Author: Mark

Oct 13, 2025Ravie LakshmananCybersecurity / Hacking News

Every week, the cyber world reminds us that silence doesn’t mean safety. Attacks often begin quietly — one unpatched flaw, one overlooked credential, one backup left unencrypted. By the time alarms sound, the damage is done.

This week’s edition looks at how attackers are changing the game — linking different flaws, working together across borders, and even turning trusted tools into weapons. From major software bugs to AI abuse and new phishing tricks, each story shows how fast the threat landscape is shifting and why security needs to move just as quickly.

⚡ Threat of the Week

Dozens of Orgs Impacted by Exploitation of Oracle EBS Flaw — Dozens of organizations may have been impacted following the zero-day exploitation of a security flaw in Oracle’s E-Business Suite (EBS) software since August 9, 2025, according to Google Threat Intelligence Group (GTIG) and Mandiant. The activity, which bears some hallmarks associated with the Cl0p ransomware crew, is assessed to have fashioned together multiple distinct vulnerabilities, including a zero-day flaw tracked as CVE-2025-61882 (CVSS score: 9.8), to breach target networks and exfiltrate sensitive data. The attack chains have been found to trigger two different payload chains, dropping malware families like GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE. Oracle has also released updates to EBS to address another vulnerability in the same product (CVE-2025-61884) that could lead to unauthorized access to sensitive data. The company did not mention if it was being exploited in the wild.

• Storm-1175 Linked to Exploitation of GoAnywhere MFT Flaw — A cybercriminal group Microsoft tracks as Storm-1175 exploited a maximum-severity vulnerability in GoAnywhere MFT (CVE-2025-10035) to initiate multi-stage attacks, including Medusa ransomware. Storm-1175’s attacks are opportunistic, and have affected organizations in the transportation, education, retail, insurance, and manufacturing sectors. The activity blends legitimate tools with stealthy techniques to stay under the radar and monetize access through extortion and data theft, using the access to install remote monitoring tools such as SimpleHelp and MeshAgent, drop web shells, and move laterally across networks using built-in Windows utilities. Fortra has since disclosed that it began its investigation on September 11 following a “potential vulnerability” reported by a customer, uncovering “potentially suspicious activity” related to the flaw.
• OpenAI Disrupted Three Clusters from China, North Korea, and Russia — OpenAI said it disrupted three activity clusters for misusing its ChatGPT artificial intelligence (AI) tool to facilitate malware development. This includes a Russian‑language threat actor, who is said to have used the chatbot to help develop and refine a remote access trojan (RAT), a credential stealer with an aim to evade detection. The second cluster of activity originated from North Korea, which used ChatGPT for malware and command-and-control (C2) development, focusing on developing macOS Finder extensions, configuring Windows Server VPNs, or converting Chrome extensions to their Safari equivalents. The third set of banned accounts shared overlaps with a cluster tracked as UNK_DropPitch (aka UTA0388), a Chinese hacking group which employed the AI chatbot to generate content for phishing campaigns in English, Chinese, and Japanese; assist with tooling to accelerate routine tasks such as remote execution and traffic protection using HTTPS; and search for information related to installing open-source tools like nuclei and fscan.
• Over 175 npm Packages Used for Phishing Campaign — In an unusual twist, threat actors have been observed to push throwaway npm packages that, once installed, are designed to create and publish an npm package of its own with the pattern “redirect-xxxxxx” or “mad-xxxxxx,” which, in turn, auto-redirects victims to credential-harvesting sites when opened from crafted HTML business documents. “Unlike the more familiar tactic of simply uploading malicious packages to compromise developers during package installation, this campaign takes a different path,” Snyk said. “Instead of infecting users via npm install, the attackers leverage the browser delivery path through UNPKG, turning legitimate open source hosting infrastructure into a phishing mechanism.” It’s believed that the HTML files generated through the npm packages are distributed to victims, who are then redirected to the credential phishing sites when they attempt to open them. In the packages analyzed by Snyk, the pages masquerade as Cloudflare security checks before leading victims to an attacker-controlled URL fetched from a remote GitHub-hosted file.
• LockBit, Qilin, and DragonForce Join Forces — Three of the most notorious ransomware-as-a-service operations, LockBit, Qilin, and DragonForce, have formed a criminal cartel aimed at coordinating attacks and sharing resources. The partnership was announced early last month, shortly following the emergence of LockBit 5.0. “Create equal competition conditions, no conflicts and no public insults,” DragonForce wrote in a post on a dark web forum. “This way, we can all increase our income and dictate market conditions. Call it whatever you like – coalition, cartel, etc. The main thing is to stay in touch, be friendly to each other, and be strong allies, not enemies.” The teaming up of the three groups comes amid mounting pressure from law enforcement disruptions, prompting them to attack sectors previously considered off-limits, such as nuclear power plants, thermal power plants, and hydroelectric power plants. It also follows a similar consolidation pattern among primarily English-speaking cybercrime collectives like Scattered Spider, ShinyHunters, and LAPSUS$, which began collaborating under the name Scattered LAPSUS$ Hunters. That said, the cartelization of ransomware also comes at a time of record fragmentation in the broader ecosystem, with the number of active data leak sites reaching an all-time high of 81 in the third quarter of 2025.
• China-Nexus Hackers Weaponize Open-Source Nezha Tool in Attacks — Threat actors with suspected ties to China have turned a legitimate open-source monitoring tool called Nezha into an attack weapon, using it to deliver a known malware called Gh0st RAT to targets. The campaign is said to have likely compromised more than 100 victim machines since August 2025, with a majority of the infections reported in Taiwan, Japan, South Korea, and Hong Kong. The activity is yet another indication of how threat actors continue to twist legitimate tools for malicious purposes and blend in with normal network traffic. In one instance observed by Huntress, the attackers targeted an exposed phpMyAdmin panel to deploy a web shell by means of a log poisoning attack. The access obtained through the web shell was then used to drop Nezha and ultimately drop Gh0st RAT, but not before laying the necessary groundwork to avoid detection.

‎️‍🔥 Trending CVEs

Hackers move fast. They often exploit new vulnerabilities within hours, turning a single missed patch into a major breach. One unpatched CVE can be all it takes for a full compromise. Below are this week’s most critical vulnerabilities gaining attention across the industry. Review them, prioritize your fixes, and close the gap before attackers take advantage.

This week’s list includes — CVE-2025-61884 (Oracle E-Business Suite), CVE-2025-11371 (Gladinet CentreStack and TrioFox), CVE-2025-5947 (Service Finder theme), CVE-2025-53967 (Framelink Figma MCP server), CVE-2025-49844 (Redis), CVE-2025-27237 (Zabbix Agent), CVE-2025-59489 (Unity for Android and Windows), CVE-2025-36604 (Dell UnityVSA), CVE-2025-37728 (Elastic Kibana Connector), CVE-2025-56383 (Notepad++), CVE-2025-11462 (AWS Client VPN for macOS), CVE-2025-42701, CVE-2025-42706 (CrowdStrike Falcon), CVE-2025-11001, CVE-2025-11002 (7-Zip), CVE-2025-59978 (Juniper Networks Junos Space), CVE-2025-11188, CVE-2025-11189, CVE-2025-11190 (SynchroWeb Kiwire Captive Portal), CVE-2025-3600 (Progress Telerik UI for ASP.NET AJAX), a cross-site scripting (XSS) vulnerability in REDCap, and unpatched security vulnerabilities in Ivanti Endpoint Manager (from ZDI-25-935 through ZDI-25-947).

📰 Around the Cyber World

• TwoNet Targets Forescout Honeypot — An ICS/OT honeypot run by Forescout, designed to mimic a water treatment facility, was targeted last month by a Russia-linked group named TwoNet. The financially motivated hacktivist group subsequently attempted to deface the associated human machine interface (HMI), disrupt processes, and manipulate other ICS. Forescout’s honeypots also saw attack attempts that have been linked to Russia and Iran. TwoNet first emerged in January, primarily focused on DDoS attacks using the MegaMedusa Machine malware, per Intel471. Through an affiliated group, CyberTroops, TwoNet announced it was ceasing operations on September 30, 2025. “This underscores the ephemeral nature of the ecosystem where channels and groups are short-lived, while operators typically persist by rebranding, shifting alliances, joining other groups, learning new techniques, or targeting other organizations,” Forescout said. “Groups moving from DDoS/defacement to OT/ICS often misread targets, trip over honeypots, or overclaim. That doesn’t make them harmless; it shows where they are headed.”
• Sophos Probes WhatsApp Worm’s Links to Coyote — A recently disclosed campaign dubbed Water Saci involved the threat actors using self-propagating malware dubbed SORVEPOTEL that spreads via the popular messaging app WhatsApp. Sophos said it’s investigating to determine if the campaign could be related to prior reported campaigns that distributed a banking trojan named Coyote targeting users in Brazil, and if the malware used in the attacks, Maverick, is an evolution of Coyote. The WhatsApp messages contain a zipped LNK file that, when launched, initiates a series of malicious PowerShell commands to drop next-stage PowerShell, which then attempts to modify local security controls. In some cases, Sophos said it observed an additional payload, the legitimate Selenium browser automation tool, that enabled control of running browser sessions on the infected host. It’s suspected that Selenium is delivered alongside Maverick via the same command-and-control (C2) infrastructure.
• North Korean IT Workers Seek Jobs in New Sectors — The infamous North Korean IT workers are now seeking remote jobs in the industrial design and architecture fields, according to security company KELA. “Their involvement could pose risks related to espionage, sanctions evasion, safety concerns, and access to sensitive infrastructure designs,” it said, describing the threat as a “a highly organized, state-backed network that extends far beyond IT roles.” One of IT workers, Hailong Jin, has been identified as connected to the development of a malicious game called DeTankZone, while also sharing ties with another IT worker named Lian Hung, who has claimed to be a mobile app developer in Tanzania. It’s believed that Hailong Jin and Lian Hung may be the same person, the Chollima Group said, adding Bells Inter Trading Limited is a North Korean run front company employing IT Workers in Tanzania. The company, for its part, has been linked to several VPN apps published on both Apple and Google’s iOS and Android app stores. “Rather than viewing them as a monolithic entity, North Korean IT Workers are more akin to individual entrepreneurs operating under the blessing of a higher-status boss,” the Chollima Group noted. “As an IT Worker gains more status and respect, they are able to climb the organization’s ranks and eventually become bosses themselves. From there they may form their own front companies and gain the status necessary to take on more malicious activity (if they so choose). We believe Lian Hung and Hailong Jin, both appearing to be in their 30s-40s, may be operating as middle managers or hold higher statuses in this structure, which may explain their titles of choice being ‘Project Manager.’”
• FBI Seizes Site Used by Salesforce Extortionists — The U.S. Federal Bureau of Investigation (FBI) seized a website (“breachforums[.]hn”) that was being used by Scattered LAPSUS$ Hunters to extort Salesforce and its customers. The action marks another chapter in the ongoing cat-and-mouse game to dismantle the persistent data leak site. That said, the dark web version of the leak site is still up and running. “BreachForums was seized by the FBI and international partners today. All our domains were taken from us by the U.S. Government. The era of forums is over,” the Scattered Lapsus$ Hunters group said in a PGP-encrypted statement on Telegram. While the groups initially claimed they were shutting down their operations, the website resurfaced merely a few days later, transitioning from a hacking forum to a dedicated extortion site. The group also admitted that the BreachForums servers and backups were destroyed, and that database archives and escrow data from as far back as 2023 were compromised. Scattered LAPSUS$ Hunters (aka the Trinity of Chaos) is a newly formed alliance comprising Scattered Spider (aka Muddled Libra), LAPSUS$, and ShinyHunters (aka Bling Libra). In recent weeks, the threat actors breached Salesloft’s systems and used the access to obtain customers’ Salesforce data. Last month, Salesloft revealed that the data breach linked to its Drift application started with the compromise of its GitHub account. BreachForums has a long and turbulent history, punctuated by numerous takedowns and resurrections since its original administrator was arrested in March 2023.
• NSO Group Acquired by U.S. Investment Group — Israeli spyware maker NSO Group has disclosed that a U.S. investment group has acquired the controversial company. A company’s spokesperson told TechCrunch that “an American investment group has invested tens of millions of dollars in the company and has acquired controlling ownership.”
• Apple Revises its Bug Bounty Program — Apple announced significant updates to its bug bounty program, with the company now offering up to $2 million for exploit chains that can achieve similar goals as sophisticated mercenary spyware attacks. It’s also rewarding one-click WebKit sandbox escapes with up to $300,000, and up to $1 million for wireless proximity exploits over any radio, broad unauthorized iCloud access, and WebKit exploit chains leading to unsigned arbitrary code execution. “Since we launched the public Apple Security Bounty program in 2020, we’re proud to have awarded over $35 million to more than 800 security researchers, with multiple individual reports earning $500,000 rewards,” the company said. The new payouts will go into effect in November 2025.
• Spanish Guardia Civil Disrupts GXC Team — Spanish authorities dismantled the GXC Team and arrested its alleged mastermind, a 25-year-old Brazilian national who went online as GoogleXcoder. According to Group-IB, GXC Team operated a crime-as-a-service (CaaS) platform offering AI-powered phishing kits, Android malware, and voice scam tools via Telegram and a Russian-speaking hacker forum to cybercriminals targeting banks, transportation, and e-commerce, in Spain, Slovakia, the UK, US, and Brazil.”To avoid capture, the suspect adopted a ‘digital nomad’ lifestyle, frequently relocating between Spanish provinces and using stolen identities to secure housing, phone lines, and payment cards,” Group-IB said.
• Inside Russian Market — Rapid7 said Russian Market has evolved its operations over time, pivoting from selling RDP access to stolen credit card data and, more recently, infostealer logs. “Stolen credentials originate from organizations worldwide, with 26% originating in the US and 23% in Argentina,” the company said. “Most sellers have adopted a multi-stealer approach over the years, leveraging various malware variants in their operations, with Lumma emerging as a widely used tool. The most common types of infostealers being used by sellers in Russian Market over the years have been Raccoon, Vidar, Lumma, RedLine, and Stealc, with Rhadamanthys and Acreed gaining popularity in the first half of 2025.” The findings came as Red Canary revealed that Atomic, Poseidon, and Odyssey have emerged as the three prominent stealer families targeting Apple macOS systems, while also sharing many tactical similarities. Odyssey Stealer is a successor to Poseidon that was first detected in March 2025.
• Austria Says Microsoft Violated E.U. Laws — Austria’s privacy regulator found that Microsoft violated E.U. law by illegally tracking students through Microsoft 365 Education using tracking cookies without their consent. The decision was reached following noyb’s complaint in 2024. The Austrian Data Protection Authority (DSB) has ordered the deletion of the relevant personal data. “The decision by the Austrian DPA really highlights the lack of transparency with Microsoft 365 Education,” noyb said. “It is almost impossible for schools to inform students, parents and teachers about what is happening with their data.”
• AI Models Can Acquire Backdoors from About 250 Malicious Documents — A new academic study from Anthropic, the U.K. AISI’s Safeguards team, and The Alan Turing Institute has found that it takes approximately 250 malicious documents to establish a simple “backdoor” in large language models. The research challenges the idea that attackers need to control or poison a large portion of the training data in order to influence an LLM’s output. “Poisoning attacks require a near-constant number of documents regardless of model and training data size,” it said. “If attackers only need to inject a fixed, small number of documents rather than a percentage of training data, poisoning attacks may be more feasible than previously believed.” A 2024 study by researchers at Carnegie Mellon University, ETH Zürich, Meta, and Google DeepMind showed that attackers controlling 0.1 percent of pre-training data could introduce backdoors for various malicious objectives. “Our results suggest that injecting backdoors through data poisoning may be easier for large models than previously believed as the number of poisons required does not scale up with model size,” the researchers said, “highlighting the need for more research on defences to mitigate this risk in future models.” The disclosure coincided with OpenAI’s stating that its GPT-5 model exhibits lower levels of political bias than any previous models.

🎥 Cybersecurity Webinars

• Drowning in Vulnerability Alerts? Here’s How to Finally Regain Control – Most security teams face the same problem — too many vulnerabilities and not enough time. Dynamic Attack Surface Reduction (DASR) helps fix this by finding and closing risks automatically, before attackers can use them. Instead of chasing endless alerts, teams can focus on what really matters: keeping systems safe and running smoothly. It’s a smarter, faster way to stay one step ahead.
• How Leading Teams Are Using AI to Simplify Compliance and Reduce Risk – AI is changing how organizations handle Governance, Risk, and Compliance (GRC). It can make compliance faster and smarter—but it also brings new risks and rules to follow. This session will show you how to use AI safely and effectively, with real examples, lessons from early adopters, and practical tips to prepare your team for the future of compliance.
• From Firefighting to Secure-by-Design: A Practical Playbook – AI is changing fast, but security can’t lag behind. The smartest teams now treat security controls as launchpads, not roadblocks — enabling AI agents to move quickly and safely. By shifting from reactive firefighting to a secure-by-design mindset, organizations gain both speed and confidence. With the right framework, you can control AI risks while accelerating innovation instead of slowing it down.

🔧 Cybersecurity Tools

• P0LR Espresso – A new open-source tool from Permiso that helps security teams quickly analyze multi-cloud logs during live response. It normalizes data from platforms like AWS, Azure, and GCP to deliver clear timelines, behavioral insights, and IOC analysis—making it easier to spot compromised identities and understand what really happened.
• Ouroboros – A new open-source decompiler built in Rust that uses symbolic execution to recover high-level code structure from compiled binaries. Unlike traditional decompilers that rely on static assignment models, Ouroboros tracks constraints and data flow to understand how registers and memory change during execution. This approach helps it reconstruct logical code patterns such as loops, conditions, and control flow regions, making it a practical tool for reverse engineering, program analysis, and security research.

Disclaimer: These tools are for educational and research use only. They haven’t been fully security-tested and could pose risks if used incorrectly. Review the code before trying them, test only in safe environments, and follow all ethical, legal, and organizational rules.

🔒 Tip of the Week

Don’t Leave Your Backups Unlocked — Backups are your safety net — but if they’re not encrypted, they can become your biggest risk. Anyone who gets access to an unencrypted backup can read everything inside: passwords, emails, financial data, customer info — all of it.

The Simple Fix: Always encrypt your backups before saving or sending them anywhere (USB, cloud, or server). Encryption locks your data so only you can open it.

🔐 Easy, Trusted Open-Source Tools:

• Restic: Fast, simple, and encrypts everything automatically. Works with many cloud services.
• BorgBackup: Compresses, deduplicates, and encrypts your backups — perfect for long-term storage.
• Duplicity: Uses GPG encryption and supports encrypted backups to local or remote storage.
• rclone: Syncs files securely to cloud storage with built-in encryption options.

Pro Tip: Test your backup regularly — make sure you can decrypt and restore it. A locked or broken backup is as bad as no backup at all.

Conclusion

The week’s stories show both sides of cybersecurity — the creativity of attackers and the resilience of defenders. Our strength lies in awareness, collaboration, and action. Let’s use every lesson learned to make next week’s news a little less alarming.

Think your WAF has you covered? Think again. This holiday season, unmonitored JavaScript is a critical oversight allowing attackers to steal payment data while your WAF and intrusion detection systems see nothing. With the 2025 shopping season weeks away, visibility gaps must close now.

Get the complete Holiday Season Security Playbook here.

Bottom Line Up Front

The 2024 holiday season saw major attacks on website code: the Polyfill.io breach hit 500,000+ websites, and September’s Cisco Magecart attack targeted holiday shoppers. These attacks exploited third-party code and online store weaknesses during peak shopping, when attacks jumped 690%.

For 2025: What security steps and monitoring should online retailers take now to prevent similar attacks while still using the third-party tools they need?

As holiday shopping traffic increases, companies strengthen their servers and networks, but a critical weak spot remains unwatched: the browser environment where malicious code runs hidden on users’ devices, stealing data and bypassing standard security.

The Client-Side Security Gap

Recent industry research reveals the concerning scope of this security gap:

These statistics underscore a fundamental shift in the threat landscape. As organizations have strengthened server-side defenses through WAFs, intrusion detection systems, and endpoint protection, attackers have adapted by targeting the browser environment where traditional monitoring tools fall short due to the following:

• Limited Visibility: Server-side monitoring tools cannot observe JavaScript execution within users’ browsers. WAFs and network monitoring solutions miss attacks that operate entirely in the client environment.
• Encrypted Traffic: Modern web traffic is encrypted via HTTPS, making it difficult for network monitoring tools to inspect the content of data transmissions to third-party domains.
• Dynamic Nature: Client-side code can modify its behavior based on user actions, time of day, or other factors, making static analysis insufficient.
• Compliance Gaps: Although regulations like PCI DSS 4.0.1 focus now more on client side risk, there’s still limited guidance on client-side data protection.

Supply Chain Compromises

Modern web applications depend heavily on third-party services, analytics platforms, payment processors, chat widgets, and advertising networks. Each represents a potential entry point. The 2019 Ticketmaster breach occurred when attackers compromised a customer support chat tool, demonstrating how a single third-party script can expose an entire platform.

Shadow Scripts and Script Sprawl

Many organizations lack complete visibility into all JavaScript code executing on their pages. Scripts can dynamically load other scripts, creating a complex web of dependencies that security teams struggle to track. This “shadow script” phenomenon means that unauthorized code may be running without explicit approval or monitoring.

Session and Cookie Manipulation

Client-side attacks can intercept authentication tokens, manipulate session data, or extract sensitive information from cookies and local storage. Unlike server-side attacks that leave network logs, these operations occur entirely within the user’s browser, making detection challenging without specialized monitoring.

Real-World Holiday Season Attacks: Lessons from 2024

The 2024 holiday season provided stark examples of the escalating client-side threat. The infamous Polyfill.io supply chain attack, which began in February 2024 and impacted over 100,000 websites by the holidays, demonstrated how a compromised third-party script could redirect users to malicious sites. Similarly, the Cisco Magecart attack in September 2024 targeted holiday shoppers via their merchandise store, highlighting how even large organizations are vulnerable to payment data theft during peak periods.

Beyond these high-profile incidents, the pervasive nature of client-side threats was evident. The compromised Kuwaiti e-commerce site Shrwaa.com hosted malicious JavaScript files throughout 2024, infecting other sites undetected and showcasing the “shadow script” problem. The Grelos skimmer variant further illustrated session and cookie manipulation, deploying fake payment forms on smaller, trusted e-commerce sites just before Black Friday and Cyber Monday. These incidents underscore the critical need for robust client-side security measures.

The Holiday Season Amplifies Risk

Several factors make the holiday shopping period particularly vulnerable:

Increased Attack Motivation: Higher transaction volumes create lucrative targets, with Cyber Monday 2024 seeing 5.4 trillion daily requests on Cloudflare’s network, with 5% blocked as potential attacks.

Code Freeze Periods: Many organizations implement development freezes during peak seasons, limiting the ability to respond quickly to newly discovered vulnerabilities.

Third-Party Dependencies: Holiday promotions often require integration with additional marketing tools, payment options, and analytics platforms, expanding the attack surface.

Resource Constraints: Security teams may be stretched thin, with most organizations scaling back after-hours SOC staffing levels by up to 50% during holidays and weekends.

Implementing Effective Client-Side Security

1. Deploy Content Security Policy (CSP)

Start with CSP in report-only mode to gain visibility into script execution without breaking functionality:

This approach provides immediate insights into script behavior while allowing time for policy refinement.

The CSP Trap to Avoid: When implementing CSP, you’ll likely encounter broken functionality from legacy scripts. The tempting quick fix is adding `’unsafe-inline’` to your policy, which allows all inline JavaScript to execute. However, this single directive completely undermines your CSP protection, it’s the equivalent of leaving your front door unlocked because one key doesn’t work. Instead, use nonces (cryptographic tokens) for legitimate inline scripts: `<script nonce=”random-token-here”>`. Generate a new nonce per page load and reference it in your CSP header: `script-src ‘nonce-random-token-here’`. This allows your approved scripts while blocking injected malicious code. Yes, it requires server-side changes, but it’s the difference between real protection and a policy that exists only on paper.

2. Implement Subresource Integrity (SRI)

Ensure that third-party scripts haven’t been tampered with by implementing SRI tags:

3. Conduct Regular Script Audits

Maintain a comprehensive inventory of all third-party scripts, including:

• Purpose and business justification
• Data access permissions
• Update and patching procedures
• Vendor security practices
• Alternative solutions if the service becomes compromised

4. Implement Client-Side Monitoring

Deploy specialized client-side monitoring tools, ranging from browser-based CSP validators to Web Exposure management solutions to commercial Runtime Application Self-Protection (RASP) solutions, that can observe JavaScript execution in real-time, detecting:

• Unexpected data collection or transmission
• DOM manipulation attempts
• New or modified scripts
• Suspicious network requests

5. Establish Incident Response Procedures

Develop specific playbooks for client-side incidents, including:

• Script isolation and removal procedures
• Customer communication templates
• Vendor contact information and escalation paths
• Regulatory notification requirements

Implementation Challenges and Solutions

While the benefits of client-side security are clear, implementation can present obstacles. Here’s how to navigate common challenges:

Legacy System Compatibility

• Implement CSP gradually, starting with highest-risk pages
• Use CSP reporting to identify problematic scripts before enforcement
• Consider deploying a reverse proxy to inject security headers without application changes

Performance Impact

• Test thoroughly using report-only modes initially
• Monitor that SRI checks add minimal overhead (typically under 5ms per script)
• Track real user metrics like page load time during rollout

Vendor Resistance

• Include security requirements in vendor contracts upfront
• Frame requirements as protecting both parties’ reputations
• Maintain a vendor risk register tracking security posture
• Document uncooperative vendors as highest-risk dependencies

Resource Limitations

• Consider managed security services specializing in client-side protection
• Start with free browser-based tools and CSP report analyzers
• Prioritize automation for script inventory, monitoring, and alerts
• Dedicate 6-12 hours monthly for initial setup and ongoing monitoring, or budget 1-2 days quarterly for comprehensive audits in enterprise environments with 50+ third-party scripts

Organizational Buy-In

• Build business case around breach costs (average Magecart attack: $3.9M) versus monitoring investment ($10K-50K annually)
• Organizations with dedicated client-side monitoring detect breaches 5.3 months faster than industry average (reducing the 7.5-month detection window to 2.2 months), significantly limiting data exposure and regulatory penalties
• Present client-side security as revenue protection, not IT overhead
• Secure executive sponsorship before holiday freeze periods
• Emphasize prevention is less disruptive than responding to an active breach during peak season

Looking Forward

Client-side security represents a fundamental shift in how we approach web application protection. As the attack surface continues to evolve, organizations must adapt their security strategies to include comprehensive monitoring and protection of the client environment.

The holiday shopping season provides both urgency and opportunity: urgency to address these vulnerabilities before peak traffic arrives, and opportunity to implement monitoring that will provide valuable insights into normal versus suspicious script behavior.

Success requires moving beyond the traditional perimeter-focused security model to embrace a more comprehensive approach that protects data wherever it travels, including within the user’s browser. The organizations that make this transition will not only protect their customers during the holiday rush but establish a more resilient security posture for the year ahead.

Download the complete Holiday Season Security Playbook to ensure your organization is prepared for the 2025 shopping season.

Oct 13, 2025Ravie LakshmananBrowser Security / Windows Security

Microsoft said it has revamped the Internet Explorer (IE) mode in its Edge browser after receiving “credible reports” in August 2025 that unknown threat actors were abusing the backward compatibility feature to gain unauthorized access to users’ devices.

“Threat actors were leveraging basic social engineering techniques alongside unpatched (0-day) exploits in Internet Explorer’s JavaScript engine (Chakra) to gain access to victim devices,” the Microsoft Browser Vulnerability Research team said in a report published last week.

In the attack chain documented by the Windows maker, the threat actors have been found to trick unsuspecting users into visiting an seemingly legitimate website and then employ a flyout on the page to instruct them into reloading the page in IE mode.

Once the page is reloaded, the attackers are said to have weaponized an unspecified exploit in the Chakra engine to obtain remote code execution. The infection sequence culminates with the adversary using a second exploit to elevate their privileges out of the browser in order to seize complete control of the victim’s device.

The activity is concerning, not least because it subverts modern defenses baked into Chromium and Microsoft Edge by launching it in a less secure state using Internet Explorer, effectively allowing the threat actors to break out of the confines of the browser and perform various post-exploitation steps, including malware deployment, lateral movement, and data exfiltration.

Microsoft did not disclose any details regarding the nature of the vulnerabilities, the identity of the threat actor behind the attacks, and the scale of the efforts.

However, in response to evidence of active exploitation and the security risk posed by the feature, the company said it has taken steps to remove the dedicated toolbar button, context menu, and the hamburger menu items.

Users who wish to enable IE mode will now have to explicitly enable it on a case-by-case basis via Edge browser settings –

• Navigate to Settings > Default Browser
• Locate the option labeled Allow sites to be reloaded in Internet Explorer mode and set it to Allow
• After enabling this setting, add the specific site(s) requiring IE compatibility to the Internet Explorer mode pages list
• Reload the site

The Windows maker noted that these restrictions to launching IE mode are necessary to balance security and the need for legacy support.

“This approach ensures that the decision to load web content using legacy technology is significantly more intentional,” Microsoft said. “The additional steps required to add a site to a site list are a significant barrier for even the most determined attackers to overcome.”

Malware campaigns distributing the RondoDox botnet have expanded their targeting focus to exploit more than 50 vulnerabilities across over 30 vendors.

The activity, described as akin to an “exploit shotgun” approach, has singled out a wide range of internet-exposed infrastructure, including routers, digital video recorders (DVRs), network video recorders (NVRs), CCTV systems, web servers, and various other network devices, according to Trend Micro.

The cybersecurity company said it detected a RondoDox intrusion attempt on June 15, 2025, when the attackers exploited CVE-2023-1389, a security flaw in TP-Link Archer routers that has come under active exploitation repeatedly since it was first disclosed in late 2022.

RondoDox was first documented by Fortinet FortiGuard Labs back in July 2025, detailing attacks aimed at TBK digital video recorders (DVRs) and Four-Faith routers to enlist them in a botnet for carrying out distributed denial-of-service (DDoS) attacks against specific targets using HTTP, UDP, and TCP protocols.

“More recently, RondoDox broadened its distribution by using a ‘loader-as-a-service’ infrastructure that co-packages RondoDox with Mirai/Morte payloads – making detection and remediation more urgent,” Trend Micro said.

RondoDox’s expanded arsenal of exploits includes nearly five dozen security flaws, out of which 18 don’t have a CVE identifier assigned. The 56 vulnerabilities span various vendors such as D-Link, TVT, LILIN, Fiberhome, Linksys, BYTEVALUE, ASMAX, Brickcom, IQrouter, Ricon, Nexxt, NETGEAR, Apache, TBK, TOTOLINK, Meteobridge, Digiever, Edimax, QNAP, GNU, Dasan, Tenda, LB-LINK, AVTECH, Zyxel, Hytec Inter, Belkin, Billion, and Cisco.

“The latest RondoDox botnet campaign represents a significant evolution in automated network exploitation,” the company added. “It’s a clear signal that the campaign is evolving beyond single-device opportunism into a multivector loader operation.”

Late last month, CloudSEK revealed details of a large-scale loader-as-a-Service botnet distributing RondoDox, Mirai, and Morte payloads through SOHO routers, Internet of Things (IoT) devices, and enterprise apps by weaponizing weak credentials, unsanitized inputs, and old CVEs.

The development comes as security journalist Brian Krebs noted that the DDoS botnet known as AISURU is “drawing a majority of its firepower” from compromised IoT devices hosted on U.S. internet providers like AT&T, Comcast, and Verizon. One of the botnet’s operators, Forky, is alleged to be based in Sao Paulo, Brazil, and is also linked to a DDoS mitigation service called Botshield.

In recent months, AISURU has emerged as one of the largest and most disruptive botnets, responsible for some of the record-setting DDoS attacks seen to date. Built on the foundations of Mirai, the botnet controls an estimated 300,000 compromised hosts worldwide.

The findings also follow the discovery of a coordinated botnet operation involving over 100,000 unique IP addresses from no less than 100 countries targeting Remote Desktop Protocol (RDP) services in the U.S., per GreyNoise.

The activity is said to have commenced on October 8, 2025, with the majority of the traffic originating from Brazil, Argentina, Iran, China, Mexico, Russia, South Africa, Ecuador, and others.

“The campaign employs two specific attack vectors – RD Web Access timing attacks and RDP web client login enumeration – with most participating IPs sharing one similar TCP fingerprint, indicating centralized control,” the threat intelligence firm said.

Oct 13, 2025Ravie LakshmananMalware / Financial Security

Cybersecurity researchers are calling attention to a new campaign that delivers the Astaroth banking trojan that employs GitHub as a backbone for its operations to stay resilient in the face of infrastructure takedowns.

“Instead of relying solely on traditional command-and-control (C2) servers that can be taken down, these attackers are leveraging GitHub repositories to host malware configurations,” McAfee Labs researchers Harshil Patel and Prabudh Chakravorty said in a report.

“When law enforcement or security researchers shut down their C2 infrastructure, Astaroth simply pulls fresh configurations from GitHub and keeps running.”

The activity, per the cybersecurity company, is primarily focused on Brazil, although the banking malware is known to target various countries in Latin America, including Mexico, Uruguay, Argentina, Paraguay, Chile, Bolivia, Peru, Ecuador, Colombia, Venezuela, and Panama.

This is not the first time Astaroth campaigns have trained their sights on Brazil. In July and October 2024, both Google and Trend Micro warned of threat clusters dubbed PINEAPPLE and Water Makara that used phishing emails to distribute the malware.

The latest attack chain is no different in that it also begins with a DocuSign-themed phishing email containing a link that downloads a zipped Windows shortcut (.lnk) file, which, when opened, installs Astaroth on the compromised host.

The LNK file incorporates obfuscated JavaScript that’s responsible for fetching additional JavaScript from an external server. The newly fetched JavaScript code, for its part, downloads a number of files from one of the randomly selected hard-coded servers.

This includes an AutoIt script that’s executed by the JavaScript payload, following which it loads and runs shellcode, which, in turn, loads a Delphi-based DLL to decrypt and inject the Astaroth malware into a newly created RegSvc.exe process.

Astaroth is a Delphi malware designed to monitor victims’ visits to banking or cryptocurrency websites and steal their credentials using keylogging. The captured information is transmitted to the attackers using the Ngrok reverse proxy.

It accomplishes this by checking the active browser program window every second and whether it has a banking-related site opened. If these conditions are met, the malware hooks keyboard events to record keystrokes. Some of the targeted websites are listed below –

• caixa.gov[.]br
• safra.com[.]br
• itau.com[.]br
• bancooriginal.com[.]br
• santandernet.com[.]br
• btgpactual[.]com
• etherscan[.]io
• binance[.]com
• bitcointrade.com[.]br
• metamask[.]io
• foxbit.com[.]br
• localbitcoins[.]com

Astaroth also comes fitted with capabilities to resist analysis and shuts down automatically if it detects emulator, debugger, and analysis tools like QEMU Guest Agent, HookExplorer, IDA Pro, ImmunityDebugger, PE Tools, WinDbg, and Wireshark, among others.

Persistence on the host is set up by dropping an LNK file in the Windows Startup folder that runs the AutoIT script to launch the malware automatically upon a system reboot. What’s more, not only is the initial URL accessed by the JavaScript within the LNK file geofenced, the malware also makes sure that the machine’s system locale is not set to English or the U.S.

“Astaroth uses GitHub to update its configuration when the C2 servers become inaccessible, by hosting images on GitHub, which uses steganography to hide this information in plain sight,” McAfee said.

In doing so, the malware leverages a legitimate platform to host configuration files and turn it into a resilient backup infrastructure when primary C2 servers become inaccessible. The company noted that it worked with the Microsoft-owned subsidiary to remove the GitHub repositories, temporarily neutralizing the operations.

Oct 13, 2025Ravie LakshmananRansomware / Windows Security

Cybersecurity researchers have disclosed details of a new Rust-based backdoor called ChaosBot that can allow operators to conduct reconnaissance and execute arbitrary commands on compromised hosts.

“Threat actors leveraged compromised credentials that mapped to both Cisco VPN and an over-privileged Active Directory account named, ‘serviceaccount,’” eSentire said in a technical report published last week. “Using the compromised account, they leveraged WMI to execute remote commands across systems in the network, facilitating the deployment and execution of ChaosBot.”

The Canadian cybersecurity company said it first detected the malware in late September 2025 within a financial services customer’s environment.

ChaosBot is noteworthy for its abuse of Discord for command-and-control (C2). It gets its name from a Discord profile maintained by the threat actor behind it, who goes by the online moniker “chaos_00019” and is responsible for issuing remote commands to the infected devices. A second Discord user account associated with C2 operations is lovebb0024.

Alternatively, the malware has also been observed relying on phishing messages containing a malicious Windows shortcut (LNK) file as a distribution vector. Should the message recipient open the LNK file, a PowerShell command is executed to download and execute ChaosBot, while a decoy PDF masquerading as legitimate correspondence from the State Bank of Vietnam is displayed as a distraction mechanism.

The payload is a malicious DLL (“msedge_elf.dll”) that’s sideloaded using the Microsoft Edge binary called “identity_helper.exe,” after which it performs system reconnaissance and downloads a fast reverse proxy (FRP) to open a reverse proxy into the network and maintain persistent access to the compromised network.

The threat actors have also been found to leverage the malware to unsuccessfully configure a Visual Studio Code Tunnel service to act as an additional backdoor to enable command execution features. The malware’s primary function, however, is to interact with a Discord channel created by the operator with the victim’s computer name to receive further instructions.

Some of the supported commands are listed below –

• shell, to execute shell commands via PowerShell
• scr, to capture screenshots
• download, to download files to the victim device
• upload, to upload a file to the Discord channel

“New variants of ChaosBot make use of evasion techniques to bypass ETW [Event Tracing for Windows] and virtual machines,” eSentire said.

“The first technique involves patching the first few instructions of ntdll!EtwEventWrite (xor eax, eax -> ret). The second technique checks the MAC addresses of the system against known Virtual Machine MAC address prefixes for VMware and VirtualBox. If a match is found, the malware exits.”

Chaos Ransomware Gains Destructive and Clipboard Hijacking Features

The disclosure comes Fortinet FortiGuard Labs detailed a new ransomware variant of Chaos written in C++ that introduces new destructive capabilities to irrevocably delete large files rather than encrypting them and manipulate clipboard content by swapping Bitcoin addresses with an attacker-controlled wallet to redirect cryptocurrency transfers.

“This dual strategy of destructive encryption and covert financial theft underscores Chaos’ transition into a more aggressive and multifaceted threat designed to maximize financial gain,” the company said.

By incorporating destructive extortion tactics and clipboard hijacking for cryptocurrency theft, the attackers aim to position Chaos-C++ ransomware as a potent tool that can not only encrypt files, but also delete the content of any file larger than 1.3 GB and facilitate financial fraud.

The Chaos-C++ ransomware downloader poses as bogus utilities like System Optimizer v2.1 to trick users into installing them. It’s worth mentioning here that previous iterations of Chaos ransomware, such as Lucky_Gh0$t, were distributed under the guise of OpenAI ChatGPT and InVideo AI.

Once launched, the malware checks for the presence of a file named “%APPDATA%READ_IT.txt,” which signals that the ransomware has already been executed on the machine. If the file exists, it enters into what’s called a monitoring mode to keep tabs on the system clipboard.

In the event the file is not present, Chaos-C++ checks if it’s running with administrative privileges, and if so, proceeds to run a series of commands to inhibit system recovery, and then launches the encryption process to fully encrypt files that are below 50 MB, while skipping those with a file size between 50 MB and 1.3 GB, presumably for efficiency reasons.

“Rather than relying solely on full file encryption, Chaos-C++ employs a combination of methods, including symmetric or asymmetric encryption and a fallback XOR routine,” Fortinet said. “Its versatile downloader also guarantees successful execution. Together, these approaches make the ransomware execution more robust and harder to disrupt.”

Oct 12, 2025Ravie LakshmananVulnerability / Threat Intelligence

Oracle on Saturday issued a security alert warning of a fresh security flaw impacting its E-Business Suite that it said could allow unauthorized access to sensitive data.

The vulnerability, tracked as CVE-2025-61884, carries a CVSS score of 7.5, indicating high severity. It affects versions from 12.2.3 through 12.2.14.

“Easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Configurator,” according to a description of the flaw in the NIST’s National Vulnerability Database (NVD). “Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data.”

In a standalone alert, Oracle said the flaw is remotely exploitable without requiring any authentication, making it crucial that users apply the update as soon as possible. The company, however, makes no mention of it being exploited in the wild.

Oracle’s Chief Security Officer, Rob Duhart, pointed out that the vulnerability affects “some deployments” of E-Business Suite and that it could be weaponized to allow access to sensitive resources.

The development comes shortly after Google Threat Intelligence Group (GTIG) and Mandiant disclosed that dozens of organizations may have been impacted following the zero-day exploitation of CVE-2025-61882 in Oracle’s E-Business Suite (EBS) software.

The attacks have been found to leverage the vulnerability to trigger two different payload chains, dropping malware families like GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE.

While the tech giant did not specifically attribute the activity to a specific named threat actor or group, it’s believed that the attackers are orchestrated by a hacking group with ties to the Cl0p ransomware group.

Oct 11, 2025Ravie LakshmananCloud Security / Network Security

Cybersecurity company Huntress on Friday warned of “widespread compromise” of SonicWall SSL VPN devices to access multiple customer environments.

“Threat actors are authenticating into multiple accounts rapidly across compromised devices,” it said. “The speed and scale of these attacks imply that the attackers appear to control valid credentials rather than brute-forcing.”

A significant chunk of the activity is said to have commenced on October 4, 2025, with more than 100 SonicWall SSL VPN accounts across 16 customer accounts having been impacted. In the cases investigated by Huntress, authentications on the SonicWall devices originated from the IP address 202.155.8[.]73.

The company noted that in some instances, the threat actors did not engage in further adversarial actions in the network and disconnected after a short period of time. However, in other cases, the attackers have been found conducting network scanning activity and attempting to access numerous local Windows accounts.

The disclosure comes shortly after SonicWall acknowledged that a security incident resulted in the unauthorized exposure of firewall configuration backup files stored in MySonicWall accounts. The breach, according to the latest update, affects all customers who have used SonicWall’s cloud backup service.

“Firewall configuration files store sensitive information that can be leveraged by threat actors to exploit and gain access to an organization’s network,” Arctic Wolf said. “These files can provide threat actors with critical information such as user, group, and domain settings, DNS and log settings, and certificates.”

Huntress, however, noted that there is no evidence at this stage to link the breach to the recent spike in compromises.

Considering that sensitive credentials are stored within firewall configurations, organizations using the MySonicWall cloud configuration backup service are advised to reset their credentials on live firewall devices to avoid unauthorized access.

It’s also recommended to restrict WAN management and remote access where possible, revoke any external API keys that touch the firewall or management systems, monitor logins for signs of suspicious activity, and enforce multi-factor authentication (MFA) for all admin and remote accounts.

The disclosure comes amid an increase in ransomware activity targeting SonicWall firewall devices for initial access, with the attacks leveraging known security flaws (CVE-2024-40766) to breach target networks for deploying Akira ransomware.

Darktrace, in a report published this week, said it detected an intrusion targeting an unnamed U.S. customer in late August 2025 that involved network scanning, reconnaissance, lateral movement, privilege escalation using techniques like UnPAC the hash, and data exfiltration.

“One of the compromised devices was later identified as a SonicWall virtual private network (VPN) server, suggesting that the incident was part of the broader Akira ransomware campaign targeting SonicWall technology,” it said.

“This campaign by Akira ransomware actors underscores the critical importance of maintaining up-to-date patching practices. Threat actors continue to exploit previously disclosed vulnerabilities, not just zero-days, highlighting the need for ongoing vigilance even after patches are released.”

Oct 11, 2025Ravie LakshmananNetwork Security / Vulnerability

Threat actors are abusing Velociraptor, an open-source digital forensics and incident response (DFIR) tool, in connection with ransomware attacks likely orchestrated by Storm-2603 (aka CL-CRI-1040 or Gold Salem), which is known for deploying the Warlock and LockBit ransomware.

The threat actor’s use of the security utility was documented by Sophos last month. It’s assessed that the attackers weaponized the on-premises SharePoint vulnerabilities known as ToolShell to obtain initial access and deliver an outdated version of Velociraptor (version 0.73.4.0) that’s susceptible to a privilege escalation vulnerability (CVE-2025-6264) to enable arbitrary command execution and endpoint takeover, per Cisco Talos.

In the attack in mid-August 2025, the threat actors are said to have made attempts to escalate privileges by creating domain admin accounts and moving laterally within the compromised environment, as well as leveraging the access to run tools like Smbexec to remotely launch programs using the SMB protocol.

Prior to data exfiltration and dropping Warlock, LockBit, and Babuk, the adversary has been found to modify Active Directory (AD) Group Policy Objects (GPOs), turn off real-time protection to tamper with system defenses, and evade detection. The findings mark the first time Storm-2603 has been linked to the deployment of Babuk ransomware.

Rapid7, which maintains Velociraptor after acquiring it in 2021, previously told The Hacker News that it’s aware of the misuse of the tool, and that it can also be abused when in the wrong hands, just like other security and administrative tools.

“This behavior reflects a misuse pattern rather than a software flaw: adversaries simply repurpose legitimate collection and orchestration capabilities,” Christiaan Beek, Rapid7’s senior director of threat analytics, said in response to the latest reported attacks.

According to Halcyon, Storm-2603 is believed to share some connections to Chinese nation-state actors owing to its early access to the ToolShell exploit and the emergence of new samples that exhibit professional-grade development practices consistent with sophisticated hacking groups.

The ransomware crew, which first emerged in June 2025, has since used LockBit as both an operational tool and a development foundation. It’s worth noting that Warlock was the final affiliate registered with the LockBit scheme under the name “wlteaml” before LockBit suffered a data leak a month before.

“Warlock planned from the beginning to deploy multiple ransomware families to confuse attribution, evade detection, and accelerate impact,” the company said. “Warlock demonstrates the discipline, resources, and access characteristic of nation-state–aligned threat actors, not opportunistic ransomware crews.”

Halcyon also pointed out the threat actor’s 48-hour development cycles for feature additions, reflective of structured team workflows. This centralized, organized project structure suggests a team with dedicated infrastructure and tooling, it added.

Other notable aspects that suggest ties to Chinese state-sponsored actors include –

• Use of operational security (OPSEC) measures, such as stripped timestamps and intentionally corrupted expiration mechanisms
• The compilation of ransomware payloads at 22:58-22:59 China Standard Time and packaging them into a malicious installer at 01:55 the next morning
• Consistent contact information and shared, misspelled domains across Warlock, LockBit, and Babuk deployments, suggesting cohesive command-and-control (C2) operations and not opportunistic infrastructure reuse

A deeper examination of Storm-2603’s development timeline has uncovered that the threat actor established the infrastructure for AK47 C2 framework in March 2025, and then created the first prototype of the tool the next month. In April, it also pivoted from LockBit-only deployment to dual LockBit/Warlock deployment within a span of 48 hours.

While it subsequently registered as a LockBit affiliate, work continued on its own ransomware until it was formally launched under the Warlock branding in June. Weeks later, the threat actor was observed leveraging the ToolShell exploit as a zero-day while also deploying Babuk ransomware starting July 21, 2025.

“The group’s rapid evolution in April from the LockBit 3.0-only deployment to a multi-ransomware deployment 48 hours later, followed by Babuk deployment in July, shows operational flexibility, detection evasion capabilities, attribution confusion tactics, and sophisticated builder expertise using leaked and open-source ransomware frameworks,” Halcyon said.

Oct 10, 2025Ravie LakshmananSaaS Security / Threat Intelligence

A threat actor known as Storm-2657 has been observed hijacking employee accounts with the end goal of diverting salary payments to attacker-controlled accounts.

“Storm-2657 is actively targeting a range of U.S.-based organizations, particularly employees in sectors like higher education, to gain access to third-party human resources (HR) software as a service (SaaS) platforms like Workday,” the Microsoft Threat Intelligence team said in a report.

However, the tech giant cautioned that any software-as-a-service (SaaS) platform storing HR or payment and bank account information could be a target of such financially motivated campaigns. Some aspects of the campaign, codenamed Payroll Pirates, were previously highlighted by Silent Push, Malwarebytes, and Hunt.io.

What makes the attacks notable is that they don’t exploit any security flaw in the services themselves. Rather, they leverage social engineering tactics and a lack of multi-factor authentication (MFA) protections to seize control of employee accounts and ultimately modify payment information to route them to accounts managed by the threat actors.

In one campaign observed by Microsoft in the first half of 2025, the attacker is said to have obtained initial access through phishing emails that are designed to harvest their credentials and MFA codes using an adversary-in-the-middle (AitM) phishing link, thereby gaining access to their Exchange Online accounts and taking over Workday profiles through single sign-on (SSO).

The threat actors have also been observed creating inbox rules to delete incoming warning notification emails from Workday so as to hide the unauthorized changes made to profiles. This includes altering the salary payment configuration to redirect future salary payments to accounts under their control.

To ensure persistent access to the accounts, the attackers enroll their own phone numbers as MFA devices for victim accounts. What’s more, the compromised email accounts are used to distribute further phishing emails, both within the organization and to other universities.

Microsoft said it observed 11 successfully compromised accounts at three universities since March 2025 that were used to send phishing emails to nearly 6,000 email accounts across 25 universities. The email messages feature lures related to illnesses or misconduct notices on campus, inducing a false sense of urgency and tricking recipients into clicking on the fake links.

To mitigate the risk posed by Storm-2657, it’s recommended to adopt passwordless, phishing-resistant MFA methods such as FIDO2 security keys, and review accounts for signs of suspicious activity, such as unknown MFA devices and malicious inbox rules.