Cybersecurity News | Daily Recap [04 Aug 2025]

hendryadrian.com

hendryadrian.com

Malware & Campaigns

• ClickTok malware campaign targets TikTok Shop users with fake stores distributing SparkKitty spyware to steal cryptocurrency wallets via trojanized apps and AI ads – ClickTok Campaign
• A stealthy new Linux malware Plague bypasses authentication using a malicious PAM module for persistent SSH backdoor access with advanced evasion techniques – Plague Linux Malware, Plague Stealth Backdoor
• REMCOS remote-access trojan deployed via malicious Windows shortcut files in a multi-stage campaign, enabling keystroke logging, spying, and full system control – REMCOS Shortcut Attack
• PlayPraetor Android RAT infects over 11,000 devices via fake Google Play pages and Meta ads, targeting Spanish and French speakers for financial fraud and data theft – PlayPraetor RAT

Vulnerabilities & Exploits

• Critical flaws in Dahua security cameras allow full remote control; firmware updates are urgently recommended – Dahua Flaws
• Ransomware gangs and Chinese state-backed hackers exploit Microsoft SharePoint zero-day vulnerabilities to deploy ransomware and espionage malware like 4L4MD4R – SharePoint Attacks
• Multiple critical vulnerabilities patched in Cursor AI code editor that allowed remote code execution and prompt injection attacks – Cursor Vulnerabilities
• Researchers warn of phishing attacks against Mozilla add-on developers impersonating official teams to steal credentials – Mozilla Phishing
• Credential-stealing phishing exploits link-wrapping services from companies like Proofpoint and Intermedia to bypass filters and target Microsoft 365 logins – Microsoft 365 Phishing

Cybersecurity Policy & Funding

• US government announces over $100 million in grants to enhance cybersecurity for state, local, and tribal governments – US Cyber Grants
• Sean Cairncross confirmed as US National Cyber Director to improve coordination and strategy despite lacking a cybersecurity background – Sean Cairncross Confirmed, Cairncross Appointment
• A new panel is creating a roadmap for establishing a dedicated U.S. Cyber Force to address leadership and strategic gaps in cyber military operations – US Cyber Force Roadmap

Cyber Espionage & Threat Actors

• The nation-state group Liminal Panda conducts covert cyberespionage against Southwest Asian telecom infrastructure, tracking mobile users and exploiting outdated systems – Liminal Panda Campaign
• APT36 (Transparent Tribe) escalates cyber-espionage in India using the new Poseidon backdoor targeting railways, oil, and government sectors – APT36 Poseidon Attack

Data Breaches & Settlements

• Data breach at Northwest Radiologists exposes sensitive information of nearly 350,000 Washington residents, potentially linked to ransomware, with credit monitoring offered – Radiologists Breach
• Gene sequencing company Illumina settles for $9.8 million over product vulnerabilities affecting U.S. government agencies, involving remote exploitation risks – Illumina Settlement
• Toptal’s GitHub npm packages briefly compromised due to leaked LastPass credentials; issue quickly contained with no known impact despite reports of 5,000 downloads – Toptal GitHub Compromise (Note: No direct link provided)

AI & Security Risks

• Cisco’s jailbreak demo reveals weaknesses in AI guardrails, showing that 13% of data breaches involve AI models vulnerable to instruction-level decomposition attacks – AI Guardrails Weakness

Security Best Practices

• Comprehensive guide on preventing man-in-the-middle (MITM) attacks emphasizes encryption, network security, and user education to block covert data interception – MITM Prevention Guide

Weekly Threat Overview

• This week’s recap highlights ransomware, malware variants, credential theft, supply chain vulnerabilities, and espionage tied to state actors like Hafnium and LockBit – Weekly Threat Recap

Cybersecurity News | Daily Recap – hendryadrian.com