Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. Florida Prison Exposes Visitor Contact Info to Every Inmate
Published: 2025-08-01
A data breach at a Florida prison has exposed the personal contact information of prison visitors to all inmates, raising concerns about potential extortion, harassment, and physical threats.
2. Cursor AI Code Editor Fixed Flaw Allowing Attackers to Run Commands via Prompt Injection
Published: 2025-08-01
Cybersecurity researchers disclosed a now-patched, high-severity flaw in Cursor, an AI code editor, tracked as CVE-2025-54135, which could result in remote code execution and was addressed in version 1.3 released on July 29, 2025. The vulnerability, codenamed CurXecute, allowed attackers to gain full remote code execution under user privileges, potentially leading to ransomware, data theft, and AI manipulation.
3. Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts
Published: 2025-08-01
Threat actors are impersonating enterprises with fake Microsoft OAuth applications to harvest credentials and take over Microsoft 365 accounts, using phishing kits like Tycoon and ODx for MFA phishing, with campaigns detected since early 2025. The attacks involve phishing emails from compromised accounts, tricking recipients into clicking malicious URLs.
4. AI-Generated Malicious npm Package Drains Solana Funds from 1,500+ Before Takedown
Published: 2025-08-01
A malicious AI-generated npm package, @kodane/patch-manager, was found to conceal a cryptocurrency wallet drainer, attracting over 1,500 downloads before being removed, with its postinstall script dropping payloads across multiple operating systems. The package connected to a C2 server, posing risks like data theft and financial loss.
5. Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
Published: 2025-08-01
The China-based threat actor Storm-2603 is using a bespoke C2 framework, AK47 C2, including DNS-based AK47DNS, to deploy Warlock and LockBit ransomware, exploiting SharePoint flaws CVE-2025-49706 and CVE-2025-49704, with activity dating back to at least March 2025. The group’s operations involve HTTP and DNS-based clients for command-and-control.
6. Kremlin Goons Caught Abusing Local ISPs to Spy on Diplomats
Published: 2025-07-31
Microsoft confirmed that the Russian state-sponsored group Secret Blizzard is conducting cyber-espionage against foreign embassies in Moscow by exploiting local ISPs.
7. Secret Blizzard Deploys Malware in ISP-Level AitM Attacks on Moscow Embassies
Published: 2025-07-31
The Russian threat actor Secret Blizzard conducted an ISP-level adversary-in-the-middle attack targeting Moscow embassies, deploying malware called ApolloShadow to install trusted root certificates for intelligence collection, with activity ongoing since at least 2024. The campaign poses risks to diplomatic personnel using local ISPs in Russia.
8. Experts Detect Multi-Layer Redirect Tactic Used to Steal Microsoft 365 Login Credentials
Published: 2025-07-31
A phishing campaign abuses link wrapping services from Proofpoint and Intermedia to bypass defenses, redirecting victims to Microsoft 365 phishing pages, with activity observed over the last two months, highlighting attackers’ use of legitimate tools for malicious purposes. The tactic involves unauthorized access to email accounts for redirection.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using tools like advanced AI security solutions to monitor your systems for vulnerabilities and automate security patches. Stay safe online!