activate your incident response (IR) plan with clear role ownership and a structured communication workflow.
-
Contain the breach by segmenting and isolating affected assets, automating isolation response, and rotating all privileged, machine, and API credentials to protect against credential abuse.
-
Strengthen detection by collecting high-fidelity telemetry and launching targeted threat hunting for abnormal behavior.
|
With AI accelerating the speed and impact of modern attacks, strengthening disciplined response and preparedness has become essential for true cyber resiliency. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
