Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. CL-STA-0969 Installs Covert Malware in Telecom Networks During 10-Month Espionage Campaign
Published: 2025-08-02
A state-sponsored threat actor known as CL-STA-0969 targeted telecommunications organizations in Southeast Asia to gain remote control over compromised networks using tools like Cordscan.
2. New ‘Plague’ PAM Backdoor Exposes Critical Linux Systems to Silent Credential Theft
Published: 2025-08-02
Cybersecurity researchers identified a malicious Linux backdoor called Plague, a rogue PAM module that silently bypasses authentication and steals credentials, evading detection for a year.
3. Akira Ransomware Exploits SonicWall VPNs in Likely Zero-Day Attack on Fully-Patched Devices
Published: 2025-08-02
Akira ransomware attacks exploited SonicWall SSL VPN devices, potentially using a zero-day vulnerability, affecting fully-patched systems in a surge of activity observed in late July 2025.
4. Cursor AI Code Editor Fixed Flaw Allowing Attackers to Run Commands via Prompt Injection
Published: 2025-08-01
A high-severity vulnerability, CVE-2025-54135, in the Cursor AI code editor was patched, previously allowing remote code execution through prompt injection.
5. Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts
Published: 2025-08-01
Threat actors impersonated enterprises with fake Microsoft OAuth applications, using phishing kits like Tycoon to harvest credentials and access Microsoft 365 accounts.
6. AI-Generated Malicious npm Package Drains Solana Funds from 1,500+ Before Takedown
Published: 2025-08-01
A malicious AI-generated npm package, @kodane/patch-manager, drained Solana funds from over 1,500 downloads before being removed, featuring a stealth wallet drainer.
7. Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks
Published: 2025-08-01
The China-based threat actor Storm-2603 used a DNS-based AK47 C2 framework to deploy Warlock and LockBit ransomware, exploiting Microsoft SharePoint vulnerabilities since at least March 2025.
8. Secret Blizzard Deploys Malware in ISP-Level AitM Attacks on Moscow Embassies
Published: 2025-07-31
Russian threat actor Secret Blizzard conducted ISP-level adversary-in-the-middle attacks to deploy ApolloShadow malware, targeting foreign embassies in Moscow for espionage since at least 2024.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using robust security tools and practices to monitor and protect your systems from vulnerabilities and attacks. Stay safe online!