Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Breach. Show all posts
Oracle E-Business Suite
American Airlines cyberattack Clop Ransomware Data Breach Data Leak Envoy Air data breach Oracle E-Business Suite

Envoy Air Confirms Oracle Data Breach After Clop Ransomware Group Lists American Airlines on Leak Site

 

kEnvoy Air, a regional carrier owned by American Airlines, has confirmed that data from its Oracle E-Business Suite application was compromised following claims by the Clop extortion group, which recently listed American Airlines on its data leak site.

"We are aware of the incident involving Envoy's Oracle E-Business Suite application," Envoy Air told BleepingComputer.

"Upon learning of the matter, we immediately began an investigation and law enforcement was contacted. We have conducted a thorough review of the data at issue and have confirmed no sensitive or customer data was affected. A limited amount of business information and commercial contact details may have been compromised."

Envoy Air operates regional flights for American Airlines under the American Eagle brand. Although it functions as a separate entity, its operations are closely integrated with American’s systems for ticketing, scheduling, and passenger services.

The Clop ransomware group has begun leaking what it claims to be stolen Envoy data, posting the message: “The company doesn’t care about its customers, it ignored their security!!!” This breach is tied to a wider campaign that began in August, in which Clop targeted Oracle E-Business Suite systems and began sending extortion demands to affected companies in September.

Initially, Oracle said that attackers were exploiting vulnerabilities patched in July. However, the company later confirmed that the threat actors took advantage of a previously unknown zero-day flaw, now identified as CVE-2025-61882.

Cybersecurity firms CrowdStrike and Mandiant later reported that Clop exploited the flaw in early August to infiltrate networks and install malware. While the total number of victims remains unclear, Google’s John Hultquist told BleepingComputer that “dozens of organizations” were affected.

The extortion gang is also targeting Harvard University as part of the same operation. The university confirmed to BleepingComputer that the breach affected “a limited number of parties associated with a small administrative unit.”

Adding to the concerns, Oracle quietly patched another zero-day flaw—CVE-2025-61884—in its E-Business Suite last week, which had been actively exploited since July 2025. The exploit was reportedly leaked by the Shiny Lapsus$ Hunters group on Telegram.

American Airlines has previously faced data breaches in 2022 and 2023, which exposed employee personal data.

Who is Clop?

The Clop ransomware group, also known as TA505, Cl0p, or FIN11, has been active since 2019. It initially used a variant of the CryptoMix ransomware to infiltrate corporate networks and steal information.

Since 2020, the group has shifted its focus to exploiting zero-day vulnerabilities in file transfer and data storage platforms. Notable campaigns include:

  • 2020: Accellion FTA zero-day attack impacting nearly 100 companies
  • 2021: SolarWinds Serv-U FTP zero-day exploit
  • 2023: GoAnywhere MFT zero-day breach affecting 100+ firms
  • 2023: MOVEit Transfer campaign, their largest to date, compromising data from 2,773 organizations worldwide
  • 2024: Exploited Cleo file transfer zero-days (CVE-2024-50623 and CVE-2024-55956) for data theft and extortion

The U.S. State Department is currently offering a $10 million reward for information linking Clop’s ransomware operations to any foreign government.
Read more »
Sotheby
Data Breach Employee Data Financial Information Ransomware Sotheby

Sotheby’s Investigates Cyberattack That Exposed Employee Financial Information

 



Global auction house Sotheby’s has disclosed that it recently suffered a data breach in which cybercriminals accessed and extracted files containing sensitive information. The company confirmed that the security incident, detected on July 24, 2025, led to unauthorized access to certain internal data systems.

According to a notification filed with the Maine Attorney General’s Office, the compromised records included details such as full names, Social Security Numbers (SSNs), and financial account information. While the filing listed only a few individuals from the states of Maine and Rhode Island, the overall number of people affected by the breach has not been publicly confirmed.

Sotheby’s stated that once the intrusion was identified, its cybersecurity team immediately launched a detailed investigation, working alongside external security experts and law enforcement authorities. The process reportedly took nearly two months as the company conducted a comprehensive audit to determine what type of information was taken and whose data was affected.

In its notice to those impacted, the company wrote that certain Sotheby’s data “appeared to have been removed from our environment by an unknown actor.” It added that an “extensive review of the data” was carried out to identify the affected records and confirm the individuals connected to them.

As a precautionary measure, Sotheby’s is offering affected individuals 12 months of free identity protection and credit monitoring services through TransUnion, encouraging them to register within 90 days of receiving the notification letter.

Initially, it was unclear whether the compromised data involved employees or clients. However, in an update on October 17, 2025, Sotheby’s clarified in a statement to BleepingComputer that the breach involved employee information, not customer data. The company emphasized that it took the incident seriously and immediately involved external cybersecurity experts to support the response and remediation process.

“Sotheby’s discovered a cybersecurity incident that may have involved certain employee information,” a company spokesperson said in an official statement. “Upon discovery, we promptly began an investigation with leading data protection specialists and law enforcement. The company is notifying all impacted individuals as required and remains committed to protecting the integrity of its systems and data.”

Sotheby’s is among the world’s most recognized auction houses, dealing in high-value art and luxury assets. In 2024, the firm recorded total annual sales of nearly $6 billion, highlighting the scale and sensitivity of the data it manages, including financial and transactional records.

Although no ransomware groups have claimed responsibility for this breach so far, similar attacks have previously targeted high-end auction platforms. In 2024, the RansomHub gang allegedly breached Christie’s, stealing personal data belonging to an estimated 500,000 clients. Such incidents indicate that cybercriminals increasingly view global art institutions as lucrative targets due to the financial and personal data they store.

This is not the first time Sotheby’s has dealt with cybersecurity issues. Between March 2017 and October 2018, the company’s website was compromised by a malicious web skimmer designed to collect customer payment information. A comparable supply-chain attack in 2021 also led to unauthorized access to sensitive data.

The latest breach reinforces the growing risks faced by major cultural and financial institutions that handle valuable client and employee data. As investigations continue, Sotheby’s has urged affected individuals to remain vigilant, review their financial statements regularly, and immediately report any suspicious activity to their bank or credit institution.


Read more »
phishing
Bitwarden Data Breach LastPass Master Password phishing

Fake Breach Alerts Target LastPass and Bitwarden Users to Hijack PCs

 

An ongoing phishing campaign is targeting users of LastPass and Bitwarden with fake breach alerts designed to install remote access tools on victims’ systems. The emails falsely claim that both password managers suffered security incidents and urge users to download a “more secure” desktop application to protect their data.

LastPass confirmed it was not hacked and labeled the messages as social engineering attempts meant to create urgency and prompt users to install malicious software. The campaign began over a holiday weekend to exploit reduced IT staffing and delay detection. Fake emails were sent from domains like hello@lastpasspulse[.]blog and hello@lastpasjournal[.]blog, mimicking official communication.

Similarly, Bitwarden users received nearly identical messages from hello@bitwardenbroadcast.blog, using the same urgent tone and lure of a secure desktop app update. Cloudflare has since blocked the phishing landing pages, identifying them as malicious.

The downloaded binaries install Syncro, a legitimate remote monitoring and management (RMM) tool, which then deploys ScreenConnect to enable remote access to the infected device. The Syncro agent is configured to hide its system tray icon and check in with the attacker’s server every 90 seconds, maintaining stealth. It disables security agents from Emsisoft, Webroot, and Bitdefender and avoids deploying other bundled tools like Splashtop or TeamViewer, focusing solely on gaining remote control.

Once connected via ScreenConnect, attackers can deploy additional malware, exfiltrate data, and access stored credentials from password managers. Syncro clarified that its platform was not breached; instead, attackers created a fraudulent MSP account to abuse the service. A separate phishing wave targeted 1Password users with similar tactics, redirecting them to onepass-word[.]com through a malicious email sent from watchtower@eightninety[.]com. 

Cybersecurity experts stress that users should never respond to such alerts via email and should verify security news only through official company websites and communications. Companies do not request master passwords, and any such demand is a definitive sign of phishing.
Read more »
User Privacy
Data Breach Fashion Retailer MANGO Spain User Privacy

MANGO Marketing Vendor Breach Exposes Customer Contact Details

 

MANGO, the Spanish fashion retailer, has disclosed a data breach affecting customer information due to a cyberattack on one of its external marketing service providers. The incident, revealed on October 14, 2025, involved unauthorized access to personal data used in marketing campaigns, prompting the company to notify affected customers directly.

The compromised data includes customers' first names, country of residence, postal codes, email addresses, and telephone numbers. Notably, sensitive details such as last names, banking information, credit card data, government-issued IDs, passports, and account credentials were not accessed, reducing the risk of financial fraud. Despite this, the exposed information could be leveraged by threat actors for targeted phishing campaigns, where attackers impersonate legitimate entities to trick individuals into revealing further personal or financial data.

MANGO emphasized that its corporate infrastructure and internal IT systems remained unaffected, with no disruption to business operations. The company confirmed that all security protocols were activated immediately upon detection of the breach at the third-party vendor, although the name of the compromised marketing partner has not been disclosed.

In response, MANGO has reported the incident to the Spanish Data Protection Agency (AEPD) and other relevant regulatory authorities, in compliance with data protection regulations. To assist concerned customers, the company has established a dedicated support channel, including an email address (personaldata@mango.com) and a toll-free hotline (900 150 543), where individuals can seek clarification and guidance regarding potential exposure.

Founded in 1984 and headquartered in Barcelona, MANGO operates over 2,800 physical and e-commerce stores across 120 countries. It employs approximately 16,300 people and generates an annual revenue of €3.3 billion, with nearly 30% derived from online sales. While the breach does not impact core business systems, the incident highlights the growing risks associated with third-party vendors in digital supply chains, particularly in the retail and fashion sectors that rely heavily on external marketing and customer engagement platforms.

At the time of reporting, no ransomware group has claimed responsibility for the attack, and the identity of the attackers remains unknown. Local media outlets reached out to MANGO for further details on the scope and technical aspects of the breach but had not received a response by publication.
Read more »
SimonMed
Data Breach Medusa Ransomware Patient Data SimonMed

SimonMed Imaging reports data breach affecting over 1.2 million patients

 




U.S.-based medical imaging provider SimonMed Imaging has disclosed a cybersecurity incident that compromised the personal data of more than 1.2 million patients earlier this year. The company, which operates nearly 170 diagnostic centers across 11 states, specializes in radiology and imaging services such as MRI, CT scans, X-rays, ultrasounds, and mammography.


Details of the breach 

According to information shared with regulators, unauthorized individuals gained access to SimonMed’s internal systems between January 21 and February 5, 2025. The breach came to light on January 27, when one of SimonMed’s third-party vendors reported a security incident that also affected the company. An internal investigation confirmed suspicious network activity the following day.

SimonMed stated that once the attack was detected, the organization acted swiftly to contain the intrusion. Measures included resetting employee passwords, activating multifactor authentication, adding endpoint detection and response (EDR) tools, cutting off third-party vendors’ direct system access, and restricting external network connections to only verified sources. Law enforcement authorities were notified, and cybersecurity specialists were brought in to assist in the investigation and recovery process.


Data possibly exposed

While SimonMed has not disclosed the full scope of data accessed by the attackers, the company confirmed that patients’ full names were among the exposed information. Given the type of data typically stored in radiology systems, the breach may also involve sensitive records such as identification details, medical reports, and financial information.

As of October 10, SimonMed reported finding no evidence that the compromised data has been used for fraud or identity theft. Affected individuals have been offered free identity theft protection services through Experian as a precautionary step.


Ransomware group claims responsibility

Shortly after the breach, the Medusa ransomware group claimed responsibility, listing SimonMed on its leak site on February 7. The group alleged that it had stolen 212 gigabytes of data and released a small sample online as proof. The leaked files reportedly contained ID scans, patient information spreadsheets, billing details, and diagnostic reports.

Medusa demanded a ransom of $1 million, along with an additional $10,000 fee for each day the company delayed payment before full data disclosure. SimonMed’s name has since been removed from the group’s website, which often suggests that negotiations may have taken place. However, the company has not confirmed whether any ransom payment was made.


Growing threat to healthcare organizations

The Medusa ransomware operation, which surfaced in 2023, has been linked to several high-profile attacks on critical infrastructure, including the Minneapolis Public Schools and Toyota Financial Services. In March 2025, the FBI, CISA, and MS-ISAC jointly warned healthcare and education organizations about Medusa’s ongoing targeting campaigns.

Cybersecurity experts emphasize that healthcare institutions remain vulnerable due to the volume of sensitive data they handle. Experts recommend strengthening authentication protocols, monitoring system activity, and maintaining up-to-date security measures to minimize the risk of future incidents.


Read more »
Malwares
Cybersecurity Breach Data Breach data security Data Stolen Google Pixel Malware attacks Malwares

Pixnapping Malware Exploits Android’s Rendering Pipeline to Steal Sensitive Data from Google and Samsung Devices

 

Cybersecurity researchers have revealed a new Android malware attack called Pixnapping, capable of stealing sensitive information from Google and Samsung smartphones without any user interaction. The name “Pixnapping” blends “pixel” and “snapping,” referring to how the malware stealthily extracts visual data pixel by pixel from targeted apps. 

When a user installs an app laced with the Pixnapping malware, it silently scans the device for other apps to spy on—such as Google Authenticator. Instead of opening the target app directly, the malware leverages the Android rendering pipeline to intercept the visual data being displayed. It then analyzes the color and content of individual pixels in areas known to display confidential information, like two-factor authentication (2FA) codes. By interpreting these pixels, the malware reconstructs the original data—essentially taking “invisible screenshots” of protected content without ever triggering normal app permissions. 

According to researchers, three flaws in Android’s design enable Pixnapping. First, apps can invoke another app’s activity through the rendering pipeline, which allows unauthorized access to refresh sensitive screens. Second, Android permits graphical operations to be performed on another app’s displayed content. Third, apps can detect pixel color changes during these operations, revealing the hidden visual data. 

Tests confirmed Pixnapping’s success across several devices, including the Pixel 6, 7, 8, and 9, as well as the Samsung Galaxy S25, running Android versions 13 through 16. The malware’s efficiency varied across devices, achieving success rates between 29% and 73% on Pixel models. On the Galaxy S25, however, researchers couldn’t extract 2FA codes before they expired. The attack was also demonstrated on apps and services such as Gmail, Signal, Venmo, Google Accounts, and Google Maps—indicating that Pixnapping could potentially expose emails, encrypted messages, payment data, and location histories. 

The vulnerability is tracked as CVE-2025-48561. While Google has issued an initial patch, researchers found ways to bypass it, prompting Google to develop a stronger fix expected in the December Android security update.  

Fortunately, Pixnapping has not been detected in active attacks yet. Still, experts urge users to stay vigilant by updating their devices with the latest security patches and downloading apps only from verified marketplaces such as the Google Play Store. Even then, users should double-check app details to ensure authenticity and avoid sideloading unverified applications. 

Pixnapping underscores a critical flaw in Android’s visual data handling and highlights the growing sophistication of modern mobile malware. Until Google delivers a complete patch, maintaining cautious download habits and prompt software updates remains the best defense.
Read more »
WhatsApp Malware
Banking Trojan Cyber Threats Cybersecurity Data Breach Fileless Attack Financial Security Malware Campaign Social Engineering WhatsApp Malware

WhatsApp Worm Infects Devices and Compromises User Banking Information

 


There has been a troubling revelation in the cybersecurity community that cybercriminals continue to weaponise trusted digital ecosystems by deploying highly sophisticated malware campaigns that use WhatsApp's messaging platform to infiltrate users throughout Brazil, demonstrating that cybercriminals continue to use trusted digital ecosystems to their advantage. 

This large-scale operation, which was detected on September 29, 2025, exhibits unprecedented technical precision and social engineering skills, manipulating user trust in order to achieve rapid and silent propagation of the virus. There has been an increased use of WhatsApp Web by the attackers in attempts to propagate malicious LNK and ZIP files disguised as harmless attachments sent from compromised contacts. 

The attackers have chosen to send misleading messages that convincingly mimic genuine communication to lure their victims into execution. The moment that an unsuspecting recipient opens a file that contains malware on a desktop system, the malware stealthily executes a fileless infection chain, which is designed to steal credentials from financial institutions as well as cryptocurrency exchanges as they conduct their transactions. 

Researchers have determined that the campaign was linked to a broader operation known as "Water Saci," which shows a level of sophistication and scale not typically seen in regional cybercrime. There is evidence in the code of the malware, Maverick and Sorvepotel, that is code-like to the notorious Coyote Trojan, pointing to a new evolution of Brazilian cybercrime tools that target the thriving ecosystem of digital finance in the country. 

In contrast to typical attacks that are primarily focused on data theft and ransomware deployment, this particular operation places a high value on rapid self-propagation and wide infiltration. 

By cleverly leveraging social relationships, the infection process distributes malicious files through the accounts of already infected users to embed itself deeper into trusted networks as a result. It is estimated that over 400 corporate environments have already been compromised by this threat, and more than 1,000 endpoints have been affected, proving that the campaign's aggressive reach and operational efficiency are evident because command-and-control servers validate each download to ensure that it comes directly from the malware. 

Nevertheless, this technique complicates automated security analysis and network defence, making it significantly more difficult to detect and deter the threat. The malware was written primarily in Portuguese and distributed by localised URLs. As a result of its design, it suggests that a deliberate effort was made to target the individual consumer as well as corporate users in Brazil's rapidly growing cryptocurrency and financial sectors.

Besides the campaign's regional implications, this campaign serves as a stark reminder of the convergence that has been taking place in modern cyberattacks between social manipulation and advanced technical execution. 

With this new wave of WhatsApp-targeted malware exploiting trust, automation, and the interconnectedness of messaging platforms, people are witnessing a concerning shift in the cyber threat landscape, one where they can no longer assume the familiar is safe. It has been reported that the Sorvepotel malware has impacted many sectors throughout Brazil, not just individual users. The malware has penetrated a wide range of sectors throughout the country.

A Trend Micro cybersecurity researcher stated that public and government service organisations have been the most severely affected, followed by manufacturing, technology, education, and construction organisations. However, as attackers continue to refine and expand their tactics, other Latin American countries may soon have to face similar threats. 

Although the current campaign is focusing primarily on Brazil, experts warn that similar threats may soon impact other Latin American countries. There is no doubt that the Sovepotel infection chain is extremely deceptive. It spreads mainly through phishing messages sent via compromised contacts' WhatsApp accounts. It is common for these messages, which appear to come from trusted friends or colleagues, to contain malicious ZIP files, which appear as if they were legitimate files-such as receipts, budget documents, or health-related documents, written in Portuguese. 

These files are aimed at attracting enterprise users rather than casual mobile users, as they are urged to open them on desktop computers. Once the malware has been executed, it will spread automatically through WhatsApp Web, sending mass messages which will not only expedite its spread but will also lead to the suspension of infected accounts for excessive spam activity, as well as the spreading of the malware. 

Several researchers have noticed that, in addition to parallel phishing campaigns through email, attackers may also distribute ZIP files containing similar content from seemingly legitimate corporate addresses, increasing the likelihood of infection. There is already a substantial scale of operation, with over 400 customer environments reported as compromised, which is an indication that the worm has spread rapidly and is extremely effective in its operational aspects. 

By targeting Brazilian financial institutions and cryptocurrency exchanges, the group illustrates a deliberate effort to monetise itself by stealing credentials and gaining unauthorised access to financial resources, even though analysts warn that the same techniques can be adapted to other countries as well. Depending on the severity of the attack, financial consequences can range from immediate unauthorised withdrawals to long-term identity theft and the loss of a victim's reputation. 

Cybersecurity experts, for this reason, emphasise the need to adopt multilayered defence strategies. Educating users and organisations on how to keep them safe requires them to avoid suspicious links, even those shared by familiar contacts, as well as verify their authenticity by using alternative channels for communications. It is crucial to maintain an updated application base, enable two-factor authentication across financial and communication platforms, and keep reputable antivirus software in place to minimise exposure. 

Additionally, it is important to monitor financial accounts for unusual activity and conduct frequent data backups to prevent future losses. It is important to note that research indicates that awareness and education remain the best defences, as they ensure both individuals and organisations are prepared to recognise, resist, and report emerging social engineering threats as soon as they emerge, so they are not caught by surprise.

Based on the technical analysis of the campaign, people have discovered that the infection mechanism in the campaign was highly sophisticated and stealthy in order to evade detection and achieve persistence without leaving any traditional forensic evidence. During the first stage of infection, a victim receives a malicious ZIP archive through WhatsApp Web, which contains a malicious LNK file disguised as a legitimate document. 

These LNK files are often presented by generic names, or they are branded to resemble correspondence from a bank. In the accompanying Portuguese language message, the recipient is advised to open the file on a computer, as it specifies that "visualisations can be performed only on computers," and even suggests Chrome users select the "keep file" option due to the ZIP format of the file. 

When the LNK file has been executed, it launches cmd.exe with embedded commands that trigger a PowerShell script, which is responsible for contacting a remote command and control server via a PowerShell script. Using this server, each request is meticulously verified, allowing downloads only if the "User-Agent" header is detected to be unique to the PowerShell process. 

By doing so, the server effectively blocks unauthorised access and automated analysis attempts, blocking common attacks. Using PowerShell, the embedded .NET file will be decoded and executed as a live assembly by using byte-level manipulation, thereby making the infection completely fileless, because it will be performed entirely in memory.

It is quite hard to reverse engineer this initial loader because it is heavily obfuscated by controlling flow flattening, indirect function calls, and randomised naming conventions. A key part of the malware's function is to download and decrypt two encrypted shellcodes from the C2 server, authenticated by a cryptographic HMAC signature. 

The attacker's custom key — "MaverickZapBot2025SecretKey12345"— generates an API token that allows it to fetch these payloads only. Additionally, the campaign is further protected from external scrutiny by the custom key. 

The decrypted data contains a Doughnut-based loader that is responsible for initiating two distinct execution paths: the first delivers the “MaverickBanker” Trojan, while the second targets the WhatsApp infector module. Subsequent stages continue along this elaborate path. Secondary loaders are responsible for retrieving a .NET assembly named "Maverick.StageOne," a component that will download and execute the WhatsApp infector, a self-propagating component intended to hijack a victim's session and automate the delivery of messages, in an attempt to hijack their data. 

By using open-source automation tools like WPPConnect and Selenium browser drivers, this module can detect an active WhatsApp Web window and begin sending malicious files to the victim's contacts in order to maintain infection. During this stage in Brazilian culture, WhatsApp is referred to as the “ZAP,” a colloquial term referring to its localised development and social engineering techniques. 

Despite the multiple layers of obfuscation used in the malware, analysts have been able to reconstruct the malware's workflow, confirming that the malware has a modular structure, reuses shared functions, and intends to maintain a large-scale self-replication network across multiple interconnected networks, confirming its intent to be able to replicate itself. 

With an intricate combination of automation, encryption, and behavioural evasion, large-scale cybercrime operations are being carried out using everyday communication tools in a manner that represents a new frontier in weaponising these tools. A technical analysis of the Water Saci campaign has demonstrated that an advanced and meticulously engineered infrastructure was used to ensure persistence, propagation, and stealth of the campaign.

During the first stage of the PowerShell script, an Explorer process is secretly launched, which will be used to retrieve further payloads from multiple command-and-control (C2) servers, including the ones hosting zapgrande.com, expansiveuser.com, and sorvetenopote.com. As can be seen from embedded Portuguese-language comments embedded within the code, the threat actor intentionally attempted to weaken the system’s defences by executing commands in Microsoft Defender to disable User Account Control (UAC). 

As a result of the deliberate security modifications, the malware can perform privileged operations uninterrupted, creating an environment where subsequent payloads are not detected. In addition, the campaign delivers one of two distinct payloads, depending on the system profile of the victim: a legitimate Selenium browser automation framework, which is coupled with ChromeDriver, or the more destructive Maverick banking Trojan. 

A Selenium component is used to simulate active browser sessions, enabling attackers to hijack WhatsApp Web accounts for the purpose of distributing malicious files to new victims, leading to the propagation of the worm's self-propagation cycle. Maverick, on the other hand, focuses on credential theft, monitoring user browsing activity to determine how to gain access to Brazilian financial institutions and cryptocurrency exchanges before deploying additional. NET-based malwaretoo harvest sensitive information about their customers. 

Despite the fact that the campaign is quite adaptable to the dual payload mechanism, the researchers from Trend Micro point out that, combined with the campaign's ability to spread independently, this represents a significant escalation in regional cyber threats, and if left unchecked, can easily spread beyond Latin America. 

It is particularly challenging due to the campaign's worm-like nature: after the initial infection, the malware sends further malicious messages to the victim's WhatsApp contacts, creating a fast and exponential infection network based on the social trust that has been established. Because recipients are much more likely to open attachments from familiar sources, this strategy has a dramatic impact on the success rate of the malware. 

In an effort to make the world a more secure place, cybercriminals are increasingly exploiting widely used communication platforms to deliver fileless and evasive attacks, according to experts, which marks a significant change in the global threat landscape. WhatsApp is used extensively across Brazil for personal and professional purposes and is therefore a lucrative target for cybercriminals. Despite the growing threat, researchers have urged organisations to take proactive defensive measures to reduce risks.

It is recommended that administrators disable auto-downloads of media and documents on WhatsApp, implement firewall and endpoint policies restricting file transfers from personal applications, and enforce application whitelisting or containerization in BYOD environments to prevent malicious attacks. 

The importance of employee awareness programs cannot be overstated - users need to be trained in recognising and reporting suspicious attachments and links, even those sent by trusted contacts. Responding quickly to PowerShell execution alerts as well as maintaining updated endpoint security tools can help further contain infections in their earliest stages. 

Experts warn that to be able to fight these kinds of threats, companies must maintain vigilance, implement layers of defences, and foster an organisational culture that fosters awareness -- elements that have become increasingly important as malicious software that thrives on trust and connectivity spreads.

WhatsApp's "Water Saci" operation illustrates how cyber tactics are rapidly transforming the way people manage digital risk in everyday communication due to their rapid advancement. The attackers continue to exploit the familiarity of trusted platforms, so the user and organisation alike must adopt a more comprehensive protective framework that combines technology, awareness, and behavioural caution to protect themselves.

By implementing robust defences such as endpoint monitoring, adaptive threat detection, and strict file transfer controls, it may be possible to reduce exposure to such fileless and socially engineered threats. The reduction of infection rates can also be drastically reduced when the workplace culture is rooted in cybersecurity mindfulness-where verification precedes action.

The strategic collaboration between cybersecurity companies, financial institutions, and policy regulators will be crucial if people are to identify early signs of compromise and neutralise threats before they become a problem. It is important that individuals as well as organisations embed proactive vigilance and shared accountability as part of their digital habits, ensuring that trust in modern communication tools remains a strength instead of a weakness for both parties.

Read more »
Ransomware
Account Hacking Cybercrime Prevention Cybersecurity Data Breach digital safety Gaming Malware online threats Phishing Attacks Ransomware

Malware Infiltrations Through Official Game Channels


 

Cybercriminals are increasingly exploiting the trust of unsuspecting players as a profitable target in the evolving landscape of digital entertainment by downloading video games, which appear to be harmless to the eyes of user. The innocent download of a popular game, an exciting demo, or a modification made by a fan can sometimes conceal a much more sinister payload behind the innocent appearance. 

With the development of malicious code embedded within seemingly legitimate files, attackers have become increasingly adept at stealing credentials, draining cryptocurrency wallets, or hijacking user accounts without immediate notice, all using deceptive tactics. It has been reported that games can be real in nature, but they are often bundled with hidden malware that activates as soon as they are installed. 

Infections that cause this type of infection are usually hidden in post-release updates, ensuring that early versions look harmless while later patches quietly deliver the exploit, allowing threat actors to keep their exploits a secret. There is an increasingly common ploy to lure players away from verified gaming storefronts with claims of "exclusive content" or "performance-enhancing updates," and then redirect them to malicious external downloads, which are actually malicious. 

In addition to circumventing the platform's built-in security checks, such tactics also hinder developers and distributors from identifying and removing the threat promptly, as they cannot detect and remove the threat. One of the recent examples underscores the sophistication of these attacks, as security researchers discovered that a threat actor uploaded four seemingly benign "mods" to the official Steam catalogue for the popular online game Dota 2 in an effort to sabotage the game. 

When these modifications were installed on victims' systems, they opened a back door, allowing the attacker to take advantage of a known security vulnerability (CVE-2021-38003) that exists in the open-source JavaScript engine of Dota 2's Panorama framework. 

Community enhancements that were supposed to serve as vehicles for advanced exploitation turned out to be vehicles for advanced exploitation - demonstrating how even trusted platforms are susceptible to being compromised. It is clear from this troubling trend that the line between gaming and cyber risk is blurry, where just one careless click on a seemingly innocent file can expose players to data theft, account compromise, and system vulnerabilities that will last for years. 

While many security breaches in gaming occur as a result of external threat actors, there are some instances where the danger is a result of the game itself. It has been observed that developers, in certain cases, have knowingly embedded malicious components into their creations for the purpose of profit, surveillance, or misguided experimentation. However, in some cases, fan-made mods and community content have knowingly transmitted infections introduced by their creators. 

There have been cases when an infected development environment has accidentally introduced malware into an end-game by accident, putting countless players at risk. In such cases, it is made clear that even the most trustworthy and official platforms can be used to compromise players, eroding trust in a field once defined by creativity and connection, a time when player trust has been eroded. 

There have been increasing numbers of attacks by attackers who have been strategically leveraging the excitement surrounding major game releases by timing their campaigns for peak excitement moments. In these periods of high traffic, fraudulent “early access” invitations and “exclusive beta” offers seem more convincing, lured by players who desire to experience the latest titles earlier. 

When people are forced to download files without verifying their authenticity through claims of “limited access” or “exclusive playtests”, they are often manipulated into downloading files with the intent of creating anticipation and urgency. The type of tactics mentioned above is particularly effective with regard to streamers who are constantly looking for new content that will draw viewers to their channel.

By exploiting this ambition, cybercriminals entice them into downloading trojanized games or demo versions, which compromise both their systems as well as their audiences. However, content creators are not alone at risk of malware; casual gamers, whose curiosity or thrill of novelty drives them, are also at risk of accidentally installing malware disguised as legitimate software. The attacks take place across multiple platforms. 

Some malicious projects have bypassed moderation on official storefronts, such as Steam, by releasing Early Access games, overhyped demos, or free platformers, which have later proved harmful as a consequence of the attacks. As a result of their high ratings and fabricated reviews, they often gave the illusion that these titles were credible until intervention was instituted. As a result of cyber deception, platforms such as Discord and Telegram have become fertile ground for cyber attacks outside of official channels. 

The trust inherent in these communities amplifies the damage caused by the malicious attacker, causing victims to unintentionally become accomplices in the attack. Attackers compromise legitimate accounts and distribute infected files posing as friendly recommendations like "try my new game" or "check out this beta build".

A number of researchers, including Bitdefender's experts, have warned that the very qualities defining the gaming community- its enthusiasm, speed, and interconnectedness-are becoming weapons against it. In a culture where rapid downloads and shared excitement drive engagement, players tend to override caution in an effort to discover new content, exposing them to evolving cyber threats even when they are wewell-versed

During the past few months, Kaspersky has conducted an analysis of the growing trend of cyberattacks targeting gamers, specifically those belonging to Generation Z, which revealed alarming insights. As a result of this study, which examined malware activity across 20 of the most popular video games from the second quarter of 2024 until the first quarter of 2025, the study identified more than 1.8 million attempts to attack across the 20 most popular games between March 2025 and March 2024, the highest amount ever recorded during this period. 

Cybercriminals continue to target the biggest franchises of the gaming industry, most of which have active online and modding communities, as the findings illustrate. These findings highlight the fact that many of the biggest franchises are a prime target for cybercriminals. The largest number of attack attempts was recorded by the Grand Theft Auto franchise, which was the highest number among all titles analysed. 

Even though GTA V has been around for more than a decade, it has endured due to its popularity, modding flexibility, and active online community, making it particularly vulnerable to cybercrime. With anticipation building for GTA VI's release expected in 2026, experts are warning that similar campaigns will be on the rise, as threat actors will likely take advantage of the excitement surrounding “early access” offers and counterfeit installers in order to gain an edge. 

The biggest cybercriminal attack that occurred on Minecraft was 4,112,493. This is due to the vast modding ecosystem and younger player demographic, both of which continue to attract cybercriminals to the game. With 2,635,330 attempts, Call of Duty came in second with 2,615,330, mainly due to malicious files posing as cheats or cracked versions for games such as Modern Warfare 3. It is no wonder that,

The Sims were responsible for 2,416,443 attack attempts, a figure which can be attributed to the popularity of unofficial expansion packs and custom in-game assets. Roblox was also prominent, with 1,548,929 attacks, reflecting the persistent exploitation of platforms with content that is generated by users. There were also several other high-risk franchises, including FIFA, Among Us, Assassin’s Creed, Counter-Strike: Global Offensive, and Red Dead Redemption, which together contributed to hundreds of thousands of incidents.

Community engagement, which includes mods, patches, and fan content, has been shown to have a direct correlation with malicious software spread. Kaspersky has conducted a comprehensive analysis of these infections, which range from simple downloaders to sophisticated Trojans capable of stealing passwords, granting remote access to systems and deploying ransomware, among others. This type of attack is aimed primarily at compromising valuable gaming accounts, which are then sold on black market markets or underground forums for a high price. 

In accordance with the findings of the study, cyber threats are evolving as a result of the enthusiasm for new content, as well as a culture of sharing within gaming communities being weaponised by attackers for profit and exploitation. In my opinion, Guild Wars 2 stands out as a particularly notable example, which was developed by ArenaNet and published by NCSoft as a massively multiplayer online role-playing game. 

There is a strong community attached to this game because of its dynamic and expansive co-operative world. Despite the popularity of the game, the studio faced backlash in March 2018 after an update reportedly installed a surveillance tool on the players' systems. It was the embedded program's responsibility to search local files for unauthorised third-party applications and executables that may be associated with cheating. 

It was condemned by many players and cybersecurity experts as a serious breach of privacy, asking if the deployment of what appeared to be spyware was necessary to combat dishonesty. This episode proved that there is a delicate balance between maintaining the integrity of online games and infringing upon the rights of users. 

An analysis of the report revealed that efforts made to combat one form of manipulation of data were capable of introducing another, highlighting a growing ethical dilemma in the gaming industry-where issues of security, surveillance, and player trust have intersected in increasingly interesting, albeit uncomfortable, ways lately. In spite of the fact that the measure was designed to ensure fair play and resulted in nearly 1,600 accounts being identified and banned, it sparked widespread concern due to the way the measure was implemented. 

During the ongoing investigation into how malware infiltrated the gaming industry, a number of recent cases have shed light on the evolving strategies that cybercriminals are using to infiltrate the market. Those incidents mark a critical turning point in the history of video games, revealing how both indie developers and major gaming platforms, unwittingly, can be conduits for large-scale cyberattacks. 

One of the most alarming examples is BlockBlasters (2025), which appears innocent at first glance but rapidly gains popularity with its creative design and indie appeal, despite being a seemingly harmless free platformer on Steam. An update released weeks after the game was released introduced a hidden cryptocurrency dragon that hacked over $150,000 from unsuspecting players who had been unaware of the device.

In a later investigation, it emerged that the attackers had enlarged their reach by pretending to be sponsors and contacting streamers to promote the game. When Valve finally intervened and removed it, the attackers were able to expand their reach. During the same period, Sniper: Phantom's Resolution leveraged Steam's visibility but hosted its demo externally, bypassing platform safeguards. 

After a community report that the installer contained information-stealing malware, Valve delisted the title as a result of the incident, but this case demonstrated how attackers are able to use official storefronts as an effective means of promoting legitimate downloads while directing victims to malicious ones. 

There was also a similar pattern with the Early Access survival game Chemia (2024/2025), which had invited players to sign up for playtesting access to the game. Even though the project was presented professionally, it was eventually linked to three different malicious software strains which extorted data and created backdoors on infected machines in the future. 

Despite the fact that the supposed studio behind the title has been unable to locate an online presence, suspicions were raised that the identity had been fabricated. Meanwhile, the outbreak of the Fracturiser in Minecraft mods in 2023 underscores the dangers associated with community-driven ecosystems. As a result of malicious updates released by criminals into legitimate developer repositories, it has been extremely difficult for maintainers to recover control of the issue. 

These incidents have resulted in severe fallout for users. The takeover of accounts has permitted attackers to impersonate victims and spread scams, while financial losses, as seen during the BlockBlasters campaign, have devastated many players, including one streamer who lost funds that were being raised for medical care. 

Furthermore, as fraudulent titles, manipulated reviews, and influence promotions continue to erode the trust in gaming platforms, the line between genuine creativity and calculated deception is becoming increasingly blurred, which is further obscuring the real difference between genuine creativity and calculated deception. As a reminder of the dangers lurking even in verified storefronts and beloved communities, gamers are becoming increasingly uncertain about what they can play, especially as they become more and more connected.

Increasing cyber threats hidden within gaming platforms have highlighted a sobering truth: it is no longer acceptable to put digital safety as an afterthought to entertainment pursuits. In order to remain competitive in this rapidly evolving threat landscape, both players and developers should learn how to adapt in order to stay safe while exploiting trust, curiosity, and the community spirit that defines gaming culture. 

To protect against malicious behaviour and threats, platform oversight, a stricter moderation system for uploaded content, and advanced threat detection tools are not optional—they are essential. 

Furthermore, the player can also play a crucial role by verifying download sources, avoiding unofficial links, and keeping up to date with emerging cyber risks before attempting to install any new titles or mods.

In the end, the strongest defence is a higher level of awareness. It is no secret that video games have grown into a global industry of power and necessity, but the cybersecurity within it also needs to grow in equal measure. 

Vigilance, along with proactive security practices, can keep the excitement of new releases and the creative spirit of the community alive without becoming a gateway for exploitation. Keeping this delicate balance between innovation and protection, the future of safe gaming depends on making every click informed.
Read more »
Salesforce
Airways Data Breach Data Leaked Identity Theft LAPSUS$ Qantas Salesforce

Qantas Faces Scrutiny After Massive Data Leak Exposes Millions of Customer Records

 



Qantas Airways is under investigation after personal data belonging to millions of its customers appeared online following a major cyberattack. The breach, which originated from an offshore call centre using Salesforce software, is believed to have exposed information from around 5.7 million individuals.

According to cybersecurity reports, the data was released after a criminal group known as Scattered LAPSUS$ Hunters followed through on a ransom threat. The leaked files reportedly include customers’ full names, email addresses, Frequent Flyer membership numbers, phone numbers, home and business addresses, dates of birth, and gender details. In some cases, even meal preferences were among the stolen data.

Although Qantas had outsourced customer support operations to an external provider, Australian officials emphasized that responsibility for data protection remains with the airline. “Outsourcing does not remove a company’s cybersecurity obligations,” warned Cyber Security Minister Tony Burke, who added that serious penalties may apply if organisations fail to meet legal requirements for safeguarding personal data.

Experts have cautioned customers not to search for the leaked information online, particularly on dark web platforms, to avoid scams or exposure to malicious content.

Cybersecurity researcher Troy Hunt explained that while the stolen data may not include financial details, it still poses serious risks of identity theft. “The information provides multiple points of verification that can be exploited for impersonation attacks,” he noted. Hunt added that Qantas would likely face substantial legal and financial repercussions from the incident, including class-action lawsuits.

RMIT University’s Professor Matthew Warren described the event as the beginning of a “second wave of scams,” predicting that fraudsters could impersonate Qantas representatives to trick customers into disclosing more information. “Attackers may contact victims, claiming to offer compensation or refunds, and request bank or card details,” he said. With most Qantas passengers being Australian, he warned, “a quarter of the population could be at risk.”

In response, Qantas has established a dedicated helpline and identity protection support for affected customers. The airline also secured a court injunction from the New South Wales Supreme Court to block access to the stolen data. However, this order only applies within Australia, leaving the information still accessible on some foreign websites where the databases were leaked alongside data from other companies, including Vietnam Airlines, GAP, and Fujifilm.

Legal experts have already lodged a complaint with the Office of the Australian Information Commissioner, alleging that Qantas failed to take sufficient steps to protect personal information. Similar to previous high-profile breaches involving Optus and Medibank in 2022, the case may lead to compensation claims and regulatory fines.

Professor Warren emphasised that low conviction rates for cybercrimes continue to embolden hackers. “When attackers see few consequences, it reinforces the idea that cyber laws are not a real deterrent,” he said.


Read more »
Scattered Lapsus$ Hunters
Data Breach Qantas dark web leak Qantas data breach Qantas ransomware attack Salesforce data breach Scattered Lapsus$ Hunters

5 Million Qantas Travellers’ Data Leaked on Dark Web After Global Ransomware Attack

 

Personal data of around five million Qantas passengers has surfaced on the dark web after the airline fell victim to a massive ransomware attack. The cybercriminal group, Scattered Lapsus$ Hunters, released the data publicly when their ransom demands went unmet.

The hackers uploaded the stolen files on Saturday, tagging them as “leaked” and warning, “Don’t be the next headline, should have paid the ransom.”

The compromised information reportedly includes email addresses, phone numbers, dates of birth, and frequent flyer membership details from Qantas’ customer records. However, the airline confirmed that no financial data, credit card details, or passport numbers were exposed in this breach.

The cyberattack is part of a larger global campaign that has impacted 44 organisations worldwide, with up to a billion customer records potentially compromised. The infiltration occurred through a Salesforce database breach in June, extending from April 2024 to September 2025.

Cyber intelligence expert Jeremy Kirk from Intel 471 said the attackers are a long-established criminal network with members operating across the US, UK, and Australia.
He noted: “This particular group is not a new threat; they've been around for some time.”
Kirk added: “They're very skilled in knowing how companies have connected different systems together.”

Major global brands such as Gap, Vietnam Airlines, Toyota, Disney, McDonald’s, Ikea, and Adidas were also affected by the same campaign.

While Qantas customers’ financial data was not exposed, experts have warned that the leaked personal details could be exploited for identity theft and phishing scams.
Kirk cautioned: “These days, a lot of threat groups are now generating personalised phishing emails.”
He continued: “They're getting better and better at this, and these types of breaches help fuel that underground fraudster economy.”

Qantas has since launched a 24/7 customer support line and provided specialist identity protection assistance to those affected.
A company representative stated, “We continue to offer a 24/7 support line and specialist identity protection advice to affected customers.”

In July, Qantas secured a permanent court order from the NSW Supreme Court to block any unauthorised access, sharing, or publication of the stolen data.

Salesforce, whose database was infiltrated, confirmed that it would not negotiate or pay ransom demands, stating: “We will not engage, negotiate with, or pay any extortion demand.” The company also clarified that its platform itself remained uncompromised and that it continues to work closely with affected clients.

A Qantas spokesperson added: “With the help of specialist cyber security experts, we are investigating what data was part of the release.”
They continued: “We have also put in place additional security measures, increased training across our teams, and strengthened system monitoring and detection since the incident occurred.”
Read more »
Scattered Lapsus$ Hunters
Data Breach Qantas Qantas dark web leak Qantas ransomware attack Salesforce data breach Scattered Lapsus$ Hunters

5 Million Qantas Travellers’ Data Leaked on Dark Web After Global Ransomware Attack

 

Personal data of around five million Qantas passengers has surfaced on the dark web after the airline fell victim to a massive ransomware attack. The cybercriminal group, Scattered Lapsus$ Hunters, released the data publicly when their ransom demands went unmet.

The hackers uploaded the stolen files on Saturday, tagging them as “leaked” and warning, “Don’t be the next headline, should have paid the ransom.”

The compromised information reportedly includes email addresses, phone numbers, dates of birth, and frequent flyer membership details from Qantas’ customer records. However, the airline confirmed that no financial data, credit card details, or passport numbers were exposed in this breach.

The cyberattack is part of a larger global campaign that has impacted 44 organisations worldwide, with up to a billion customer records potentially compromised. The infiltration occurred through a Salesforce database breach in June, extending from April 2024 to September 2025.

Cyber intelligence expert Jeremy Kirk from Intel 471 said the attackers are a long-established criminal network with members operating across the US, UK, and Australia.
He noted: “This particular group is not a new threat; they've been around for some time.”
Kirk added: “They're very skilled in knowing how companies have connected different systems together.”

Major global brands such as Gap, Vietnam Airlines, Toyota, Disney, McDonald’s, Ikea, and Adidas were also affected by the same campaign.

While Qantas customers’ financial data was not exposed, experts have warned that the leaked personal details could be exploited for identity theft and phishing scams.
Kirk cautioned: “These days, a lot of threat groups are now generating personalised phishing emails.”
He continued: “They're getting better and better at this, and these types of breaches help fuel that underground fraudster economy.”

Qantas has since launched a 24/7 customer support line and provided specialist identity protection assistance to those affected.

A company representative stated, “We continue to offer a 24/7 support line and specialist identity protection advice to affected customers.”

In July, Qantas secured a permanent court order from the NSW Supreme Court to block any unauthorised access, sharing, or publication of the stolen data.

Salesforce, whose database was infiltrated, confirmed that it would not negotiate or pay ransom demands, stating: “We will not engage, negotiate with, or pay any extortion demand.” The company also clarified that its platform itself remained uncompromised and that it continues to work closely with affected clients.

A Qantas spokesperson added: “With the help of specialist cyber security experts, we are investigating what data was part of the release.”
They continued: “We have also put in place additional security measures, increased training across our teams, and strengthened system monitoring and detection since the incident occurred.”
Read more »
private key breach
Blockchain Security Crypto Theft crypto wallet hack Data Breach Ethereum transfer Hyperliquid hack PeckShield report private key breach

$21 Million Stolen in Hyperliquid Private Key Breach: Experts Warn of Rising Crypto Wallet Hacks

 

Hyperliquid user, identified by the wallet address 0x0cdC…E955, has reportedly lost $21 million in cryptocurrency after hackers gained access to their private key.

According to blockchain security firm PeckShield, the attackers swiftly transferred the compromised funds to the Ethereum network, as confirmed through on-chain tracking. The stolen crypto included approximately 17.75 million DAI tokens and 3.11 million MSYRUPUSDP tokens. PeckShield also shared visual data mapping out the wallet addresses connected to the heist.

“A victim 0x0cdC…E955 lost ~$21M worth of cryptos due to a private key leak. The hacker has bridged the stolen funds… including 17.75M & 3.11M,” — PeckShieldAlert (@PeckShieldAlert)

Blockchain records indicate that the stolen tokens were strategically transferred and redistributed across multiple wallets, mirroring tactics seen in earlier high-profile crypto thefts.

An unusual detail in the case is the timing of certain trading activities. Just as PeckShield’s alert went public, data showed that a Hyperliquid account closed a $16 million HYPE long position, followed by the liquidation of 100,000 HYPE tokens worth about $4.4 million.

Researchers analyzing transactions on Hypurrscan suggested that this trading account might have belonged to the same compromised user. Their findings indicate that the liquidated assets were later converted into USDC and DAI, with transfers spanning both the Ethereum and Arbitrum networks—aligning closely with the hacker’s movements identified by PeckShield.

The breach wasn’t limited to Hyperliquid balances. Investigations revealed an additional $3.1 million was siphoned from the Plasma Syrup Vault liquidity pool, with the tokens quickly routed to a newly created wallet.

Prominent X (formerly Twitter) user Luke Cannon suggested that the total damage could be higher, estimating another $300,000 stolen from linked wallet addresses.

Recurring Attacks Raise Security Concerns

Another Hyperliquid user, @TradeThreads (BRVX), reported losing $700,000 in HYPE tokens last month under similar circumstances.

“Lost 700k in hype in a similar incident last month. Not sure how they hacked. No malware, no discord chats, no TG calls, no email download,” — BRVX (@TradeThreads)

He speculated that Windows malware might have been the cause, as he had not accessed his wallets for a week and had recently switched to a new MacBook where the wallet wasn’t even set up.

Unlike exchange or smart contract vulnerabilities, this breach resulted from a private key leak, which grants attackers full access to wallet credentials. Such leaks often stem from phishing attacks, malware, or insecure key storage practices.

Cybersecurity experts continue to emphasize the importance of cold wallets or multi-signature setups for protecting high-value crypto assets.

Recently, Blockstream issued a security alert warning Jade hardware wallet owners of a phishing campaign spreading through fake firmware update emails.

Growing Pattern of Private Key Exploits

Private key-related hacks are becoming alarmingly common. Just weeks ago, North Korean hackers reportedly stole $1.2 million from Seedify’s DAO launchpad, causing its token SFUND to drop by 99%. Similarly, a Venus Protocol user on BNB Chain lost $27 million to a key breach in September.

According to CertiK’s annual security report, over $2.36 billion was lost across 760 on-chain security incidents last year, with $1.05 billion directly linked to private key compromises—making up 39% of all attacks.

The report explains that phishing remains a preferred method among hackers because it exploits human error rather than technological weaknesses. Since blockchain transactions are irreversible, even a single mistake can result in irreversible losses.

The Ethereum network continues to witness the most attacks, followed by Binance Smart Chain (BSC)—but experts warn that Hyperliquid is now becoming a new target for cybercriminals due to its decentralized infrastructure.
Read more »
North Korea Hackers
Crypto Theft Data Breach Discord Breach North Korea Hackers

Crypto Vanishes: North Korea’s $2B Heist, Discord Breach Exposes Millions

 

North Korean hackers have stolen over $2 billion in cryptocurrency in 2025, while a Discord breach exposed sensitive user data, including government IDs of approximately 70,000 individuals. These incidents highlight the growing sophistication of cyber threats targeting both financial assets and personal information.

Cybercrime surge

North Korean state-sponsored hacking groups, such as the Lazarus Group, have significantly increased their cryptocurrency thefts, amassing more than $2 billion in 2025 alone, marking a record for these cybercriminals. The funds are believed to support North Korea’s nuclear weapons and missile development programs.The regime’s hacking activities now contribute approximately 13% to its estimated $15.17 billion GDP. 

The largest single theft occurred in February 2025, when hackers stole $1.4 billion from the crypto exchange ByBit, with other attacks targeting platforms like WOO X and Seedify resulting in millions more in losses. North Korean hackers are increasingly focusing on wealthy individual cryptocurrency holders, who often lack the robust security measures of institutional investors, making them vulnerable targets. 

Discord ID breach and data exposure

Discord confirmed a breach in which hackers accessed the government-issued identification documents of around 70,000 users who had uploaded them for age verification disputes. The attackers infiltrated a third-party customer service provider, 5CA, to gain access to this sensitive data. 

The stolen information, including selfies holding IDs, email addresses, and partial phone numbers, is being shared in Telegram groups, raising serious privacy concerns about digital age verification systems. This incident underscores the risks associated with centralized storage of personal identification documents.

New tactics: EtherHiding on blockchains

In a significant evolution of cyber-espionage tactics, a North Korean threat actor tracked as UNC5342 has been observed using a technique called “EtherHiding” since February 2025. This method involves embedding malicious code within smart contracts on public blockchains like Ethereum or BNB Smart Chain, using the decentralized ledger as a resilient command-and-control server. 

This approach, part of a campaign named “Contagious Interview,” uses social engineering—posing as recruiters on LinkedIn—to lure victims into executing malware that downloads further payloads via blockchain transactions. The decentralized nature of blockchains makes EtherHiding highly resistant to takedown efforts, presenting a new challenge for cybersecurity defenses.
Read more »
Scattered Spider
Customer Data Data Breach Extortion Group NCA Ransomware Salesforce Scattered Spider

Salesforce Refuses to Pay Extortion Demand After Alleged Theft of Nearly One Billion Records




Salesforce has confirmed it will not pay a ransom to an extortion group that claims to have stolen close to one billion records belonging to several of its customers. The company stated that it will not enter negotiations or make payments to any threat actor, reaffirming its policy of non-engagement with cybercriminals.


Extortion Group Claims to Have Breached Dozens of Salesforce Customers

The group behind the alleged theft calls itself “Scattered LAPSUS$ Hunters”, a name that appears to blend identities from three notorious cyber-extortion collectives: Scattered Spider, LAPSUS$, and ShinyHunters. Cybersecurity firm Mandiant, owned by Google, has been tracking this activity under the identifier UNC6040, though analysts say the group’s exact origins and membership remain unconfirmed.

According to Mandiant’s June report, the campaign began in May, when attackers used voice-based social engineering, or “vishing,” to trick employees at several organizations using Salesforce’s platform. Pretending to represent technical support teams, the callers persuaded employees to connect an attacker-controlled application to their company’s Salesforce environment. Once integrated, the app provided unauthorized access to stored customer data.

Security researchers described the tactic as simple but highly effective, since it relies on human trust rather than exploiting software vulnerabilities. Several organizations unknowingly granted the attackers access, enabling them to exfiltrate vast amounts of data.

Earlier this month, the extortionists created a leak site listing approximately 40 affected Salesforce customers, including large global firms. The site claimed that 989.45 million records had been compromised and demanded that Salesforce begin ransom negotiations “or all your customers’ data will be leaked.” The attackers added that if Salesforce agreed to pay, other victim companies would not be required to do so individually.

Salesforce, however, made its position clear. In a statement to media outlets, a company spokesperson said, “Salesforce will not engage, negotiate with, or pay any extortion demand.” The company also informed customers via email that it had received credible intelligence about plans by ShinyHunters to release the stolen data publicly, but it would still not yield to any ransom demand.


Broader Concerns Over Ransomware Economics

The incident adds to a growing global debate over ransom payments. Analysts say extortion and ransomware attacks persist largely because organizations continue to pay. According to Deepstrike Security, global ransom payments in 2024 reached $813 million, a decline from $1.1 billion in 2023 but still a major incentive for criminal groups.

Experts such as independent security researcher Kevin Beaumont have repeatedly criticized the practice of paying ransoms, arguing that it directly funds organized crime and perpetuates the cycle of attacks. Beaumont noted that while law enforcement agencies like the UK’s National Crime Agency (NCA) publicly discourage payments, some companies still proceed with negotiations, sometimes even with NCA representatives present.


Risks and Lessons for Organizations

Data stolen from cloud-based platforms like Salesforce may include customer identifiers, contact details, transaction histories, and other business records. Even without financial information, such data can be weaponized in phishing, identity theft, or fraud campaigns.

Security professionals advise all organizations using cloud platforms to implement multi-factor authentication, enforce least-privilege access controls, and review all third-party applications connected to their systems. Employees should be trained to verify unexpected support calls or administrative requests through official channels before granting access.

The Salesforce case underscores the growing sophistication of social engineering attacks targeting major enterprise platforms. As digital ecosystems expand, cybercriminals are increasingly exploiting human error rather than software flaws. Salesforce’s refusal to pay marks a firm stance in an era when ransom-driven extortion continues to dominate the threat landscape, sending a strong message to both the cybersecurity community and the attackers themselves.



Read more »
Subscribe to: Comments (Atom)