France’s CNIL fined Google $379M and Shein $175M for breaching cookie rules
Source: https://securityaffairs.com/181911/laws-and-regulations/frances-cnil-fined-google-379m-and-shein-175m-for-breaching-cookie-rules.html
U.S. CISA adds TP-Link Archer C7(EU) and TL-WR841N flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/181886/hacking/u-s-cisa-adds-tp-link-archer-c7eu-and-tl-wr841n-flaws-to-its-known-exploited-vulnerabilities-catalog.html
Proofpoint researchers have observed an increase in cybercriminals using Stealerium-based malware, an open-source infostealer available on GitHub. Multiple stealers share code with Stealerium, including Phantom Stealer. Campaigns delivering Stealerium have used various lures and file types, targeting industries like hospitality, education, and finance. The malware can exfiltrate a wide range of data, including browser credentials, credit card info, and crypto wallet data. It uses anti-analysis techniques and can exfiltrate data through multiple channels like SMTP, Discord, and Telegram. The rise in Stealerium usage reflects the growing trend of threat actors pivoting to information stealers as identity theft becomes a priority.
LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The backdoor is deployed via Microsoft OneDrive.exe using DLL side-loading, and it establishes persistence by modifying registry keys. NotDoor employs obfuscation techniques and a custom string encoding method. It can execute commands, exfiltrate files, and upload files to the victim's machine. The malware demonstrates APT28's continuous evolution in bypassing defense mechanisms, posing a significant threat to NATO member countries across various sectors.
Disney to pay $10M to settle claims it collected kids’ data on YouTube
Source: https://www.bleepingcomputer.com/news/security/disney-to-pay-10m-to-settle-claims-it-collected-kids-data-on-youtube/
Hackers Grab $130M Using Brazil's Real-Time Payment System
Source: https://www.databreachtoday.co.uk/hackers-grab-130m-using-brazils-real-time-payment-system-a-29352
In June 2025, Google's Salesforce instance was breached by UNC6040 & UNC6240 using vishing, OAuth app abuse, and anonymity layers. The attackers stole business data of small and medium-sized clients. A parallel attack by UNC6395 compromised Salesloft Drift's Salesforce integration, affecting hundreds of customers. Both incidents involved sophisticated social engineering, OAuth token abuse, and data exfiltration via TOR. The attacks are linked to the ShinyHunters group and share similarities with other high-profile breaches targeting various industries. The incidents highlight vulnerabilities in SaaS environments and the need for improved security measures, including OAuth governance, identity management, and proactive monitoring.
Cloudflare Confirms Data Breach Linked to Salesforce and Salesloft Drift
Source: https://hackread.com/cloudflare-data-breach-salesforce-and-salesloft-drift/
Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control
Source: https://thehackernews.com/2025/09/researchers-warn-of-mystrodx-backdoor.html
Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE
Source: https://thehackernews.com/2025/09/lazarus-group-expands-malware-arsenal.html
Palo Alto Networks, Zscaler and PagerDuty Hit in Salesforce Linked Data Breaches
Source: https://hackread.com/palo-alto-networks-zscaler-pagerduty-salesforce-data-breach/
When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider
Source: https://thehackernews.com/2025/09/when-browsers-become-attack-surface.html
