Author: Mark

Nov 13, 2025Ravie LakshmananCybersecurity / Hacking News

Behind every click, there’s a risk waiting to be tested. A simple ad, email, or link can now hide something dangerous. Hackers are getting smarter, using new tools to sneak past filters and turn trusted systems against us.

But security teams are fighting back. They’re building faster defenses, better ways to spot attacks, and stronger systems to keep people safe. It’s a constant race — every move by attackers sparks a new response from defenders.

In this week’s ThreatsDay Bulletin, we look at the latest moves in that race — from new malware and data leaks to AI tools, government actions, and major security updates shaping the digital world right now.

The cyber world never slows down. Every fix, every patch, every new idea brings a new risk waiting to be found. Staying alert isn’t just a choice anymore — it’s a habit we all need to build.

The good news is that defenders are learning faster than ever. Researchers, companies, and governments are sharing more knowledge, closing more gaps, and helping each other face threats head-on. Progress may be slow, but it’s steady.

As we wrap up this week’s ThreatsDay Bulletin, remember — awareness is the first line of defense. Stay curious, stay updated, and stay safe until next time.

Nov 13, 2025Ravie LakshmananVulnerability / Network Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting WatchGuard Fireware to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

The vulnerability in question is CVE-2025-9242 (CVSS score: 9.3), an out-of-bounds write vulnerability affecting Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1.

“WatchGuard Firebox contains an out-of-bounds write vulnerability in the OS iked process that may allow a remote unauthenticated attacker to execute arbitrary code,” CISA said in an advisory.

Details of the vulnerability were shared by watchTowr Labs last month, with the cybersecurity company stating that the issue stems from a missing length check on an identification buffer used during the IKE handshake process.

“The server does attempt certificate validation, but that validation happens after the vulnerable code runs, allowing our vulnerable code path to be reachable pre-authentication,” security researcher McCaulay Hudson noted.

There are currently no details on how the security defect is being exploited and what’s the scale of such efforts. According to data from the Shadowserver Foundation, more than 54,300 Firebox instances remain vulnerable to the critical bug as of November 12, 2025, down from a high of 75,955 on October 19.

Roughly 18,500 of these devices are in the U.S., the scans reveal. Italy (5,400), the U.K. (4,000), Germany (3,600), and Canada (3,000) round up the top five. Federal Civilian Executive Branch (FCEB) agencies are advised to apply WatchGuard’s patches by December 3, 2025.

The development comes as CISA also added CVE-2025-62215 (CVSS score: 7.0), a recently disclosed flaw in Windows kernel, and CVE-2025-12480 (CVSS score: 9.1), an improper access control vulnerability in Gladinet Triofox, to the KEV catalog. Google’s Mandiant Threat Defense team has attributed the exploitation of CVE-2025-12480 to a threat actor it tracks as UNC6485.

Cybersecurity researchers are calling attention to a large-scale spam campaign that has flooded the npm registry with thousands of fake packages since early 2024 as part of a likely financially motivated effort.

“The packages were systematically published over an extended period, flooding the npm registry with junk packages that survived in the ecosystem for almost two years,” Endor Labs researchers Cris Staicu and Kiran Raj said in a Tuesday report.

The coordinated campaign has so far published as many as 67,579 packages, according to SourceCodeRED security researcher Paul McCarty, who first flagged the activity. The end goal is quite unusual – It’s designed to inundate the npm registry with random packages rather than focusing on data theft or other malicious behaviors.

The worm-life propagation mechanism and the use of a distinctive naming scheme that relies on Indonesian names and food terms for the newly created packages have lent it the moniker IndonesianFoods. The bogus packages masquerade as Next.js projects.

“What makes this threat particularly concerning is that the attackers took the time to craft an NPM worm, rather than a singular attack,” McCarty said. “Even worse, these threat actors have been staging this for over two years.”

Some signs that point to a sustained, coordinated effort include the consistent naming patterns and the fact that the packages are published from a small network of over a dozen npm accounts.

The worm is located within a single JavaScript file (e.g., “auto.js” or “publishScript.js”) in each package, staying dormant until a user manually runs the script using a command like “node auto.js.” In other words, it does not execute automatically during installation or as part of a “postinstall” hook.

It’s not clear why someone would go to the extent of running JavaScript manually, but the existence of over 43,000 packages suggests either multiple victims executed the script – either by accident or out of curiosity – or the attackers ran it themselves to flood the registry, Henrik Plate, head of security research at Endor Labs, told The Hacker News.

“We haven’t found evidence of a coordinated social engineering campaign, but the code was written with social engineering potential, possible victim scenarios include: fake blog posts, tutorials, or README entries instructing users to run ‘node auto.js’ to ‘complete setup’ or ‘fix a build issue,’ [and] CI/CD pipeline build scripts with wildcards something like node *.js that execute all JavaScript files,” Raj added.

“The payload’s dormant design is intended to evade automated detection, by requiring manual execution instead of ‘autorun,’ the attackers reduce the chance of being flagged by security scanners and sandboxing systems.”

The manual execution causes the script to initiate a series of actions in an infinite loop, including removing <“private”: true> from the “package.json” file. This setting is typically used to prevent accidental publication of private repositories. It then proceeds to create a random package name using the internal dictionary and assign it a random version number to bypass npm’s duplicate version detection.

In the final stage, the spam package is uploaded to npm using the “npm publish” command. The entire process is repeated in an endless loop, causing a new package to be pushed out every 7 to 10 seconds. This translates to about 12 packages per minute, 720 per hour, or 17,000 per day.

“This floods the NPM registry with junk packages, wastes infrastructure resources, pollutes search results, and creates supply chain risks if developers accidentally install these malicious packages,” McCarty said.

According to Endor Labs, the campaign is part of an attack that was first flagged by Phylum (now part of Veracode) and Sonatype in April 2024 that involved the publication of thousands of spam packages to conduct a “massive automated crypto farming campaign” by abusing the Tea protocol.

“What makes this campaign particularly insidious is its worm-like spreading mechanism,” the researchers said. “Analysis of the ‘package.json’ files reveals that these spam packages do not exist in isolation; they reference each other as dependencies, creating a self-replicating network.”

Thus, when a user installs one of the spam packages, it causes npm to fetch the entire dependency tree, straining registry bandwidth as more dependencies are fetched exponentially.

Endor Labs said some of the attacker-controlled packages, such as arts-dao and gula-dao, include a tea.yaml file listing five different TEA accounts. The Tea protocol is a decentralized framework that allows open-source developers to be rewarded for their software contributions.

This likely indicates that the threat actors are using this campaign as a monetization vector by earning TEA tokens by artificially inflating their impact scores. It’s not clear who is behind the activity, but source code and infrastructure clues suggest it could be someone operating out of Indonesia.

The application security company has also flagged a second variant that employs a different package naming scheme comprising random English words (e.g., able_crocodile-notthedevs).

The findings also serve to highlight a security blind spot in security scanners, which are known to flag packages that execute malicious code during installation by monitoring lifecycle hooks or detecting suspicious system calls.

“In this case, they found nothing because there was nothing to find at the time of installation,” Endor Labs said. “The sheer number of packages flagged in the current campaign shows that security scanners must analyze these signals in the future.”

Garrett Calpouzos, principal security researcher at software supply chain security firm Sonatype, characterized IndonesianFoods as a self-publishing worm operating at a massive scale, overwhelming security data systems in the process.

“The technical sophistication isn’t necessarily higher — interestingly, these packages do not appear to even try to infiltrate developer machines — it’s the automation and scale that are escalating at an alarming rate,” Calpouzos said.

“Each wave of these attacks weaponizes npm’s open nature in slightly new ways. This one may not steal credentials or inject code, but it still strains the ecosystem and proves how trivial it is to disrupt the world’s largest software supply chain. While the motivation is unclear, the implications are striking.”

When reached for comment, a GitHub spokesperson said it has removed the packages in question from npm, and that it’s committed to detecting, analyzing, and taking down packages and accounts that go against its policies.

“We have disabled malicious npm packages in accordance with GitHub’s Acceptable Use Policies which prohibit posting content that directly supports unlawful active attack or malware campaigns that are causing technical harms,” the spokesperson added.

“We employ manual reviews and at-scale detections that use machine learning and constantly evolve to mitigate malicious usage of the platform. We also encourage customers and community members to report abuse and spam.”

Cybersecurity researchers are calling attention to a large-scale spam campaign that has flooded the npm registry with thousands of fake packages since early 2024 as part of a likely financially motivated effort.

“The packages were systematically published over an extended period, flooding the npm registry with junk packages that survived in the ecosystem for almost two years,” Endor Labs researchers Cris Staicu and Kiran Raj said in a Tuesday report.

The coordinated campaign has so far published as many as 46,484 packages, according to SourceCodeRED security researcher Paul McCarty, who first flagged the activity. The end goal is quite unusual – It’s designed to inundate the npm registry with random packages rather than focusing on data theft or other malicious behaviors.

The worm-life propagation mechanism and the use of a distinctive naming scheme that relies on Indonesian names and food terms for the newly created packages have lent it the moniker IndonesianFoods. The bogus packages masquerade as Next.js projects.

“What makes this threat particularly concerning is that the attackers took the time to craft an NPM worm, rather than a singular attack,” McCarty said. “Even worse, these threat actors have been staging this for over two years.”

Some signs that point to a sustained, coordinated effort include the consistent naming patterns and the fact that the packages are published from a small network of over a dozen npm accounts.

The worm is located within a single JavaScript file (e.g., “auto.js” or “publishScript.js”) in each package, staying dormant until a user manually runs the script using a command like “node auto.js.” In other words, it does not execute automatically during installation or as part of a “postinstall” hook.

It’s not clear why someone would go to the extent of running JavaScript manually, but the existence of over 43,000 packages suggests either multiple victims executed the script – either by accident or out of curiosity – or the attackers ran it themselves to flood the registry, Henrik Plate, head of security research at Endor Labs, told The Hacker News.

“We haven’t found evidence of a coordinated social engineering campaign, but the code was written with social engineering potential, possible victim scenarios include: fake blog posts, tutorials, or README entries instructing users to run ‘node auto.js’ to ‘complete setup’ or ‘fix a build issue,’ [and] CI/CD pipeline build scripts with wildcards something like node *.js that execute all JavaScript files,” Raj added.

“The payload’s dormant design is intended to evade automated detection, by requiring manual execution instead of ‘autorun,’ the attackers reduce the chance of being flagged by security scanners and sandboxing systems.”

The manual execution causes the script to initiate a series of actions in an infinite loop, including removing <“private”: true> from the “package.json” file. This setting is typically used to prevent accidental publication of private repositories. It then proceeds to create a random package name using the internal dictionary and assign it a random version number to bypass npm’s duplicate version detection.

In the final stage, the spam package is uploaded to npm using the “npm publish” command. This step is repeated in an infinite loop, causing a new package to be pushed out every 7 to 10 seconds. This translates to about 12 packages per minute, 720 per hour, or 17,000 per day.

“This floods the NPM registry with junk packages, wastes infrastructure resources, pollutes search results, and creates supply chain risks if developers accidentally install these malicious packages,” McCarty said.

According to Endor Labs, the campaign is part of an attack that was first flagged by Phylum (now part of Veracode) and Sonatype in April 2024 that involved the publication of thousands of spam packages to conduct a “massive automated crypto farming campaign” by abusing the Tea protocol.

“What makes this campaign particularly insidious is its worm-like spreading mechanism,” the researchers said. “Analysis of the ‘package.json’ files reveals that these spam packages do not exist in isolation; they reference each other as dependencies, creating a self-replicating network.”

Thus, when a user installs one of the spam packages, it causes npm to fetch the entire dependency tree, straining registry bandwidth as more dependencies are fetched exponentially.

Endor Labs said some of the attacker-controlled packages, such as arts-dao and gula-dao, include a tea.yaml file listing five different TEA accounts. The Tea protocol is a decentralized framework that allows open-source developers to be rewarded for their software contributions.

This likely indicates that the threat actors are using this campaign as a monetization vector by earning TEA tokens by artificially inflating their impact score. It’s not clear who is behind the activity, but source code and infrastructure clues suggest it could be someone operating out of Indonesia.

The application security company has also flagged a second variant that employs a different naming scheme comprising random English words (e.g., able_crocodile-notthedevs).

The findings also serve to highlight a security blind spot in security scanners, which are known to flag packages that execute malicious code during installation by monitoring lifecycle hooks or detecting suspicious system calls.

“In this case, they found nothing because there was nothing to find at the time of installation,” Endor Labs said. “The sheer number of packages flagged in the current campaign shows that security scanners must analyze these signals in the future.”

Garrett Calpouzos, principal security researcher at software supply chain security firm Sonatype, characterized IndonesianFoods as a self-publishing worm operating at a massive scale, overwhelming security data systems in the process.

“The technical sophistication isn’t necessarily higher — interestingly, these packages do not appear to even try to infiltrate developer machines — it’s the automation and scale that are escalating at an alarming rate,” Calpouzos said.

“Each wave of these attacks weaponizes npm’s open nature in slightly new ways. This one may not steal credentials or inject code, but it still strains the ecosystem and proves how trivial it is to disrupt the world’s largest software supply chain. While the motivation is unclear, the implications are striking.”

When reached for comment, a GitHub spokesperson said it has removed the packages in question from npm, and that it’s committed to detecting, analyzing, and taking down packages and accounts that go against its policies.

“We have disabled malicious npm packages in accordance with GitHub’s Acceptable Use Policies which prohibit posting content that directly supports unlawful active attack or malware campaigns that are causing technical harms,” the spokesperson added.

“We employ manual reviews and at-scale detections that use machine learning and constantly evolve to mitigate malicious usage of the platform. We also encourage customers and community members to report abuse and spam.”

Nov 12, 2025Ravie LakshmananCybercrime / Malware

Google has filed a civil lawsuit in the U.S. District Court for the Southern District of New York (SDNY) against China-based hackers who are behind a massive Phishing-as-a-Service (PhaaS) platform called Lighthouse that has ensnared over 1 million users across 120 countries.

The PhaaS kit is used to conduct large-scale SMS phishing attacks that exploit trusted brands like E-ZPass and USPS to steal people’s financial information by prompting them to click on a link using lures related to fake toll fees or package deliveries. While the scam in itself is fairly simple, it’s the industrial scale of the operation that has allowed it to illegally make more than a billion dollars over the past three years.

“They exploit the reputations of Google and other brands by illegally displaying our trademarks and services on fraudulent websites,” Halimah DeLaine Prado, General Counsel at Google, said. “We found at least 107 website templates featuring Google’s branding on sign-in screens specifically designed to trick people into believing the sites are legitimate.”

The company said it’s taking legal action to dismantle the underlying infrastructure under the Racketeer Influenced and Corrupt Organizations (RICO) Act, the Lanham Act, and the Computer Fraud and Abuse Act.

Lighthouse, along with other PhaaS platforms like Darcula and Lucid, is part of an interconnected cybercrime ecosystem operating out of China that is known to send thousands of smishing messages via Apple iMessage and Google Messages’ RCS capabilities to users in the U.S. and beyond in hopes of stealing sensitive data. These kits have been put to use by a smishing syndicate tracked as Smishing Triad.

In a report published in September, Netcraft revealed that Lighthouse and Lucid have been linked to more than 17,500 phishing domains targeting 316 brands from 74 countries. Phishing templates associated with Lighthouse are licensed from anywhere between $88 for a week to $1,588 for a yearly subscription.

“While Lighthouse operates independently of the XinXin group, its alignment with Lucid in terms of infrastructure and targeting patterns highlights the broader trend of collaboration and innovation within the PhaaS ecosystem,” Swiss cybersecurity company PRODAFT said in a report published in April.

It’s estimated that Chinese smishing syndicates may have compromised between 12.7 million and 115 million payment cards in the U.S. alone between July 2023 and October 2024. In recent years, cybercrime groups from China have also evolved to develop new tools like Ghost Tap to add stolen card details to digital wallets on iPhones and Android phones.

As recently as last month, Palo Alto Networks Unit 42 said the threat actors behind Smishing Triad have used more than 194,000 malicious domains since January 1, 2024, mimicking a wide range of services, including banks, cryptocurrency exchanges, mail and delivery services, police forces, state-owned enterprises, and electronic tolls, among others.

Nov 12, 2025Ravie LakshmananCybercrime / Malware

Google has filed a civil lawsuit in the U.S. District Court for the Southern District of New York (SDNY) against China-based hackers who are behind a massive Phishing-as-a-Service (PhaaS) platform called Lighthouse that has ensnared over 1 million users across 120 countries.

The PhaaS kit is used to conduct large-scale SMS phishing attacks that exploit trusted brands like E-ZPass and USPS to steal people’s financial information by prompting them to click on a link using lures related to fake toll fees or package deliveries. While the scam in itself is fairly simple, it’s the industrial scale of the operation that has allowed it to illegally make more than a billion dollars over the past three years.

“They exploit the reputations of Google and other brands by illegally displaying our trademarks and services on fraudulent websites,” Halimah DeLaine Prado, General Counsel at Google, said. “We found at least 107 website templates featuring Google’s branding on sign-in screens specifically designed to trick people into believing the sites are legitimate.”

The company said it’s taking legal action to dismantle the underlying infrastructure under the Racketeer Influenced and Corrupt Organizations (RICO) Act, the Lanham Act, and the Computer Fraud and Abuse Act.

Lighthouse, along with other PhaaS platforms like Darcula and Lucid, is part of an interconnected cybercrime ecosystem operating out of China that is known to send thousands of smishing messages via Apple iMessage and Google Messages’ RCS capabilities to users in the U.S. and beyond in hopes of stealing sensitive data. These kits have been put to use by a smishing syndicate tracked as Smishing Triad.

In a report published in September, Netcraft revealed that Lighthouse and Lucid have been linked to more than 17,500 phishing domains targeting 316 brands from 74 countries. Phishing templates associated with Lighthouse are licensed from anywhere between $88 for a week to $1,588 for a yearly subscription.

“While Lighthouse operates independently of the XinXin group, its alignment with Lucid in terms of infrastructure and targeting patterns highlights the broader trend of collaboration and innovation within the PhaaS ecosystem,” Swiss cybersecurity company PRODAFT said in a report published in April.

It’s estimated that Chinese smishing syndicates may have compromised between 12.7 million and 115 million payment cards in the U.S. alone between July 2023 and October 2024. In recent years, cybercrime groups from China have also evolved to develop new tools like Ghost Tap to add stolen card details to digital wallets on iPhones and Android phones.

As recently as last month, Palo Alto Networks Unit 42 said the threat actors behind Smishing Triad have used more than 194,000 malicious domains since January 1, 2024, mimicking a wide range of services, including banks, cryptocurrency exchanges, mail and delivery services, police forces, state-owned enterprises, and electronic tolls, among others.

Nov 12, 2025Ravie LakshmananNetwork Security / Zero-Day

Amazon’s threat intelligence team on Wednesday disclosed that it observed an advanced threat actor exploiting two then-zero-day security flaws in Cisco Identity Service Engine (ISE) and Citrix NetScaler ADC products as part of attacks designed to deliver custom malware.

“This discovery highlights the trend of threat actors focusing on critical identity and network access control infrastructure – the systems enterprises rely on to enforce security policies and manage authentication across their networks,” CJ Moses, CISO of Amazon Integrated Security, said in a report shared with The Hacker News.

The attacks were flagged by its MadPot honeypot network, with the activity weaponizing the following two vulnerabilities –

• CVE-2025-5777 or Citrix Bleed 2 (CVSS score: 9.3) – An insufficient input validation vulnerability in Citrix NetScaler ADC and Gateway that could be exploited by an attacker to bypass authentication. (Fixed by Citrix in June 2025)
• CVE-2025-20337 (CVSS score: 10.0) – An unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow a remote attacker to execute arbitrary code on the underlying operating system as root. (Fixed by Cisco in July 2025)

While both shortcomings have come under active exploitation in the wild, the report from Amazon sheds light on the exact nature of the attacks leveraging them.

The tech giant said it detected exploitation attempts targeting CVE-2025-5777 as a zero-day, and that further investigation of the threat led to the discovery of an anomalous payload aimed at Cisco ISE appliances by weaponizing CVE-2025-20337. The activity is said to have culminated in the deployment of a custom web shell disguised as a legitimate Cisco ISE component named IdentityAuditAction.

“This wasn’t typical off-the-shelf malware, but rather a custom-built backdoor specifically designed for Cisco ISE environments,” Moses said.

The web shell comes fitted with capabilities to fly under the radar, operating entirely in memory and using Java reflection to inject itself into running threads. It also registers as a listener to monitor all HTTP requests across the Tomcat server and implements DES encryption with non-standard Base64 encoding to evade detection.

Amazon described the campaign as indiscriminate, characterizing the threat actor as “highly resourced” owing to its ability to leverage multiple zero-day exploits, either by possessing advanced vulnerability research capabilities or having potential access to non-public vulnerability information. On top of that, the use of bespoke tools reflects the adversary’s knowledge of enterprise Java applications, Tomcat internals, and the inner workings of Cisco ISE.

The findings once again illustrate how threat actors are continuing to target network edge appliances to breach networks of interest, making it crucial that organizations limit access, through firewalls or layered access, to privileged management portals.

“The pre-authentication nature of these exploits reveals that even well-configured and meticulously maintained systems can be affected,” Moses said. “This underscores the importance of implementing comprehensive defense-in-depth strategies and developing robust detection capabilities that can identify unusual behavior patterns.”

Nov 12, 2025The Hacker NewsThreat Detection / Risk Management

Every day, security teams face the same problem—too many risks, too many alerts, and not enough time. You fix one issue, and three more show up. It feels like you’re always one step behind.

But what if there was a smarter way to stay ahead—without adding more work or stress?

Join The Hacker News and Bitdefender for a free cybersecurity webinar to learn about a new approach called Dynamic Attack Surface Reduction (DASR)—a method that helps security teams close gaps before attackers even find them.

Most tools today only tell you what’s wrong. They scan, report, and give you long lists of problems. But they don’t help you fix them fast enough.

The truth is, the attack surface keeps changing—new apps, cloud systems, remote devices, misconfigurations. It never stops.

Attackers only need one open door. And that’s why traditional defenses often fail—they react too slowly.

Meet DASR: A Smarter Way to Stay Safe

Dynamic Attack Surface Reduction (DASR) changes how we defend.

Instead of waiting for threats, DASR works quietly in the background, watching for risky changes and closing weak spots automatically.

You’ll learn in this cybersecurity expert webinar:

• Why traditional scans aren’t enough anymore
• How DASR uses automation and context to reduce risks in real time
• How to safely test and use DASR in your own environment

Save your seat now and see how you can turn endless alerts into lasting protection.

Who You’ll Hear From

Two experts from Bitdefender will share real stories and lessons from the front lines:

• Cristian Iordache, GravityZone Solutions Director, who helps companies build stronger defenses that actually work.
• Dragos Gavriluț, VP of Threat Research, who’s led security teams for over 20 years and built tools that stop real-world attacks.

They’ll show how DASR and Bitdefender’s PHASR system help close the doors attackers rely on—before damage happens.

Security shouldn’t feel like running in circles. With DASR, you can finally move from chasing problems to preventing them—calmly and confidently.

If you want a simpler, stronger, and faster way to stay ahead of threats, this is the session you don’t want to miss.

Register now and take your first step toward a safer, smarter way to defend your organization.

Nov 12, 2025Ravie LakshmananVulnerability / Patch Tuesday

Microsoft on Tuesday released patches for 63 new security vulnerabilities identified in its software, including one that has come under active exploitation in the wild.

Of the 63 flaws, four are rated Critical and 59 are rated Important in severity. Twenty-nine of these vulnerabilities are related to privilege escalation, followed by 16 remote code execution, 11 information disclosure, three denial-of-service (DoS), two security feature bypass, and two spoofing bugs.

The patches are in addition to the 27 vulnerabilities the Windows maker addressed in its Chromium-based Edge browser since the release of October 2025’s Patch Tuesday update.

The zero-day vulnerability that has been listed as exploited in Tuesday’s update is CVE-2025-62215 (CVSS score: 7.0), a privilege escalation flaw in Windows Kernel. The Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have been credited with discovering and reporting the issue.

“Concurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Kernel allows an authorized attacker to elevate privileges locally,” the company said in an advisory.

That said, successful exploitation hinges on an attacker who has already gained a foothold on a system to win a race condition. Once this criterion is satisfied, it could permit the attacker to obtain SYSTEM privileges.

“An attacker with low-privilege local access can run a specially crafted application that repeatedly attempts to trigger this race condition,” Ben McCarthy, lead cybersecurity engineer at Immersive, said.

“The goal is to get multiple threads to interact with a shared kernel resource in an unsynchronized way, confusing the kernel’s memory management and causing it to free the same memory block twice. This successful ‘double free’ corrupts the kernel heap, allowing the attacker to overwrite memory and hijack the system’s execution flow.”

It’s currently not known how this vulnerability is being exploited and by whom, but it’s assessed to be used as part of a post-exploitation activity to escalate their privileges after obtaining initial access through some other means, such as social engineering, phishing, or exploitation of another vulnerability, Satnam Narang, senior staff research engineer at Tenable, said.

“When chained with other bugs this kernel race is critical: an RCE or sandbox escape can supply the local code execution needed to turn a remote attack into a SYSTEM takeover, and an initial low‑privilege foothold can be escalated to dump credentials and move laterally,” Mike Walters, president and co-founder of Action1, said in a statement.

Also patched as part of the updates are two heap-based buffer overflow flaws in Microsoft’s Graphics Component (CVE-2025-60724, CVSS score: 9.8) and Windows Subsystem for Linux GUI (CVE-2025-62220, CVSS score: 8.8) that could result in remote code execution.

“The attacker must inject themselves into the logical network path between the target and the resource requested by the victim to read or modify network communications,” Microsoft said. “An unauthorized attacker must wait for a user to initiate a connection.”

Silverfort researchers Eliran Partush and Dor Segal, who discovered the shortcoming, described it as a Kerberos constrained delegation vulnerability that allows an attacker to impersonate arbitrary users and gain control over an entire domain by means of an adversary-in-the-middle (AitM) attack.

An attacker who is able to successfully exploit the flaw could escalate privileges and move laterally to other machines in an organization. More concerning, threat actors could also gain the ability to impersonate any user in the company, allowing them to gain unfettered access or become a domain administrator.

“Any organization using Active Directory, with the Kerberos delegation capability turned on, is impacted,” Silverfort said. “Because Kerberos delegation is a feature within Active Directory, an attacker requires initial access to an environment with compromised credentials.”

Software Patches from Other Vendors

In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including —

• Adobe
• Amazon Web Services
• AMD
• Apple
• ASUS
• Atlassian
• AutomationDirect
• Bitdefender
• Broadcom (including VMware)
• Cisco
• Citrix
• ConnectWise
• D-Link
• Dell
• Devolutions
• Drupal
• Elastic
• F5
• Fortinet
• GitLab
• Google Android
• Google Chrome
• Google Cloud
• Grafana
• Hitachi Energy
• HP
• HP Enterprise (including Aruba Networking and Juniper Networks)
• IBM
• Intel
• Ivanti
• Jenkins
• Lenovo
• Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Red Hat, Rocky Linux, SUSE, and Ubuntu
• MediaTek
• Mitsubishi Electric
• MongoDB
• Moxa
• Mozilla Firefox and Firefox ESR
• NVIDIA
• Oracle
• Palo Alto Networks
• QNAP
• Qualcomm
• Rockwell Automation
• Ruckus Wireless
• Samba
• Samsung
• SAP
• Schneider Electric
• Siemens
• SolarWinds
• SonicWall
• Splunk
• Spring Framework
• Supermicro
• Synology
• TP-Link
• WatchGuard, and
• Zoom

Active Directory remains the authentication backbone for over 90% of Fortune 1000 companies. AD’s importance has grown as companies adopt hybrid and cloud infrastructure, but so has its complexity. Every application, user, and device traces back to AD for authentication and authorization, making it the ultimate target. For attackers, it represents the holy grail: compromise Active Directory, and you can access the entire network.

Why attackers target Active Directory

AD serves as the gatekeeper for everything in your enterprise. So, when adversaries compromise AD, they gain privileged access that lets them create accounts, modify permissions, disable security controls, and move laterally, all without triggering most alerts.

The 2024 Change Healthcare breach showed what can happen when AD is compromised. In this attack, hackers exploited a server lacking multifactor authentication, pivoted to AD, escalated privileges, and then executed a highly costly cyberattack. Patient care came to a screeching halt. Health records were exposed. The organization paid millions in ransom.

Once attackers control AD, they control your entire network. And standard security tools often struggle to detect these attacks because they look like legitimate AD operations.

Common attack techniques

• Golden ticket attacks generate counterfeit authentication tickets granting full domain access for months.
• DCSync attacks exploit replication permissions to extract password hashes directly from domain controllers.
• Kerberoasting gains elevated rights by targeting service accounts with weak passwords.

How hybrid environments expand the attack surface

Organizations running hybrid Active Directory face challenges that didn’t exist five years ago. Your identity infrastructure now spans on-premises domain controllers, Azure AD Connect synchronization, cloud identity services, and multiple authentication protocols.

Attackers exploit this complexity, abusing synchronization mechanisms to pivot between environments. OAuth token compromises in cloud services provide backdoor access to on-premises resources. And legacy protocols like NTLM remain enabled for backward compatibility, giving intruders easy relay attack opportunities.

The fragmented security posture makes things worse. On-premises security teams use different tools than cloud security teams, allowing visibility gaps to emerge at the boundaries. Threat actors operate in these blind spots while security teams struggle to correlate events across platforms.

Verizon’s Data Breach Investigation Report found that compromised credentials are involved in 88% of breaches. Cybercriminals harvest credentials through phishing, malware, brute force, and purchasing breach databases.

Frequent vulnerabilities in Active Directory

• Weak passwords: Users reuse the same passwords across personal and work accounts, so one breach exposes multiple systems. Standard eight-character complexity rules seem secure, but hackers can crack them in seconds.
• Service account problems: Service accounts often use passwords that never expire or change, and they typically have excessive permissions that allow lateral movement once compromised.
• Cached credentials: Workstations store administrative credentials in memory, where attackers can extract them with standard tools.
• Poor visibility: Teams lack insight into who uses privileged accounts, what level of access they have, and when they use them.
• Stale access: Former employees keep privileged access long after they leave because no one audits and removes it, leading to a buildup of stale accounts that attackers can exploit.

And the hits keep coming: April 2025 brought another critical AD flaw allowing privilege escalation from low-level access to system-level control. Microsoft released a patch, but many organizations struggle to test and deploy updates quickly across all domain controllers.

Modern approaches to strengthen your Active Directory

Defending AD requires a layered security approach that addresses credential theft, privilege management, and continuous monitoring.

Strong password policies are your first defense

Effective password policies play a critical role in protecting your environment. Blocking passwords that appear in breach databases stops staffers from using credentials that hackers already have. Continuous scanning detects when user passwords are compromised in new breaches, not just at password reset. And dynamic feedback shows users whether their password is strong in real time, guiding them toward secure passwords they can actually remember.

Privileged access management reduces your attack surface

Implementing privileged access management helps minimize risk by limiting how and when administrative privileges are used. Start by segregating administrative accounts from standard user accounts, so compromised user credentials can’t provide admin access. Enforce just-in-time access that grants elevated privileges only when needed and automatically revokes them afterward. Route all administrative tasks through privileged access workstations to prevent credential theft from regular endpoints.

Zero-trust principles apply to Active Directory

Adopting a zero-trust approach strengthens Active Directory security by verifying every access attempt rather than assuming trust within the network. Enforce conditional access policies that evaluate user location, device health, and behavior patterns before granting access, not just username and password. Require multifactor authentication for all privileged accounts to stop malicious actors who steal credentials.

Continuous monitoring catches attacks in progress

Deploy tools that track every significant AD change, including group membership modifications, permission grants, policy updates, and unusual replication activity between domain controllers. Then, configure alerts for suspicious patterns, like multiple authentication failures from the same account, or administrative actions happening at 3 am when your admins are asleep. Continuous monitoring provides the visibility needed to detect and stop attacks before they escalate.

Patch management is a must-have for domain controllers

Strong patch management practices are essential for maintaining secure domain controllers. Deploy security updates that close privilege escalation paths within days, not weeks, bad actors actively scan for unpatched systems.

Active Directory security is a continuous process

Active Directory security isn’t a one-off project you complete. Hackers constantly refine techniques, new vulnerabilities emerge, and your infrastructure changes. That means your security also requires ongoing attention and continuous improvement.

Passwords remain the most common attack vector, making them your top priority to fix. For the highest level of protection, invest in a solution that continuously monitors for compromised credentials and blocks them in real-time. For example, a tool like Specops Password Policy integrates directly with Active Directory to block compromised credentials before they become a problem.

Specops Password Policy continuously blocks over 4 billion compromised passwords, preventing users from creating credentials that attackers already have. Daily scans catch breached passwords in real-time instead of waiting for the next password change cycle. And when users create new passwords, dynamic feedback guides them toward strong options they can actually remember, reducing support calls while improving security. Book a live demo of Specops Password Policy today.