The cracks aren’t always where you expect them. |
This week’s stories trace how trust, visibility, and detection can quietly fail — from edge devices and browser add-ons to identity systems and security tooling — often without tripping alarms until it’s too late.
👉 Tell us what’s worth your time (and what’s not) in 60 seconds. |
|
|
Here’s what you need to know: |
|
|
Fortinet Security Appliances Targeted in Active Exploitation |
Threat actors are actively exploiting multiple Fortinet vulnerabilities to bypass authentication controls and gain full administrative access to exposed security appliances. The activity targets widely deployed, internet-facing Fortinet edge systems, including FortiWeb and FortiCloud-integrated products. |
Fortinet has released patches for the vulnerabilities
Patch affected Fortinet systems immediately, restrict or disable exposed management interfaces, review logs for exploitation indicators, and harden or limit FortiCloud SSO to reduce identity-driven blast radius. |
SoundCloud Breach Exposes Millions of User Accounts |
SoundCloud disclosed a breach after access disruptions revealed unauthorized access to an internal dashboard containing user data. Although no passwords or financial data were exposed, the incident may have impacted roughly 28 million users by leaking email addresses and public profile details. SoundCloud says it has contained the incident, blocked access, and engaged third-party experts. Educate users on phishing risks, lock down non-core systems with least privilege, and strengthen identity controls and monitoring. |
Malware Hid in Firefox Extension Icons, Hits 50K Users
|
Researchers uncovered a large-scale malware campaign that quietly compromised more than 50,000 Firefox users by hiding malicious code inside extension icon files. GhostPoster abused trusted browser extensions, often free utilities, to hide JavaScript inside icon files. This allowed attackers to bypass scans and reviews and deliver a multi-stage payload capable of surveillance, security control removal, and remote code execution.
Restrict extensions with allowlists, audit and monitor their behavior closely, and integrate browser telemetry into security tooling to quickly detect and block malicious activity. |
|
|
When a critical zero-day drops, what actually happens first in your org? |
|
|
Yesterday's Pulse Check Results |
Where does your environment stand on React2Shell right now? |
|
|
Security Tools You Can Use |
|
|
Moonwalk++ Dances Past EDR by Spoofing Call Stacks |
Moonwalk++ shows how in-memory malware can spoof Windows call stacks to evade modern EDR detection. This is concerning because many enterprise defenses rely on stack-based telemetry that Moonwalk++ deliberately defeats, with testing showing common tools failed to detect the technique despite no vulnerability being exploited.
|
This is currently a research proof-of-concept and not actively exploited in the wild.
Layer call stack telemetry with memory, behavior, and process monitoring, and regularly test detections through adversary emulation. |
Google Kills Dark Web Monitoring Tool |
Google is shutting down its Dark Web Report tool after determining it did not provide meaningful protection or guidance. The shutdown affects millions of Gmail and Google One users, removing a visibility layer many relied on to detect leaked personal data. While Google cited vague and overwhelming alerts as justification and plans to refocus on clearer security tools, the loss of dark web monitoring leaves users more likely to miss exposure until after compromise.
Inventory which identities and emails you monitor today, then migrate them now to an external breach-monitoring service with clear remediation workflows before coverage disappears. |
|
|
What Happens When Your Personal Data Is Exposed? |
For individuals today, personal data exposure is no longer a question of if it will happen, but when. When your personal data is exposed, attackers often move quickly to exploit it through phishing, account takeovers, or identity fraud. |
How to secure your identity after a data breach: |
-
Secure affected accounts by changing exposed passwords immediately, using a password manager, enabling multi-factor authentication (MFA).
-
Reduce identity fraud risk by monitoring for credential abuse, placing credit freezes or fraud alerts, and reviewing account activity for suspicious behavior.
- Stay alert for follow-on attacks by treating breach-related messages with skepticism and watching closely for phishing or social engineering attempts.
|
Acting quickly after your data is exposed limits exploitation opportunities and reduces the risk of identity fraud. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2025 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
