Security News Bundle.

September 09, 2025

"Axios abuse and Salty 2F Kits fuel Advance Microsoft 365 phishing attacks."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents. Accessed on 09 September 2025, 1512 UTC.

Content and Sources compiled by https://feedly.com.

https://feedly.com/i/collection/content/user/f401222a-bca6-4c45-9cc1-183f239e8d86/category/7737d3c9-5fe2-4b34-8708-85e57085f895

Please check email link or scroll down to read your selections. Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

Security News Bundle

93

Most popular

Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks
IoC > 1 domain
•
26The Hacker News / 24min
•
8 TTPs
Threat actors are abusing HTTP client tools like Axios in conjunction with Microsoft's Direct Send feature to form a "highly efficient attack pipeline" in recent phishing campaigns, according to new findings from ReliaQuest. "Axios user agent activity surged 241% from June to August 2025, dwarfing the 85% growth of all other flagged user agents combined," the cybersecurity company said in a
What the Plex? Streaming service suffers yet another password spill
The Register – Security / 1h
For the third time in a decade Streaming platform Plex is warning some users to reset their passwords after suffering yet another breach.…
Solar plus storage is just the start: How the most home-energy savvy slash their electric bills by 78%
ZDNet | Security / 1h
Investing in solar and battery storage has its challenges -- but also some big perks.

Today

Claude can create PDFs, slides, and spreadsheets for you now in chat
ZDNet | Security / 36min
Say goodbye to copy and pasting with this new feature from Anthropic.
Blink just raised its subscription price - but you get 2 new features in return
ZDNet | Security / 58min
It's the first time Blink has increased the price of its subscrption.
This 2FA phishing scam pwned a developer - and endangered billions of npm downloads
IoC > 1 domain and 1 email address
•
ZDNet | Security / 1h
•
Critical NPM hack threatens crypto funds
'Stay vigilant.' Other maintainers have been targeted, too.
Exposed Docker APIs Likely Exploited to Build Botnet
SecurityWeek / 1h
Hackers mount the host’s file system into fresh containers, fetch malicious scripts over the Tor network, and block access to the Docker API. The post appeared first on SecurityWeek .
SAP Patches Critical NetWeaver Vulnerabilities
SecurityWeek / 1h
The critical-severity NetWeaver flaws could be exploited for remote code execution and privilege escalation. The post appeared first on SecurityWeek .
Forget iPhone 17 Air - this ridiculously thin Android lasts all day and is only $200
ZDNet | Security / 1h
The Tecno Pova Slim just launched with a design that we may soon become very familiar with. Here's why the phone matters.
Microsoft: Anti-spam bug blocks links in Exchange Online, Teams
BleepingComputer / 1h
Microsoft is working to resolve a known issue that causes an anti-spam service to mistakenly block Exchange Online and Microsoft Teams users from opening URLs and quarantine some of their emails. [...]
Ransomware Losses Climb as AI Pushes Phishing to New Heights
SecurityWeek / 1h
Based on real-world insurance claims, Resilience’s midyear report shows vendor risk is declining but costly, ransomware is evolving with triple extortion, and social engineering attacks are accelerating through AI. The post appeared first on SecurityWeek .
Ex-WhatsApp Security Chief Sues Meta Over Vulnerabilities, Retaliation
Whistle-blower sues Meta over WhatsApp
•
SecurityWeek / 1h
Attaullah Baig has filed a lawsuit against Meta and its executives, accusing them of retaliation over critical cybersecurity failures. The post appeared first on SecurityWeek .
SAP fixes maximum severity NetWeaver command execution flaw
4 TTPs
•
29BleepingComputer / 1h
SAP has addressed 21 new vulnerabilities affecting its products, including three critical severity issues impacting the NetWeaver software solution. [...]
RatOn Android Malware Detected With NFC Relay and ATS Banking Fraud Capabilities
Input Capture (Mobile T1417)
•
60The Hacker News / 1h
A new Android malware called RatOn has evolved from a basic tool capable of conducting Near Field Communication (NFC) relay attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) capabilities to conduct device fraud. "RatOn merges traditional overlay attacks with automatic money transfers and NFC relay functionality – making it a uniquely powerful threat,"
SentinelOne Announces Plans to Acquire Observo AI
SentinelOne acquires Observo AI
•
Dark Reading / 2h
The combined company will help customers separate data ingestion from SIEM, to improve detection and performance.
160,000 Impacted by Wayne Memorial Hospital Data Breach
Impact (Enterprise TA0040)
•
SecurityWeek / 3h
•
Wayne Memorial Hospital data breach
In May 2024, hackers stole names, Social Security numbers, financial information, and protected health information from the hospital’s systems. The post appeared first on SecurityWeek .
Microsoft testing new AI features in Windows 11 File Explorer
Windows 11 introduces AI features
•
44BleepingComputer / 3h
Microsoft is testing new File Explorer AI-powered features that will enable Windows 11 users to work with images and documents without needing to open the files. [...]
Threat Actor Connected to Play, RansomHub and DragonForce Ransomware Operations
SecurityWeek / 4h
The attacker deployed multiple malware families, including two backdoors and a proxy tunneller, and various reconnaissance tools. The post appeared first on SecurityWeek .
From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks
31 TTPs
•
24The Hacker News / 4h
•
MostereRAT malware targets Windows users
Cybersecurity researchers have disclosed details of a phishing campaign that delivers a stealthy banking malware-turned-remote access trojan called MostereRAT. The phishing attack incorporates a number of advanced evasion techniques to gain complete control over compromised systems, siphon sensitive data, and extend its functionality by serving secondary plugins, Fortinet FortiGuard Labs said. "
TOR-Based Cryptojacking Attack Expands Through Misconfigured Docker APIs
IoC > 1 domain
•
49The Hacker News / 4h
•
23 TTPs
Cybersecurity researchers have discovered a variant of a recently disclosed campaign that abuses the TOR network for cryptojacking attacks targeting exposed Docker APIs. Akamai, which discovered the latest activity last month, said it's designed to block other actors from accessing the Docker API from the internet. The findings build on a prior report from Trend Micro in late June 2025, which
[Webinar] Shadow AI Agents Multiply Fast — Learn How to Detect and Control Them
32The Hacker News / 4h
⚠️ One click is all it takes. An engineer spins up an “experimental” AI Agent to test a workflow. A business unit connects to automate reporting. A cloud platform quietly enables a new agent behind the scenes. Individually, they look harmless. But together, they form an invisible swarm of Shadow AI Agents—operating outside security’s line of sight, tied to identities you don’t even know exist.
Mitsubishi Electric to Acquire Nozomi Networks for Nearly $1 Billion
Mitsubishi Electric acquires Nozomi Networks
•
SecurityWeek / 4h
The industrial cybersecurity firm will become a wholly owned subsidiary of Mitsubishi Electric. The post appeared first on SecurityWeek .
Nokia successor HMD spawns secure device biz with Euro-made smartphone
The Register – Security / 4h
Ivalo XE handset targets governments and security critical sectors, though Qualcomm silicon keeps it tied to the US Finnish phone maker HMD Global is launching a business unit called HMD Secure to target governments and other security-critical customers, and has its first device ready to go.…

Yesterday

Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed
IoC > 4 hashes
•
Trend Micro Research, News and Perspecti... / 5h
•
55 TTPs
An analysis of the Gentlemen ransomware group, which employs advanced, adaptive tactics, techniques, and procedure to target critical industries worldwide.
Anthropic's Claude Code runs code to test if it is safe – which might be a big mistake
The Register – Security / 5h
AI security reviews add new risks, say researchers App security outfit Checkmarx says automated reviews in Anthropic's Claude Code can catch some bugs but miss others – and sometimes create new risks by executing code while testing it.…
How Leading CISOs are Getting Budget Approval
27The Hacker News / 5h
It’s budget season. Once again, security is being questioned, scrutinized, or deprioritized. If you're a CISO or security leader, you've likely found yourself explaining why your program matters, why a given tool or headcount is essential, and how the next breach is one blind spot away. But these arguments often fall short unless they're framed in a way the board can understand and appreciate.
Plex Urges Password Resets Following Data Breach
SecurityWeek / 6h
Hackers accessed emails, usernames, password hashes, and authentication data stored in a Plex database. The post appeared first on SecurityWeek .
SentinelOne to Acquire Observo AI in $225 Million Deal
SentinelOne acquires Observo AI
•
SecurityWeek / 7h
SentinelOne is buying Observo AI for a combination of cash and stock to boost its SIEM and data offerings. The post appeared first on SecurityWeek .
20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack
9 TTPs
•
100+The Hacker News / 7h
Multiple npm packages have been compromised as part of a software supply chain attack after a maintainer's account was compromised in a phishing attack. The attack targeted Josh Junon (aka Qix), who received an email message that mimicked npm ("support@npmjs[.]help"), urging them to update their update their two-factor authentication (2FA) credentials before September 10, 2025, by clicking on
12+ laptop accessories that I recommend to both students and professionals
ZDNet | Security / 7h
These accessories can turn your basic laptop setup into an exceptional one (and you don't have to spend an arm and a leg).
This Fedora spin is perfect for one particular kind of new Linux user
ZDNet | Security / 8h
With Windows 10 support ending, you might be looking for an alternative. If you like the idea of Fedora, but are afraid it isn't user-friendly enough, Nobara has your back.
UK toughens Online Safety Act with ban on self-harm content
UK tightens Online Safety Act
•
The Register – Security / 8h
Charities welcome change, but critics warn the law is already too broad Tech companies will be legally required to prevent content involving self-harm from appearing on their platforms – rather than responding and removing it – in a planned amendment to the UK's controversial Online Safety Act.…
LunaLock Ransomware threatens victims by feeding stolen data to AI models
3 TTPs
•
Security Affairs / 9h
•
LunaLock threatens Artists&Clients users
LunaLock, a new ransomware gang, introduced a unique cyber extortion technique, threatening to turn stolen art into AI training data. A new ransomware group, named LunaLock, appeared in the threat landscape with a unique cyber extortion technique, threatening to turn stolen art into AI training data. Recently, the LunaLock group targeted the website Artists&Clients and stole digital art. The grou
Forget disappearing messages – now Signal will store 100MB of them for you for free
Signal introduces cloud backup feature
•
The Register – Security / 11h
Including messages sent to users, a potential problem for the privacy-conscious Encrypted messaging app Signal is rolling out a free storage system for its users, with extra space if folks are willing to pay for it.…
How to undo OneDrive Backup and restore your personal files to your Windows 11 PC
ZDNet | Security / 12h
Microsoft is getting more aggressive about insisting that you use its OneDrive cloud for your Windows 11 and Microsoft 365 files. If you'd prefer to keep those files out of the cloud, follow these step-by-step instructions.
Traveling soon? 5 simple ways I thwart phone thieves - and you can too
ZDNet | Security / 13h
Phone theft is on the rise. Here are a few simple but effective things anyone can do to protect their device while on the go.
The iPhone 17 series could be Apple's boldest move in years - here's why
ZDNet | Security / 13h
The iPhone is getting its biggest shakeup since the Mini was introduced in 2020. How will consumers respond?
45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage
IoC > 1 domain
•
58The Hacker News / 13h
Threat hunters have discovered a set of previously unreported domains, some going back to May 2020, that are associated with China-linked threat actors Salt Typhoon and UNC4841. "The domains date back several years, with the oldest registration activity occurring in May 2020, further confirming that the 2024 Salt Typhoon attacks were not the first activity carried out by this group," Silent Push
Plex tells users to reset passwords after new data breach
Exfiltration (Enterprise TA0010)
•
74BleepingComputer / 14h
•
Plex security breach prompts password resets
Media streaming platform Plex is warning customers to reset passwords after suffering a data breach in which a hacker was able to steal customer authentication data from one of its databases. [...]
WhatsApp's former security boss claims reporting infosec failings led to ousting
Whistle-blower sues Meta over WhatsApp
•
The Register – Security / 15h
Meta shrugs off allegations of improper dismissal, ignoring privacy and security WhatsApp's former head of security, Attaullah Baig, has filed a lawsuit against its parent company, Meta, alleging that the social media megalith retaliated against him for reporting security failings that violated legal commitments.…
Signal lets you back up your chats for free now - plus its first-ever paid feature
Signal introduces cloud backup feature
•
ZDNet | Security / 15h
The new backup feature is opt-in. But there's a catch to that.
New 3D mapping tech goes way beyond GPS to let us see the earth in ways never before possible
ZDNet | Security / 15h
Project Orbion brings together several cutting edge technologies to create a digital twin of the planet that will enable geospatial vision like we've never seen before.
Surge in networks scans targeting Cisco ASA devices raise concerns
Massive scan targets Cisco ASA
•
43BleepingComputer / 17h
Large network scans have been targeting Cisco ASA devices, prompting warnings from cybersecurity researchers that it could indicate an upcoming flaw in the products. [...]
7 most exciting tech accessories from IFA 2025 (and that you can actually buy)
ZDNet | Security / 17h
IFA 2025 had some really cool charging accessories and audio products. Here are my favorite picks from the show.
The US government has no idea how many cybersecurity pros it employs
GAO highlights cyber workforce data gaps
•
The Register – Security / 18h
Auditors find federal cybersecurity workforce data messy, incomplete, and unreliable The US federal government employs tens of thousands of cybersecurity professionals at a cost of billions per year – or at least it thinks it does, as auditors have found the figures are incomplete and unreliable. …
'MostereRAT' Malware Blends In, Blocks Security Tools
Dark Reading / 18h
A threat actor is using a sophisticated EDR-killing malware tool in a campaign to maintain long-term, persistent access on Windows systems.
Salesloft Breached via GitHub Account Compromise
2 TTPs
•
Dark Reading / 18h
•
Salesloft Drift breach impacts companies
The breach kickstarted a massive supply chain attack that led to the compromise of hundreds of Salesforce instances through stolen OAuth tokens.
Why I recommend these OnePlus earbuds over pricier models (including AirPods) - and they're on sale
ZDNet | Security / 19h
In addition to their flagship-level noise cancellation, the OnePlus Buds 4 provide bass-heavy audio and in-depth customization.
Drift massive attack traced back to loose Salesloft GitHub account
2 TTPs
•
The Register – Security / 19h
•
Salesloft Drift breach impacts companies
Meanwhile the victim count grows The Salesloft Drift breach that compromised "hundreds" of companies including Google, Palo Alto Networks, and Cloudflare, all started with miscreants gaining access to the Salesloft GitHub account in March.…
Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack
IoC > 1 domain
•
21BleepingComputer / 19h
•
4 TTPs
•
GhostAction attack steals 3325 secrets
A new supply chain attack on GitHub, dubbed 'GhostAction,' has compromised 3,325 secrets, including PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys. [...]
Hackers breached Salesloft ’s GitHub in March, and used stole tokens in a mass attack
Salesloft Drift breach impacts companies
•
Security Affairs / 19h
Hackers breached Salesloft’s GitHub in March, stole tokens, and used them in a mass attack on several major tech customers. Salesloft revealed that the threat actor UNC6395 breached its GitHub account in March, stealing authentication tokens that were later used in a large-scale attack against several major tech customers. Salesforce data theft attacks impacted major customers like Google , Zscal
Report: OpenAI will launch its own AI chip next year
ZDNet | Security / 19h
The company behind ChatGPT is working with Broadcom to create its own custom GPUs, which it will reportedly use exclusively for internal purposes.
You can buy Samsung's Galaxy S25 FE for only $6 a month - how the deal works
ZDNet | Security / 19h
AT&T's promotion for new and current customers amounts to a whopping 66% discount on Samsung's latest midrange handset.
Looking for the fastest iPhone 17 model? These iPhone 16 speed test results can help
Apple C1 modem performance compared
•
ZDNet | Security / 19h
Pit the iPhone 16's Qualcomm modem against Apple's C1 modem in the iPhone 16e, and the winner largely depends on your carrier and location.
Signal adds secure cloud backups to save and restore chats
Signal introduces cloud backup feature
•
30BleepingComputer / 19h
Signal has introduced a new opt-in feature that helps users create end-to-end encrypted backups of their chats, allowing them to restore messages even if their phones are damaged or lost. [...]
Dev snared in crypto phishing net, 18 npm packages compromised
6 TTPs
•
The Register – Security / 20h
•
Critical NPM hack threatens crypto funds
Popular npm packages debug, chalk, and others hijacked in massive supply chain attack Crims have added backdoors to at least 18 npm packages after developer Josh Junon inadvertently authorized a reset of the two-factor authentication protecting his npm account.…
Google Meet is back after an outage. Here are a few workarounds for next time
Google services experience widespread outage
•
ZDNet | Security / 20h
The popular video conferencing service experienced a major outage. Here's what happened.
Linus Torvalds warns Linux devs: Stop cluttering patches with automated, useless links
ZDNet | Security / 20h
'Stop this garbage already.'
Lovesac confirms data breach after ransomware attack claims
8 TTPs
•
21BleepingComputer / 20h
•
Lovesac suffers significant data breach
American furniture brand Lovesac is warning that it suffered a data breach impacting an undisclosed number of individuals, stating their personal data was exposed in a cybersecurity incident. [...]
Sports streaming piracy service with 123M yearly visits shut down
BleepingComputer / 20h
Calcio, a large piracy sports streaming platform with more than 120 million visits in the past year, was shut down following a collaborative effort by the Alliance for Creativity and Entertainment (ACE) and DAZN. [...]
Salt Typhoon used dozens of domains, going back five years. Did you visit one?
IoC > 1 domain
•
The Register – Security / 21h
•
4 TTPs
Plus ties to the Chinese spies who hacked Barracuda email gateways Security researchers have uncovered dozens of domains used by Chinese espionage crew Salt Typhoon to gain stealthy, long-term

Comments