Today's cybersecurity headlines feature critical warnings about actively exploited vulnerabilities in Joomla extensions and a new macOS infostealer. We also see significant policy action taken against Russian cyber activity and a notable data breach affecting a large taxi operator.
Critical Joomla Extension Flaws Under Active ExploitationVulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding two high-severity vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla. These flaws, both rated 10.0 on the CVSS scale, are being actively exploited in the wild, allowing attackers to achieve remote code execution through arbitrary file uploads.
Why it matters: If your website uses Joomla with either the iCagenda or Balbooa Forms extensions, it is critical to update them immediately to prevent attackers from taking control of your site.
Read more at The Hacker News ↗
New CrashStealer Malware Targets macOS UsersThreat
A recently discovered macOS information stealer, dubbed CrashStealer, is being distributed using a notarized dropper to bypass Apple's Gatekeeper security checks. This C++-based malware is designed to harvest sensitive data, including login credentials, keychain data, and cryptocurrency wallet information, by masquerading as an Apple crash reporting tool.
Why it matters: macOS users should be vigilant about unsolicited software downloads and ensure their systems are updated with the latest security patches to defend against sophisticated info-stealers.
Read more at The Hacker News ↗
ModHeader Browser Extension Pulled Due to Hidden Data CollectorVulnerability
Google and Microsoft have removed ModHeader, a popular browser extension with approximately 1.6 million installations on Chrome and Edge, from their respective stores. This action followed the discovery of a dormant browsing-history collector embedded within the extension's official version, though there is no evidence it was ever activated to collect or transmit data.
Why it matters: Regularly review and remove unnecessary browser extensions, as even trusted tools can harbor hidden components that pose privacy or security risks.
Read more at The Hacker News ↗
Forg365 PhaaS Targets Microsoft 365 Accounts with Advanced TacticsThreat
A new phishing-as-a-service (PhaaS) offering called Forg365 is actively targeting Microsoft 365 users. This service employs a combination of sophisticated techniques, including device code phishing, adversary-in-the-middle (AitM) attacks, and AI-assisted lure creation, to compromise accounts and conduct post-compromise mailbox operations.
Why it matters: Small businesses using Microsoft 365 should implement multi-factor authentication and educate employees about advanced phishing techniques, as these services make sophisticated attacks more accessible to criminals.
Read more at The Hacker News ↗
Japan's Largest Taxi Operator Suffers CyberattackBreach
Nihon Kotsu, Japan's largest taxi operator, has disclosed that its systems were compromised in a cyberattack, leading to the shutdown of portions of its infrastructure. The extent of the impact on customer data or services is currently under investigation.
Why it matters: Even major service providers are vulnerable to cyberattacks, underscoring the importance of robust cybersecurity measures and incident response plans for any business handling customer data.
Read more at BleepingComputer ↗
EU and UK Sanction Russian GRU HackersPolicy
The European Union and the United Kingdom have jointly imposed sanctions on several Russian individuals and entities, accusing them of involvement in a network of state-backed hacking groups. These groups are reportedly responsible for cyberattacks across Europe, targeting governments and critical infrastructure.
Why it matters: Increased international cooperation against state-sponsored cyber threats highlights the persistent risk to organizations, particularly those in critical sectors, from sophisticated geopolitical actors.
Read more at BleepingComputer ↗
US Sanctions VPN Service Aiding Ransomware GroupsPolicy
The U.S. Treasury Department has imposed sanctions on 'First VPN Service' (1VPNS) and its Ukrainian administrator for facilitating ransomware operations. Additionally, a Belarusian individual was sanctioned for providing malware 'cryptors' used by cybercriminals.
Why it matters: These sanctions demonstrate a global effort to disrupt the infrastructure used by ransomware groups, reducing their ability to operate and potentially lessening the overall threat to businesses.
Lidl Online Shop Data Breach Impacts Customers in EuropeBreach
German discount supermarket chain Lidl has informed customers in Germany, Belgium, and the Netherlands about a data breach affecting its online shop. The incident occurred at a service provider, leading to the unauthorized access and potential theft of personal customer information.
Why it matters: Businesses relying on third-party service providers must ensure robust security protocols are in place throughout their supply chain, as a breach at a partner can directly impact your customers.
Read more at BleepingComputer ↗
CISA's GitHub Leak Provides Lessons in Security ResponseOther
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a postmortem report on a recent data leak where a contractor inadvertently published internal CISA credentials, including AWS Govcloud keys, to a public GitHub repository for nearly six months. The report highlights crucial lessons for all security teams regarding incident detection and response.
Why it matters: This incident serves as a reminder that even top cybersecurity agencies can experience leaks. Small businesses should enforce strict access controls, regular code reviews, and automated scanning for exposed credentials to prevent similar mistakes.
Read more at Krebs on Security ↗
Misconfigured Server Exposes Microsoft 365 Phishing OperationsThreat
A misconfigured Python web server, left exposed on a public port with directory listing enabled, revealed extensive details about an attacker's live Microsoft 365 phishing operations. Security researchers were able to access the attacker's toolkit and identify two additional phishing campaigns due to this oversight.
Why it matters: Proper server configuration is paramount. Simple errors like leaving default directory listings enabled can expose your entire operation or, in this case, provide valuable intelligence to security researchers against attackers.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.