|
📌 Hackers spent a year quietly stealing corporate Salesforce data
LINK
|
- A year-long series of campaigns tied to the ShinyHunters group quietly stole corporate CRM data by abusing trusted Salesforce OAuth relationships to bypass MFA, with Microsoft observing the activity from mid-2025 through mid-2026 against retail, education, and manufacturing firms.
- The attacks exploited no Salesforce software flaw; instead, operators used voice phishing to impersonate IT support and trick employees into approving an attacker-controlled connected app posing as the legitimate Salesforce Data Loader, which then inherited the user's permissions to make API calls without re-authenticating.
- Because activity ran through valid OAuth sessions, attackers could enumerate environments, query and bulk-export CRM data, and find credentials to reach other SaaS services while evading login-based detection; Microsoft advises inventorying connected apps, validating OAuth scopes, revoking unused integrations, and tightening Experience Cloud guest permissions.
|
🍎 New Mac malware poses as Apple crash tool to steal passwords
LINK
|
- A new macOS information-stealing malware called CrashStealer disguises itself as Apple's crash-reporting tool, CrashReporter.app, to steal passwords, keychain data, browser logins, and crypto wallets from more than 80 wallet extensions.
- Researchers at Jamf observed the malware being used in attacks in early July, delivered through a signed and Apple-notarized installer named "Werkbit Setup" that bypasses Gatekeeper without warnings and shows a fake password prompt to unlock the user's Keychain.
- CrashStealer encrypts stolen data with AES-256-GCM before uploading it to a command-and-control server, and Jamf's report shares indicators of compromise including tool names, hashes, delivery infrastructure, and filesystem artifacts.
|
🔓 Hackers spoof Microsoft logins to test millions of passwords
LINK
|
- Attackers are spoofing Microsoft OAuth client IDs to secretly test millions of usernames and passwords against enterprise cloud accounts, letting them confirm valid logins while dodging the sign-in logs defenders normally rely on to spot such activity.
- Proofpoint says the technique, tracked in multiple large-scale campaigns hitting millions of accounts across thousands of Microsoft Entra ID tenants, sends POST requests to Microsoft's OAuth 2.0 token endpoint using the Resource Owner Password Credentials flow to submit usernames and passwords directly.
- The returned AADSTS error codes let unauthenticated attackers infer whether usernames, passwords, and MFA or conditional access are valid; defenders should treat sign-in entries with blank application IDs, or an AADSTS700016 code, as possible signs of compromised credentials.
|
📦 Hijacked npm packages spread botnet malware to developers
LINK
|
- Attackers hijacked three npm packages in the @asyncapi namespace to spread a multi-stage botnet loader to developers, targeting people who import the packages during normal development or CI workflows.
- The compromised versions — @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, and @asyncapi/generator 3.3.1 — hide a first-stage dropper in a utility file that runs on import and pulls an encrypted second stage, Miasma, from IPFS.
- The decrypted Miasma payload persists as sync.js and acts as a botnet with shell command execution, file operations, credential theft, and command-and-control, so users should rotate npm, GitHub, cloud, SSH, and CI secrets and watch for connections to 85.137.53.71.
|
🇷🇺 Russian hackers breach thousands of French accounts via SharePoint flaw
LINK
|
- French cyber investigators at C4 and CERT-FR linked the Turla espionage group to Russia's Federal Security Service, detailing intrusions against French ministries, diplomatic bodies, defense, justice-sector entities, and technology companies dating back to the 2010s.
- In 2019, Turla operators exploited a Microsoft SharePoint vulnerability on a French justice-sector server hosting a staff training service, installing malware that may have exposed information tied to several thousand user accounts.
- The group turned ordinary businesses, associations, and individuals into hidden relays to mask attacks, used malware like Uroburos and Kazuar plus Mimikatz and Metasploit, and blended into traffic through compromised servers and satellite communications.
|
|
