DJBSEC's CyberNews 3-18-25

Story 1. OAuth Attacks Target Microsoft 365 and GitHub Accounts

Cybercriminals are exploiting OAuth vulnerabilities to compromise Microsoft 365 and GitHub accounts. Attackers use fraudulent third-party applications to trick users into granting excessive permissions, enabling access to sensitive emails, repositories, and cloud resources. Once authorized, these apps can be used for data exfiltration and further phishing attacks. Security experts recommend reviewing OAuth app permissions regularly and restricting access to trusted applications only.
Read more here

Story 2. New Steganographic Malware Attack Hides Code Inside JPG Files

A newly discovered steganographic malware campaign is using image files to conceal malicious payloads. Attackers embed malware within seemingly harmless JPG images, which execute code when opened on a compromised device. This method allows cybercriminals to evade traditional antivirus detection while delivering remote access trojans (RATs) or keyloggers. Users are advised to avoid downloading images from untrusted sources and keep their security software updated.
Read more here

Story 3. Chinese Volt Typhoon Hackers Exploiting Cisco and Netgear Routers

The Chinese state-sponsored hacking group Volt Typhoon has been observed exploiting vulnerabilities in Cisco and Netgear routers. These compromised devices are being used as stepping stones for cyber-espionage campaigns targeting critical infrastructure. By hijacking consumer and enterprise networking equipment, the attackers can evade detection and establish persistent access. Security experts recommend updating router firmware and disabling remote management features.
Read more here

Story 4. Attackers Use CSS to Create Evasive Phishing Messages

A new phishing technique leverages Cascading Style Sheets (CSS) to evade email security filters and trick users into revealing credentials. By embedding malicious payloads in CSS files, attackers can create emails that bypass spam detection while appearing legitimate. This method makes phishing campaigns harder to detect and block. Experts advise users to verify email senders, avoid clicking on suspicious links, and enable multi-factor authentication (MFA).
Read more here

Story 5. 23,000 GitHub Repositories Targeted in Large-Scale Supply Chain Attack

A massive cyberattack campaign has targeted over 23,000 GitHub repositories, injecting malicious code into open-source projects. The attackers use dependency hijacking and repository takeover techniques to compromise software supply chains. Developers who unknowingly use infected dependencies may expose their applications to backdoors and data breaches. Security professionals recommend verifying package integrity and implementing strict repository security controls.
Read more here

Story 6. Toll Road Text Message Scam Spreads Nationwide

A phishing scam disguised as toll road payment notifications has been spreading rapidly across the U.S. Victims receive fraudulent text messages claiming they owe unpaid tolls, leading them to fake payment portals that steal financial details. Authorities warn that these scams are highly sophisticated and designed to mimic official transportation agencies. Drivers are advised to verify toll charges through official state websites and never click on unsolicited payment links.
Read more here

Story 7. Hackers Exploit ChatGPT Vulnerability CVE-2024-27564 in 10,000 Attacks

Threat actors have been exploiting a newly disclosed vulnerability, CVE-2024-27564, in ChatGPT-related APIs, enabling them to conduct over 10,000 attacks. This security flaw allows attackers to manipulate AI-generated responses, steal user data, and bypass content restrictions. Organizations integrating AI services are at risk of data leakage and misinformation attacks. Security experts recommend applying patches immediately and monitoring AI interactions for suspicious activity.
Read more here

Story 8. Free Online File Converters Are Installing Malware on Users’ Devices

Security researchers have found that many free online file conversion tools are secretly installing malware on users’ devices. These fraudulent sites trick users into uploading files for conversion while delivering hidden malware payloads in return. The malware includes spyware, keyloggers, and adware that compromise system security. Users are encouraged to use trusted software for file conversions and avoid suspicious websites.
Read more here